NCP-MCA Nutanix Certified Professional - Multicloud Automation (NCP-MCA 6.10) Exam Questions and Answers

To ensure that Prism Central sends the appropriate notifications (Alerts/Events) to ServiceNow—allowing ServiceNow's Event Management to process them viaEvent Rules—the administrator must configure an X-Play Playbook that exports these alerts.

According to the Prism Central Intelligent Operations Guide (ServiceNow Integration):

Export of alertsfrom Prism Central is achieved by creating an X-Play playbook.

The administrator should use theAlerts Matching Criteriatrigger. This trigger allows the administrator to define the scope of the export (e.g., "All Critical Alerts" or specific categories).

The Playbook then uses theSend Alert to ServiceNowaction to push these matching alerts to the ServiceNow Event API.

By configuring a Playbook with theAlerts Matching Criteriatrigger, the administrator ensures a continuous, policy-based flow of event data into ServiceNow, satisfying the requirement for Event Rules to have data to process. Option A describes the action but lacks the governing trigger mechanism (matching criteria) that defines "appropriate" events for the integration.

The placement of applications in Nutanix Self-Service is dictated by the intersection of theProjectconfiguration and theBlueprintdefinition.

Project Construct:The Project defines which infrastructure accounts (Providers) are available for use (e.g., AHV, AWS, Azure). If the Project is configured to allow access tobothAWS and another provider (like on-prem AHV or Azure), the potential exists for deployment to those targets.

Blueprints:The Blueprint (or the specific Environment selected at launch) dictates where the workload actually goes. If the administrator intended "Only AWS," but the Project allows multiple providers and the Blueprints (or the users launching them) are configured to use a non-AWS environment, the application will be deployed there.

Therefore, the cause is that theProject construct(allowing multiple clouds) and theBlueprints(utilizing those available clouds) are configured to allow this distribution. To restrict it, the administrator should remove the unintended providers from the Project's "Infrastructure" or "Environment" settings.

Creating and managingPlaybookswithin the Intelligent Operations (X-Play) feature of Prism Central requires an administrative role with sufficient privileges to define system-wide automation rules.

Prism Admin:ThePrism Admin(or Super Admin) role is explicitly required to create, edit, enable, and manage Playbooks. This role grants full control over the Intelligent Operations module.

Prism Viewer (A):This role has read-only access and can view Playbooks but cannot create or modify them.

Self-Service Admin (D):This role is specific to the Self-Service (Calm) application and its blueprints/projects, not the X-Play automation engine in Prism Central.

Nutanix Playbooks allowevent-driven automation.

Documentation states that Playbooks can:

Trigger onVM Powered Offevents

Filter targets usingcategories(e.g., OSType: Linux, Environment: Dev)

Perform actions such asVM Reduce CPU,VM Resize, etc.

To automatically and immediately update CPU count when the VM powers off, the proper method is:

✔Use aPlaybook

✔Trigger:VM Powered Off

✔Target VMs using categories

✔Action:VM Reduce CPU

Self-Service Runbooks (Option D) are manually executed; they do not automatically trigger on events.

Therefore,Option Cis correct.

The scenario describes a "Zero Trust" style Security Policy (Flow Network Security) where all traffic is blocked unless explicitly allowed by a rule matching a Category.

The Rule:The policy specifically states that SSH (port 22) traffic is allowedonlyfor VMs tagged with the category AppType: Admin-VM.

The Issue:The deployed VM cannot be accessed via SSH. This indicates that the VM does not match the allow rule.

The Fix:The Blueprint used to deploy these Administrator VMs must be updated toassign the AppType: Admin-VM categoryto the VM service definition.

Once the VM is deployed with this tag, the Flow Security Policy will recognize it and permit the inbound SSH traffic. Assigning Web-Servers (Option B) would open port 443, not 22.

When creating a variable in a Nutanix Self-Service Blueprint or Runbook, the administrator must select aData Type. The standard supported data types areString,Integer,Date,Time, andDateTime.

String (Single-line):This is the fundamental text data type (typically just labeled "String" in the UI). It is used for standard alphanumeric inputs.

