I85PREP
⌘ K
Nutanix NCP-NS study materials
Nutanix NCP-NS study resources

Nutanix NCP-NS practice questions

One question at a time. Build your Nutanix NCP-NS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Security Fundamentals and Nutanix Security Architecture

What is the primary effect of enabling Cluster Lockdown mode on a Nutanix cluster?

  1. It forces all Prism logins to use SAML SSO.
  2. It encrypts all data stored on the cluster.
  3. It disables SSH access to the Controller VMs. Correct answer.
  4. It blocks all inbound traffic to guest VMs.

Explanation

Cluster Lockdown restricts administrative access by disabling SSH to the Controller VMs, so management must be performed through Prism. It is an access-control hardening feature, not an encryption or traffic-filtering feature.

Question 2Security Fundamentals and Nutanix Security Architecture

Where is the Nutanix Flow distributed firewall enforced?

  1. At the Prism Central management plane.
  2. At the guest VM operating system.
  3. At the AHV host virtual switch. Correct answer.
  4. At the physical top-of-rack switch.

Explanation

Flow enforcement happens in the AHV host's virtual networking layer, filtering traffic before it leaves the host. Prism Central only defines and distributes policies.

Question 3Security Fundamentals and Nutanix Security Architecture

In Nutanix Flow, how are VMs grouped for security policy application?

  1. By their storage container names.
  2. By their IP addresses only.
  3. By categories, which are key-value pairs. Correct answer.
  4. By their MAC addresses only.

Explanation

Flow uses categories, which are key-value metadata assigned to VMs, to define dynamic groups for policies. This avoids relying on static IP or MAC addresses.

Question 4Security Fundamentals and Nutanix Security Architecture

Which Prism Central built-in role grants full access, including user and role management?

  1. Super Admin Correct answer.
  2. Operator
  3. Viewer
  4. Consumer

Explanation

Super Admin has complete control of Prism Central, including identity and access management. Other built-in roles have narrower scopes.

Question 5Security Fundamentals and Nutanix Security Architecture

Which standard does Prism Central use to support single sign-on with an external identity provider?

  1. SAML 2.0 Correct answer.
  2. RADIUS
  3. TACACS+
  4. Kerberos 5

Explanation

Prism Central supports SAML 2.0 for SSO with external identity providers. RADIUS and TACACS+ are not the SSO standard used by Prism.

Question 6Security Fundamentals and Nutanix Security Architecture

What is the purpose of the Audit page in Prism Central?

  1. To record user and system actions for accountability. Correct answer.
  2. To manage encryption keys.
  3. To configure VLANs on AHV.
  4. To display storage capacity trends.

Explanation

Audit logs record who performed which actions and when, supporting compliance and troubleshooting. Capacity, VLAN, and key management are handled elsewhere.

Question 7Security Fundamentals and Nutanix Security Architecture

What does Nutanix Data-at-Rest Encryption (DARE) protect?

  1. Data stored on physical disks. Correct answer.
  2. Data in transit between hosts.
  3. Data in memory on the Controller VM.
  4. Data in backup snapshots only.

Explanation

DARE encrypts data at rest on the cluster's physical storage. It does not encrypt data in transit or only backups.

Question 8Security Fundamentals and Nutanix Security Architecture

What is the primary function of Nutanix Security Central?

  1. Providing microsegmentation enforcement.
  2. Assessing security posture and compliance. Correct answer.
  3. Encrypting data at rest.
  4. Managing AHV host certificates.

Explanation

Security Central performs security posture and compliance assessments and provides remediation guidance. Microsegmentation is a Flow capability.

Question 9Security Fundamentals and Nutanix Security Architecture

How does Data-at-Rest Encryption (DARE) differ from Self-Encrypting Drives (SEDs)?

  1. DARE is hardware-based; SEDs are software-based.
  2. DARE requires no keys; SEDs require external KMIP.
  3. DARE encrypts only backups; SEDs encrypt primary storage.
  4. DARE is software-based; SEDs are hardware-based. Correct answer.

