Nutanix NCP-NS study plan

Map how Nutanix Flow policy models (security policy categories, policy types, and rule precedence) apply to a three-tier application by sketching isolation rules for web, app, and database tiers

Differentiate policy enforcement modes (monitor vs. enforce) and predict the traffic outcome for a given source-destination-service tuple

Define policy objects (categories, VM tags, address groups, service groups) and explain how dynamic category-based membership changes rule scope when a VM is re-tagged

Build a written rule matrix for a sample app showing default-deny behavior plus explicit allow rules for each required flow

Design a multi-environment segmentation scheme (prod/dev/dmz) using categories so that no cross-environment allow rule is required

Trace how traffic flows between VLAN-backed subnets and overlay networks and identify where policy enforcement is applied

Explain how Flow interacts with the platform's distributed firewall placement and what happens to policy when a VM migrates between hosts

Connect segmentation design to the broader security architecture principles of least privilege, defense in depth, and east-west traffic control

Configure role-based access control by matching built-in and custom roles to least-privilege task lists for admin, operator, and auditor personas

Differentiate local authentication from directory-backed authentication and describe the object hierarchy used when binding to a directory service

Explain how authentication source ordering and fallback affect login behavior for a user who exists in both local and directory stores

Design a permission model where project-level scoping limits a team to its own VMs and networks

Walk through the SAML/SSO assertion exchange sequence and identify which identity provider attributes must map to platform-side user attributes

Explain how identity provider-initiated and service provider-initiated flows differ and what breaks when metadata or certificate rotation is mishandled

Describe multi-factor authentication enforcement points and where in the login chain they apply

Tie identity controls back to the security architecture by describing the trust boundary between the identity provider and the cluster

Differentiate data-at-rest encryption approaches available at the cluster and volume level and state which workloads each suits

Explain the key hierarchy from master key to data encryption key and describe what happens to data access when a key server is unreachable

Compare key management deployment models (external key server vs. local key manager) on availability, compliance, and operational cost

Plan a key rotation and recovery procedure that includes escrow, re-keying order, and a rollback path

Harden a cluster by enumerating the configuration items to lock down (default accounts, password policy, session timeouts, unused services) and rank them by risk

Trace the cluster certificate chain and describe the steps to replace an expired or untrusted certificate without breaking management or replication traffic

Distinguish trusted boot from secure boot by describing what each verifies, at which stage, and what attestation evidence each produces

Describe how to detect and respond to a boot integrity failure, including which logs and states to inspect first

Identify the audit event categories generated by authentication, policy change, and administrative actions and map each to a detection use case

Design alert rules for three high-value scenarios (repeated failed logins, firewall policy deletion, new admin account creation) with thresholds and notification paths

Assemble a compliance evidence package that maps platform controls to at least one common framework's control objectives

Explain log retention, export, and integrity considerations for audit records used in an investigation

Apply encryption, access control, and network policy requirements to replication and backup traffic paths and identify where data is exposed in transit and at rest

Describe how to secure backup targets and recovery workflows, including credential handling and restore authorization boundaries

Reconcile all seven domains into a single defense-in-depth narrative that names the control at each layer

Audit the earlier deliverables for gaps and update the two weakest ones with corrected configuration details