Input Options:While a String variable can be configured with an attribute to accept "Multi-line" input (useful for SSH keys or scripts), the base data type itself isString(which defaults to single-line).

Invalid Options:"Multi-line integer" is not a valid type. "Year Month Day" is a format description, not the name of theDatedata type. Therefore,Single-line string(representing the standard String type) is the correct available option among the choices.

In Nutanix Self-Service (formerly Calm),Macrosare used to reference variables within scripts, task definitions, and configurations. The documented syntax for all macros requires the variable name to be enclosed within double "at" symbols and curly braces.

Syntax:@@{variable_name}@@

Usage:This format is used for both user-defined variables (e.g., @@{db_password}@@) and built-in system macros (e.g., @@{address}@@, @@{calm_time}@@, @@{calm_project_name}@@).

Evaluation:When the Self-Service engine executes a task, it parses the string, identifies the pattern @@{...}@@, and substitutes it with the actual value of the variable from the current context before sending the script to the target machine.

In Nutanix Self-Service Runbooks, tasks that execute scripts (such as Shell for Linux or PowerShell for Windows) require a target destination. This target is defined as an Endpoint.

AnEndpointconfigures the connection details (IP address, port, connection protocol, and credentials) required to communicate with the remote machine where the script will run. Without selecting a valid Endpoint, the Runbook engine does not know where to send the script for execution.

In Nutanix Prism Central Disaster Recovery, when a Prism Central instance fails over to a recovered site, several automation components—including Playbooks—must be revalidated. Nutanix documentation clearly states:

Playbooks store encrypted credentials locally in the Prism Central database.

When Prism Central is recovered on a DR site, the credential encryption keys donottransfer.

As a result,any credentials previously stored in Playbooks become invalidand must be manually re-entered.

This requirement ensures that the scripts, tasks, remediation sequences, and integrations invoked by the Playbook can authenticate properly after recovery.

Therefore:

Playbookscannot automatically use previously stored credentialsafter a DR failover.

Administrators mustre-enter all credentialsin enabled Playbooks so the automation continues functioning.

Hence, OptionCis correct.

Options A and D are incorrect because Playbooks donotautomatically retain functional credentials after DR recovery.

Option B is incorrect because the presence or absence of a credential provider does not change the need to re-enter credentials.

In Nutanix Self-Service (Calm), applications deployed through Projects can performSnapshot actionson VMs. Snapshot expiration is governed bySnapshot Policies, which define:

Retention period

Number of snapshots to retain

Expiration / deletion schedule

Nutanix documentation specifies thatsnapshot expiration is controlled at the Environment level, which belongs to aProject. When a Snapshot action is executed through Self-Service, Calm references theSnapshot Policy associated with that Environmentto determine how the snapshot will be retained and when it will expire.

Thus, to enforce expiration on snapshots taken from Self-Service:

✔You must create a Snapshot Policy for the Environments in the Project.

Why the other options are incorrect

❌B. MST (Multicloud Snapshot Technology)

MST is used for cross-cloud replication and storage integration—not for setting snapshot expiration policies.

❌C. Approval Policy

Approval Policies govern user-request approval workflows, not snapshot retention.

❌D. Protection Domain

Protection Domains are for DR replication and do not manage snapshot expiration for Calm Self-Service actions.

Comprehensive and Detailed Explanation

Self-Service platform sync allows Prism Central to periodically collect updates from external providers.

Nutanix documentation states that the providers supportingplatform sync with a 20-minute update windoware:

Nutanix (AHV)

VMware (vSphere)

AWS

These environments support the metadata collection necessary for tracking:

IP changes

Disk resizing

VM availability

Thus, the valid set isNutanix, VMware, and AWS, makingOption Ccorrect.

Nutanix Disaster Recovery usesProtection Policiesto automate replication. These policies are applied to VMs dynamically based onCategories. To protecteveryVM from both blueprints described, the administrator must select a category that iscommon to bothsets of VMs.

Blueprint 1 Categories:OSType: Windows, AppType:IIS

Blueprint 2 Categories:OSType: Windows, Environment:Dev

Commonality:The category OSType: Windows is assigned in both blueprints.