Explanation

DARE is a software encryption layer in AOS, while SEDs perform encryption in the drive hardware. Both require key management.

Question 10Security Fundamentals and Nutanix Security Architecture

Which Flow policy type is used to isolate a VM from nearly all network traffic?

  1. Application
  2. Isolation
  3. Monitor
  4. Quarantine Correct answer.

Explanation

A Quarantine policy blocks all traffic except essential services such as DHCP and DNS. Application and Isolation policies allow defined traffic.

Question 11Security Fundamentals and Nutanix Security Architecture

What happens when a Flow policy is set to Monitor mode?

  1. Policy is disabled and not evaluated.
  2. Traffic is dropped silently.
  3. Traffic is blocked and logged.
  4. Traffic is allowed and logged without enforcement. Correct answer.

Explanation

Monitor mode logs policy hits but does not enforce the action, which is useful for testing before enforcement. Enforce mode actually blocks traffic.

Question 12Security Fundamentals and Nutanix Security Architecture

What is the role of a KMIP server in a Nutanix encrypted cluster?

  1. It distributes VLAN configuration to AHV hosts.
  2. It stores VM snapshots off-cluster.
  3. It manages encryption keys externally. Correct answer.
  4. It authenticates Prism users via LDAP.

Explanation

KMIP is a protocol for external key management, allowing DARE to use a KMS for encryption keys. It does not handle user authentication or VLANs.

Question 13Security Fundamentals and Nutanix Security Architecture

How can an administrator replace the default self-signed Prism certificate?

  1. By creating a Flow isolation policy.
  2. By enabling Cluster Lockdown.
  3. By rotating the DARE master key.
  4. By uploading a CA-signed certificate in Prism. Correct answer.

Explanation

Prism allows importing a CA-signed certificate and private key to replace the self-signed certificate. The other actions do not affect the web certificate.

Question 14Security Fundamentals and Nutanix Security Architecture

Which authentication sources can Prism Central use for user login?

  1. Local, AD, LDAP, and SAML. Correct answer.
  2. Only SAML and TACACS+ identity providers.
  3. Only local Prism user accounts.
  4. Only Active Directory and RADIUS servers.

Explanation

Prism Central supports local accounts, Active Directory, LDAP, and SAML identity providers. It does not rely on only one source.

Question 15Security Fundamentals and Nutanix Security Architecture

A Flow policy must allow web VMs to reach app VMs on TCP 8080. What defines the web and app groups?

  1. Assigned VM categories. Correct answer.
  2. Storage container names.
  3. Physical switch port numbers.
  4. Controller VM IP addresses.

Explanation

Flow policies use categories assigned to VMs to select source and destination groups. Policies then specify allowed services such as TCP 8080.

Question 16Security Fundamentals and Nutanix Security Architecture

After enabling Cluster Lockdown, how is it disabled?

  1. By running ncli from an SSH session.
  2. By resetting the CVM root password.
  3. By rebooting the cluster.
  4. Through the Prism Element interface. Correct answer.

Explanation

Lockdown disables SSH to the CVMs, so it must be disabled through Prism. Rebooting or resetting passwords does not turn it off.

Question 17Security Fundamentals and Nutanix Security Architecture

Which practice best applies the principle of least privilege in Prism Central?

  1. Granting only the roles needed for each task. Correct answer.
  2. Assigning Super Admin to all users for simplicity.
  3. Disabling audit logging to reduce overhead.
  4. Sharing a single admin account across teams.

Explanation

Least privilege means granting users the minimum permissions required for their responsibilities. Overprivileged or shared accounts increase risk.

Question 18Security Fundamentals and Nutanix Security Architecture

Which component is required to manage Flow Network Security policies?

  1. Nutanix Mine.
  2. Prism Element only.
  3. Prism Central. Correct answer.
  4. Nutanix Files.

Explanation

Flow Security Central is a Prism Central feature used to define and manage Flow policies. Prism Element alone does not provide Flow policy management.

