Security Fundamentals and the Nutanix Security Architecture
The layered picture
Nutanix security is defense in depth across four planes: physical/hardware, the AOS distributed storage fabric plus the AHV hypervisor, the management plane (Prism Element per cluster, Prism Central per fleet), and the workload/data plane. Every control you will be asked about belongs to one of these. Prism Element governs a single cluster; Prism Central governs many and hosts the fleet-wide services - Flow Network Security, identity and access management, Key Manager, and posture/compliance tooling. A frequent trap is assuming a feature configured in Prism Element also appears in Prism Central, or vice versa: they are separate appliances with separate authentication, certificates, and settings.
Concepts to know
Least privilege, separation of management and data networks, secure defaults versus operator-enabled controls, and the shared responsibility model for Nutanix Cloud Clusters running in a public cloud. Be able to separate platform capabilities (microsegmentation, data-at-rest encryption, RBAC, audit) from add-on or third-party products. Nutanix publishes hardening guidance and holds validations such as FIPS 140-2 for its cryptographic module, Common Criteria, and DISA STIG alignment; remember that a certification belongs to a specific version and configuration, not to the product name in general.
Rule of thumb
If a control is not explicitly configured and verified in Prism, treat it as absent. Nutanix ships sensible defaults, but password policy, syslog forwarding, encryption, and flow enforcement are all opt-in.