Configuration:By creating a Protection Policy that targets the category OSType: Windows, any VM deployed fromeitherblueprint will automatically inherit this tag. Consequently, the Disaster Recovery engine will immediately detect the new VM and begin replicating it according to the policy (Asynchronous, 1 hour) without manual intervention.

Options B and D would only protect a subset of the VMs (only IIS servers or only Dev workstations, respectively).

The requirement to restrict VMs to specific physical hosts for licensing purposes is addressed usingVM-Host Affinity Policiesin Nutanix AHV, which relies onCategories. The complete configuration workflow is:

Categorization (Step 1):The administrator must create specific categories to tag the entities. One category (e.g., License:Oracle) is assigned to the specificHosts(the licensed ones). Another category (e.g., App:Database) is created for theVMs.

Affinity Policy (Step 2):An Affinity Policy is created in Prism Central that strictly enforces that any VM with the App:Database category must run on hosts with the License:Oracle category.

Blueprint Assignment (Step 3):In the Self-Service Blueprint, the administrator configures the VM service to automatically apply the App:Database category upon creation.

When the blueprint is deployed, the VM is created with the category, and the AHV scheduler immediately respects the Affinity Policy, ensuring the VM only starts on the licensed hosts.

Options A and C are incomplete (Categories alone do not enforce placement), and Option B (Playbook migration) is a reactive "fix" rather than a proactive placement constraint, which risks non-compliance at startup.

To successfully create, validate, and publish blueprints to the Self-Service Marketplace (formerly Calm Marketplace), aProjectmust be configured with the following two essential components:

Infrastructure (A):

The Infrastructure configuration (often found under the "Infrastructure" or "Accounts" tab in the Project settings) is the foundational requirement. It allows the administrator to select which Cloud Provider accounts (such as Nutanix AHV, VMware vSphere, AWS, Azure, or GCP) are available for use within that specific project. Without configuring Infrastructure, the project has no access to resource providers, and therefore no blueprints can be created or validated for publication.

Environments (B):

The Environment configuration is critical for the "Blueprint to Marketplace" workflow. An Environment defines the specific compute, network, and storage profiles for the infrastructure selected in the project (e.g., mapping a specific AHV Cluster and Network to the project).

During Creation:A blueprint relies on the Project Environment to define its platform-specific settings (like Images and Networks) while being designed and tested.

During Publication & Launch:When a blueprint is published to the Marketplace, it is often published "without platform-dependent configuration" to make it portable. This portability relies entirely on the destination Project having a configuredEnvironment. When a user launches a Marketplace item, the Self-Service engine "patches" the abstract blueprint requirements with the concrete details (Network, Cluster, Credentials) defined in the Project'sEnvironment.

Policies (C)(such as Quotas and Approvals) andTunnels (D)(used for network connectivity in hybrid/VPC scenarios) are optional configurations and are not strictly required to publish a blueprint to the marketplace.

The image typically displays the Project configuration tabs: "Users, Groups, & Roles," "Infrastructure," "Environments," "Policies," and "Quotas," visually confirming the hierarchy where Infrastructure and Environments are the primary configuration steps for resource definition.

When a Playbook fails to fire despite an Alert occurring, the most common and "likely" cause is a mismatch in theTriggerconfiguration logic.

Trigger Precision:X-Play Triggers are precise. If the administrator selected theAlerttrigger, they must select asingle specificAlert Policy (e.g., "Host High Memory"). If the high-severity alert that occurred was "VM High Memory" (a different policy), the Playbook will not trigger, even if both are "High Severity."

Alerts Matching Criteria:To coverallhigh-severity alerts, the administrator must use theAlerts Matching Criteriatrigger and filter by Severity == Critical. If they used the specific "Alert" trigger or configured the criteria incorrectly (e.g., wrong entity type), the system is "working as implemented" (ignoring non-matching events), but the logic does not match the user's intent.

Autopilot (Option C):While X-Play has an Autopilot feature for KPI optimization, it is not a mandatory requirement for standard alert-based remediation playbooks to function.

The image typically shows the distinction between the "Alert" trigger (Select one policy) and "Alerts Matching Criteria" trigger (Select filters like Severity/Entity), illustrating how a configuration error here leads to the issue described in Question 40.