Question 19Security Fundamentals and Nutanix Security Architecture

How does Security Central differ from Flow Network Security?

  1. Security Central assesses compliance; Flow enforces policies. Correct answer.
  2. Both only manage user authentication.
  3. Both only encrypt data at rest.
  4. Security Central enforces microsegmentation; Flow assesses compliance.

Explanation

Security Central focuses on security posture and compliance assessment, while Flow provides distributed firewall enforcement and microsegmentation.

Question 20Security Fundamentals and Nutanix Security Architecture

What is a primary security benefit of using VLANs in AHV networking?

  1. They encrypt VM disks.
  2. They segment network traffic. Correct answer.
  3. They provide SSO for Prism.
  4. They replace Flow policies entirely.

Explanation

VLANs logically segment network traffic into separate broadcast domains, helping limit lateral movement. They complement rather than replace Flow policies.

Question 21Security Fundamentals and Nutanix Security Architecture

In a Flow Quarantine policy, which traffic is typically still permitted?

  1. DHCP and DNS only. Correct answer.
  2. All east-west traffic.
  3. Only SSH from administrators.
  4. All traffic from the same VLAN.

Explanation

Quarantine isolates VMs while allowing essential services such as DHCP and DNS so the VM can still function on the network. Other traffic is blocked.

Question 22Security Fundamentals and Nutanix Security Architecture

Which statement about DARE key management is correct?

  1. DARE cannot use an external key manager.
  2. DARE uses the guest VM's own encryption keys.
  3. DARE supports external KMIP key servers. Correct answer.
  4. DARE keys are stored unencrypted on each CVM.

Explanation

DARE can integrate with external KMIP-compliant key management servers to manage encryption keys. Keys are not stored unencrypted, and guest VM keys are not used.

Question 23Security Fundamentals and Nutanix Security Architecture

By default, how does Flow treat traffic that does not match any policy?

  1. It is denied and logged.
  2. It is routed to Prism Central.
  3. It is allowed. Correct answer.
  4. It is quarantined.

Explanation

Flow is not default-deny; traffic that does not match a policy is allowed unless an explicit deny, quarantine, or default-deny policy is applied. This makes policy design important.

Question 24Security Fundamentals and Nutanix Security Architecture

Which administrative capability is lost when Cluster Lockdown is enabled?

  1. Running ncli or acli over SSH. Correct answer.
  2. Viewing audit logs.
  3. Creating Flow policies in Prism Central.
  4. Accessing Prism Element via HTTPS.

Explanation

Lockdown disables SSH access to the CVMs, so CLI tools such as ncli and acli cannot be run over SSH. Prism-based management remains available.

Question 25Security Fundamentals and Nutanix Security Architecture

Which Prism Central role is designed for self-service users to manage only their own VMs?

  1. Super Admin
  2. Consumer Correct answer.
  3. Viewer
  4. Operator

Explanation

The Consumer role provides limited self-service access to resources owned by the user. Super Admin, Viewer, and Operator have broader or different scopes.

Question 26Security Fundamentals and Nutanix Security Architecture

Which information security principle is violated when an unauthorized user successfully alters a stored record and the change goes undetected?

  1. Confidentiality
  2. Integrity Correct answer.
  3. Availability
  4. Non-repudiation

Explanation

Integrity is the principle that data remains accurate and unaltered except through authorized, accountable changes, so undetected tampering is an integrity failure. Availability concerns timely access to data, and confidentiality concerns preventing unauthorized disclosure. Non-repudiation concerns proving that a party performed an action.

Question 27Security Fundamentals and Nutanix Security Architecture

Two guest VMs on the same AHV host must exchange traffic that a Flow Network Security policy governs. Where is that policy enforced?

