Nutanix NCP-NS study guide
Nutanix NCP-NS · Work through your exam, one topic at a time.
The Nutanix Certified Professional – Security (NCP-NS) is a professional-level credential for people who design, deploy, and operate security controls on Nutanix infrastructure. It assumes you already know your way around Prism and AHV and asks you to reason about how identity, segmentation, encryption, and audit evidence fit together across clusters and Prism Central - not just to name the menus where those settings live. The Nutanix NCP-NS study guide has 7 sections and about 2,142 words.
01Security Fundamentals and the Nutanix Security Architecture
Nutanix security is defense in depth across four planes: physical/hardware, the AOS distributed storage fabric plus the AHV hypervisor, the management plane (Prism Element per cluster, Prism Central per fleet), and the workload/data plane. Every control you will be asked about belongs to one of these.
280 words, about 1 min02Identity, Authentication, and Access Control
Authentication answers who : local Prism accounts (your break-glass access), Active Directory/LDAP directory services, or a SAML 2.0 identity provider. Authorization answers what : RBAC roles bound to users or groups through role mappings, then scoped by categories or Projects.
320 words, about 2 min03Network Segmentation and Flow Network Security Policy Design
Flow Network Security is a distributed firewall enforced inside the AHV virtual switch and managed from Prism Central. Policies are written against categories , not IP addresses, and are distributed to every host - so VM-to-VM traffic is filtered whether the two VMs sit on the same host or different hosts.
309 words, about 2 min04Data-at-Rest Encryption and Key Management
Data-at-Rest Encryption is an AOS software feature that encrypts data on the cluster's storage devices using AES-256 (XTS mode) - no self-encrypting drives required. It is enabled per cluster, ideally at cluster creation; some later AOS releases allow enabling on an existing cluster, so read the version in the question carefully.
307 words, about 2 min05Cluster Hardening, Certificates, and Trusted/Secure Boot
Change factory default credentials immediately, enforce length/complexity/lockout through Prism Central security settings, and limit Prism UI/API access to a management network. Close unused services, remove stale images and dormant VMs, track who holds Super Admin, and keep AOS, AHV, and Prism Central current via LCM (life cycle management).
302 words, about 2 min06Security Monitoring, Auditing, and Compliance Reporting
Audit logs record who changed what and when - configuration and API actions. Tasks show job progress.
321 words, about 2 min07Workload and Data Protection Security (Replication, Backup, Recovery)
Protection Domains group VMs and volume groups. Consistency groups keep multi-VM application sets consistent across snapshots.
303 words, about 2 min