Nutanix NCP-NS flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Controller VM

A per-node virtual machine in a Nutanix cluster that runs AOS storage and management services; Prism Element, Stargate, and many security-relevant services run inside it.

Category

A key-value label assigned to VMs in Prism; it is the scoping primitive for Flow security policies, protection policies, and category-scoped RBAC roles that apply to matching VMs.

Security Central

A Prism Central capability that aggregates security posture and compliance findings for managed clusters, reporting drift against hardening baselines so administrators can remediate from one dashboard.

Distributed firewall placement

Nutanix Flow enforces policy inside AHV's Open vSwitch at each VM's virtual NIC, so packets are filtered on the host before reaching the guest operating system.

Management and data planes

Nutanix separates the management plane (Prism UI and API), the control plane (CVM services such as Stargate), and the data plane (AHV hosts and disks); security controls apply at each layer.

SAML service provider

In Nutanix single sign-on, Prism acts as the SAML service provider: authentication happens at the external identity provider, and Prism authorizes the returned identity using its own RBAC roles.

RBAC scope

The boundary a role assignment applies to, either the whole Prism Central deployment or a set of VMs selected by categories, restricting what the user can view or change.

Directory group mapping

Assigning Nutanix roles to an Active Directory or LDAP group rather than to individual accounts, so role changes follow group membership and offboarding is automatic.

Local break-glass account

A locally defined Prism account kept for emergencies when the directory or identity provider is unreachable; it should hold a strong unique password and be monitored through audit logs.

Prism Viewer role

A built-in Nutanix role granting read-only visibility of the Prism interface, used for auditors and helpdesk staff who must inspect the environment but must not modify it.

Isolation policy

A Flow policy that denies all traffic to and from VMs matched by its categories except explicitly allowed flows; commonly used to quarantine a suspected-compromised workload.

Flow monitor mode

A policy state in which Flow logs which connections would be allowed or denied without dropping traffic, letting administrators validate rules before enforcement.

Service group

A reusable Flow object listing ports and protocols, such as TCP 443 or UDP 53, that many security policies reference instead of repeating port definitions individually.

Flow hitlog

A per-policy record of connections matching Flow rules, showing source, destination, port, action, and timestamp; used for troubleshooting and forwardable to syslog.

Default deny in Flow

Once a VM falls within an enforced Flow policy, all traffic that is not explicitly permitted is dropped, so policies must include required management and application flows.

Data-at-rest encryption

Nutanix software encryption that encrypts cluster disk data using AES-256 in XTS mode below the storage layer, transparently to guest VMs and their file systems.

KMIP key management server

An external or Nutanix-provided server that stores and serves the master keys used by data-at-rest encryption; the cluster itself stores only wrapped data encryption keys.

Key rotation

Replacing the encryption keys held by the key management server; superseded keys must be retained until data encrypted under them has been re-encrypted or deleted.

KMS unavailability risk

If the key management server is unreachable, a node that reboots may be unable to unwrap its data keys and fail to come online, so KMS availability must be resilient.

Cluster Lockdown

A Nutanix hardening setting that restricts SSH and API access to the Controller VMs to an allowlist of IP addresses, leaving Prism as the normal administrative path.

TPM measured boot

AHV hosts with TPM 2.0 record boot measurements in platform configuration registers; attestation compares them with expected values and flags tampering in Security Central.

UEFI Secure Boot

A firmware mode that verifies signatures of the bootloader and kernel before execution; Nutanix supports it on AHV hosts and can enable it for individual guest VMs.

CA-signed certificate replacement

Replacing Prism and CVM self-signed certificates with certificates from a trusted CA and importing the issuing chain into the cluster trust store so nodes trust each other.

NCC health check

Nutanix Cluster Check, an on-cluster diagnostic utility that runs hundreds of checks on configuration, services, and best practices to validate hardening and readiness for upgrades.

Prism audit log

A record of every administrative and API action in Prism, capturing the user, timestamp, operation, and target resource; the primary evidence source for access reviews.

Syslog forwarding

Configuring Prism to send alerts, audit, and system logs to external syslog collectors so records survive beyond on-cluster retention and reach a SIEM.

Time synchronization requirement

All Controller VMs and hosts must use consistent NTP sources; clock skew breaks certificate validation and makes correlation of audit logs across systems unreliable.

Compliance reporting

Security Central and the Nutanix security configuration guides map cluster settings to CIS-style and STIG-style controls and produce findings that can be exported as audit evidence.

Protection policy

A Prism Central object that applies snapshot and replication schedules to VMs selected by category, replacing per-VM protection domains with centrally managed RPO and retention rules.

NearSync replication

A Nutanix asynchronous replication mode with a recovery point objective measured in seconds, achieved by scheduling very frequent snapshots to a remote cluster for disaster recovery.

Metro Availability

Synchronous replication between two sites in a stretched cluster that provides a zero recovery point objective; both sites hold the same data and a site failure loses no writes.

Recovery plan test

A non-disruptive run of a Nutanix Leap recovery plan that powers on VMs at the target site from replicated snapshots to validate recovery time without affecting production.