  1. Only inside the guest operating system's own host firewall
  2. In the AHV host virtual switch, at each VM's virtual NIC Correct answer.
  3. Solely on the upstream top-of-rack switch that connects the AHV hosts
  4. On a dedicated Flow virtual appliance deployed per VLAN

Explanation

Flow Network Security is a distributed firewall built into AHV: rules are programmed into the host virtual switch and applied at each guest's virtual NIC, so they work even for traffic that never leaves the host. No separate appliance or physical switch is required for intra-host enforcement, and protection does not depend on guest-side configuration.

Question 28Security Fundamentals and Nutanix Security Architecture

Several Flow Network Security policies match the same traffic flow with different actions. How does AHV determine which action to take?

  1. It evaluates rules by priority, and the first matching rule decides the action Correct answer.
  2. It distributes the flow across the matching rules in round-robin order
  3. It applies the rule that was created most recently
  4. It applies every matching rule and allows the flow only if all of them allow it

Explanation

Flow policies carry a priority, and the policy set is evaluated in priority order so that the first rule matching a flow determines its fate; lower-priority rules are not consulted once a match occurs. This makes rule ordering an explicit design decision rather than an accident of creation time. Evaluation is deterministic, so no flow is spread across conflicting rules.

Question 29Security Fundamentals and Nutanix Security Architecture

A Flow policy is scoped to the category Environment:Production. A week later a new VM is assigned that category. What is the result?

  1. The VM is placed in a quarantine state for a grace period
  2. The VM is unaffected until the policy is manually reapplied
  3. The policy covers the VM automatically, with no policy edit required Correct answer.
  4. The VM must be restarted before the policy can take effect

Explanation

Flow policies are defined against categories, and category membership is evaluated dynamically, so any VM that gains the category immediately falls within the policy's scope. This is what allows microsegmentation rules to scale as workloads are created, cloned, or moved. Neither a restart nor a manual policy refresh is needed.

Question 30Security Fundamentals and Nutanix Security Architecture

An administrator signs in to Prism Central through the corporate identity provider and authentication succeeds, but the interface shows no clusters and no VMs. Which configuration issue most likely explains this?

  1. The identity provider's SAML signing certificate has expired
  2. The user's password does not satisfy the Prism Central complexity policy
  3. The Prism Central instance has Cluster Lockdown enabled
  4. The user's directory group is not mapped to any Prism Central role Correct answer.

Explanation

Authentication proves identity, while authorization determines what the account can see and do; in Prism Central, directory users receive permissions only through roles mapped to their directory groups. A successful login with an empty view therefore points to missing group-to-role mapping rather than a credential problem. Correcting the mapping grants the intended role scope.

Question 31Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

Which directory service types can be configured in Prism for user authentication?

  1. Kerberos and NIS
  2. Active Directory and LDAP Correct answer.
  3. OAuth and OpenID Connect
  4. RADIUS and TACACS+

Explanation

Prism supports external authentication against Microsoft Active Directory and generic LDAP directories; both are configured as directory services. RADIUS and TACACS+ are used for network device AAA, not Prism user authentication, and OAuth/OIDC are not directory service protocols used for Prism login.

Question 32Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

Which local user account is created by default on a Nutanix cluster and has full administrative privileges in Prism?

  1. prism
  2. nutanix
  3. root
  4. admin Correct answer.

Explanation

The admin account is the built-in local administrator created during cluster deployment. It authenticates against Prism and holds full privileges; other local OS accounts such as root and nutanix are for controller VM access, not Prism login.

Question 33Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

Which built-in Prism Central role grants full access, including the ability to manage users, roles, and authentication settings?

  1. Backup Admin
  2. VM Admin
  3. Super Admin Correct answer.
  4. Prism Viewer

Explanation

Super Admin is the built-in Prism Central role that includes identity and access management privileges. Other built-in roles grant scoped rights to VMs, backups, or monitoring but not to users and roles.

Question 34Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

Which built-in role provides read-only access to the Prism Central UI without permitting configuration changes?

