Security, Access Control, and Compliance
This domain tests identity, authorization, network segmentation, encryption, and audit for VDI on Nutanix. The exam expects least privilege and defense in depth, not just a VLAN.
Core rules
- Prism uses role-based access control. Map AD/LDAP groups to roles; reserve Super Admin for break-glass; separate infrastructure admins from desktop operators.
- Frame supports SSO through an identity provider and group-based entitlements. Enforce MFA at the IdP; do not rely on local Frame passwords for production.
- Nutanix Flow provides microsegmentation. Start with a default-deny policy in a monitor-only mode, then allow only required flows: user-to-gateway, broker-to-host, host-to-AD/DNS, and management.
- Encrypt data at rest where required and manage keys separately; encryption does not replace access control.
- Harden images: patch, remove unused roles, restrict local admin, enable logging, and scan before publishing.
- Send Prism and Frame audit logs to a central SIEM; review failed logons, policy changes, and admin actions.
Worked example
A VDI subnet must allow users but block lateral movement. Put session hosts in a dedicated VLAN, create Flow policies allowing only the broker and management networks to reach them, allow desktops to reach AD, DNS, and the profile share, and deny all other east-west traffic. Test in monitor mode, then enforce. Reasoning: VLANs isolate broadcast domains but do not inspect flows; Flow enforces identity-aware rules.
Traps
Using one shared admin account; exposing RDP directly to the internet; relying on VLANs alone; enabling default-allow Flow rules; forgetting service accounts in segmentation; assuming encryption satisfies compliance without logging and access review.