  1. Prism Viewer Correct answer.
  2. VM Admin
  3. Network Admin
  4. Super Admin

Explanation

The Prism Viewer role grants read-only visibility into Prism Central without change rights. Administrative roles such as Super Admin, VM Admin, and Network Admin include modification permissions.

Question 35Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

Which version of SAML does Prism Central use for single sign-on integration with an identity provider?

  1. SAML 3.0
  2. SAML 2.0 Correct answer.
  3. SAML 4.0
  4. SAML 1.1

Explanation

Prism Central implements SAML 2.0, the current SAML standard, for SSO with identity providers. SAML 1.1 is legacy, and SAML 3.0 and 4.0 do not exist.

Question 36Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

Which TCP port is used for secure LDAP (LDAPS) when Prism connects to a directory server?

  1. 443
  2. 3268
  3. 636 Correct answer.
  4. 389

Explanation

LDAP uses TCP 389 for cleartext or StartTLS, while LDAPS uses TCP 636. Port 443 is HTTPS, and 3268 is the Active Directory global catalog port.

Question 37Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

What does role-based access control (RBAC) in Prism use to determine what an authenticated user can do?

  1. The order in which users authenticate to Prism
  2. The license tier that is applied to the cluster
  3. The role assigned to the user or group Correct answer.
  4. The source IP address of the user's browser session

Explanation

RBAC grants permissions to users based on the role assigned to them or to a directory group they belong to. Source IP, licensing, and login order do not determine authorization in Prism.

Question 38Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

In Prism Central, where are directory services and SAML SSO configured?

  1. Settings > Licensing
  2. Settings > Alerts
  3. Settings > Authentication Correct answer.
  4. Settings > Cluster Details

Explanation

In Prism Central, directory services and SAML SSO are configured from Settings > Authentication. Licensing, alerts, and cluster details are unrelated to identity configuration.

Question 39Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

An administrator wants domain users to log in to Prism Central with their Active Directory credentials. Which sequence of steps is required?

  1. Configure a SAML identity provider and map the domain to it
  2. Create a matching local user account for every domain user
  3. Add the AD domain, then assign roles to users or groups Correct answer.
  4. Enable cluster lockdown first, then add the domain to Prism

Explanation

Directory users log in with their AD credentials only after the domain is added as an authentication source and roles are assigned to those users or their groups. Creating duplicate local accounts is unnecessary and defeats centralized identity management.

Question 40Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

When configuring SAML SSO with an external identity provider such as ADFS, what does Prism Central require from the identity provider?

  1. The Active Directory domain administrator account password
  2. A full copy of the Prism Central configuration database backup
  3. The identity provider metadata and signing certificate Correct answer.
  4. A list of every local user account configured in Prism Central

Explanation

Prism Central acts as the SAML service provider and must trust the identity provider through its metadata, which contains endpoints and the signing certificate. Database backups, domain admin passwords, and local user lists are not part of SAML trust establishment.

Question 41Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

A user authenticates successfully through SAML SSO but sees no clusters or resources after login. What is the most likely cause?

  1. No Prism Central role is assigned to the user or their group Correct answer.
  2. The user's Active Directory password has expired and must be changed
  3. The identity provider's SAML signing certificate has expired
  4. SAML SSO requires the user to also have a local Prism account

Explanation

Successful authentication only proves identity; authorization requires a Prism Central role. If no role is assigned directly or through a mapped directory or SAML group, the user can log in but sees nothing.

Question 42Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

When adding an LDAP directory to Prism that does not allow anonymous queries, what must be supplied?

  1. The private key that is used by the LDAP server for TLS
  2. A bind DN and password for a service account Correct answer.
  3. A Kerberos keytab file generated for the Prism Central host
  4. The local admin password of every controller VM in the cluster

Explanation

When anonymous queries are disabled, Prism must authenticate to the directory with a bind distinguished name and password, typically for a read-only service account. A private key, keytab, or controller VM password does not provide LDAP bind credentials.

Question 43Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

In Prism Central, what is the primary purpose of a project?

  1. To group resources for scoped role assignment Correct answer.
  2. To provide a secondary authentication source for Prism Central
  3. To store the disk images that are used by virtual machines
  4. To replace the default local admin account after installation

Explanation

A project groups resources so roles can be assigned on a subset rather than the whole Prism Central environment. It is not an image store, an authentication source, or a replacement for the admin account.

Question 44Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

A user must be able to create, update, and delete VMs but must not change Prism Central authentication settings. Which built-in role best fits?

  1. Prism Viewer
  2. Backup Admin
  3. Super Admin
  4. VM Admin Correct answer.

Explanation

VM Admin grants VM lifecycle operations without identity and access management or global settings changes. Super Admin is broader, Prism Viewer is read-only, and Backup Admin covers data protection.

Question 45Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

When joining a Nutanix cluster to an Active Directory domain for authentication, which credentials are required?

  1. A domain account with computer join rights Correct answer.
  2. The password of the local Prism administrator account
  3. A read-only LDAP bind account configured in the directory
  4. The Nutanix support account that is provided by the vendor

Explanation

Joining a cluster to Active Directory requires a domain account that is allowed to create or join computer objects in the target organizational unit. A local Prism password, read-only bind account, or vendor support account does not carry domain join rights.

Question 46Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

An administrator enables cluster lockdown on a Nutanix cluster. What is the result for administrative access?

  1. Direct Prism Element access is restricted to Prism Central Correct answer.
  2. All REST API access to the cluster is permanently disabled for every user
  3. Every user must authenticate with a hardware token before logging in
  4. Only read-only access remains available to administrators

Explanation

Cluster lockdown restricts direct Prism Element access so that management flows through Prism Central, reducing the exposed attack surface. It does not disable APIs permanently, require hardware tokens, or force read-only access.

Question 47Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

An administrator who authenticated to Prism Central through Active Directory leaves the company. What is the correct way to remove their Prism Central access?

  1. Remove the SAML identity provider configuration from Prism Central
  2. Change the password of the Prism Central local admin account
  3. Delete the cluster and then rebuild it from a configuration backup
  4. Remove the user from the AD group that grants the role Correct answer.

Explanation

Directory-authenticated users derive access from their group memberships, so removing the granting group or disabling the account removes access at the next authentication. Deleting the cluster, changing local admin passwords, or removing the identity provider are unrelated or destructive.

Question 48Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

An administrator needs to grant a contractor temporary read-only access to Prism Central without creating an Active Directory account. What is the appropriate approach?

  1. Enable cluster lockdown to restrict access to the cluster
  2. Assign the contractor the Super Admin role for the duration
  3. Create a local user and assign the Prism Viewer role Correct answer.
  4. Add the contractor's personal LDAP server as a Prism directory

Explanation

A local Prism Central user with a read-only role gives temporary access without creating an AD identity. Super Admin is excessive, adding a personal LDAP server is inappropriate, and cluster lockdown does not grant access.

Question 49Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

Which built-in Prism Central role is intended for users who manage protection domains and recovery points but not other infrastructure?

  1. Network Admin
  2. Backup Admin Correct answer.
  3. Super Admin
  4. Prism Viewer

Explanation

Backup Admin is scoped to protection domains, snapshots, and recovery operations. Prism Viewer is read-only, Network Admin covers networking, and Super Admin is unrestricted.

Question 50Identity, Authentication, and Access Control (Directory Services, RBAC, SAML/SSO)

A directory user's only Prism Central role comes from membership in an AD group. The user is removed from that group in Active Directory. What happens on the next authentication?

  1. The user's local Prism password is reset
  2. The user is converted into a local Prism user
  3. The user keeps the role until an administrator removes it manually in Prism
  4. The user no longer receives the role and loses the associated access Correct answer.

Explanation

Role inheritance from a directory group is evaluated when the user authenticates. Once removed from the group, the user no longer receives that role and the associated permissions.