In the Nutanix Cloud Platform,Categoriesare the fundamental metadata structure used to group and tag resources (such as VMs, Hosts, and Blueprints) for management purposes.

Functionality:Categories are key-value pairs (e.g., CostCenter:Marketing or Environment:Production) that provide a logical abstraction layer above the physical infrastructure.

Usage:

Cost Allocation:Nutanix Cost Governance (formerly Beam) uses categories to map resource consumption to specific business units or budgets.

Reporting:Prism Central uses categories to filter and group entities in reports.

Compliance/Security:Flow Network Security policies rely on categories to define traffic rules (e.g., "Allow traffic from App:Web to App:DB").

Protection:Disaster Recovery policies assign replication schedules based on categories.

Differentiation:"Labels" is a term often used in Kubernetes or public cloud (AWS/Azure tags), but "Categories" is the specific terminology and feature implementation within Nutanix Prism Central.

Nutanix Calm and Self-Service automation workflows require validation within the same execution context used by end users. Nutanix documentation specifies the following principles:

1. Playbook validation requires execution in the same user and project context

Playbooks that target resources using aCalmProjectcategory must be tested in the exact context in which they will operate.

The"Execute on behalf of"option allows the administrator to run the Playbookas if a project user initiated it, ensuring validation of:

Project-based scoping

User permissions

Category-based triggers

Playbook logic and automation flow

This matches the documented requirement that Playbooks must be validated under theintended user execution model, makingOption B correct.

2. Deployment must occur inside the Project to activate category-driven Playbooks

Blueprint deployments only trigger Playbooks when:

The deployment occursinside the Project, and

The VM receives metadata (such as CalmProject category) associated with that Project.

Nutanix Calm documentation highlights that Playbooks relying onProject categoriesonly activate when VMs are provisionedfrom that specific Project.

Deploying from the Marketplace does not guarantee that the correct project context or categories will be applied.

Thus, verifying Playbook execution requires deploying the blueprint assigned to the Project, makingOption D correct.

Why the other options are incorrect

❌Option A – “Execute”

This executes Playbooks only in the admin context, not the Project context. It doesnotvalidate permissions, user behavior, or category-based triggers required for Self-Service operation.

❌Option C – Marketplace deployment

Marketplace deployments do not necessarily apply Project-specific categories or metadata, so they cannot reliably test integration with Playbooks bound to a Project.

When configuring aNutanix(AHV) provider account within Self-Service (formerly Calm) to deploy infrastructure, the fundamental artifact required for VM provisioning is anAHV Image.

AHV Image:Nutanix AHV uses theImage Serviceto manage disk images (typically in QCOW2 or ISO format) that serve as the base for virtual machines. Before a Blueprint can be designed or deployed on a Nutanix account, a validDisk Imagemust be uploaded to the Prism Central Image Service. This image is then referenced in the Blueprint's VM configuration (Substrate) as the "Disk Image" source.

Contrast with other Providers:

VMware Template (Option B):This is the required artifact for theVMware vSphereprovider.

VHD (Option A):Typically associated with Hyper-V or Azure.

OVA (Option C):An export format, not a direct provisioning source for the Nutanix provider within Self-Service.

Therefore, ensuring anAHV Imageexists and is available on the cluster is the specific pre-configuration requirement for the Nutanix provider.

When troubleshooting or optimizing blueprints where complex operations (like Provisioning combined with detailed Network Configuration) frequently fail, the recommended best practice is to split the steps into smaller tasks.

In Nutanix Self-Service (Calm), theAudittab provides a sequential log of every task executed during an application's lifecycle. If provisioning and network configuration are bundled into a "single step" (e.g., a large script or a single package install), a failure makes it difficult to determine if the issue was with the VM creation, the OS boot, or the specific network parameter application.

By splitting the logic into distinct tasks (e.g., Task 1: Provision VM, Task 2: Configure Network), the administrator can:

Isolate the failure:The Audit log will clearly show "Provision VM: Success" and "Configure Network: Failed".

Validate inputs:It ensures the VM is fully available before attempting configuration.

Improve Auditing:Granular logs allow for faster root cause analysis of the "misconfigured parameters."

Retrying (Option B) or adding delays (Option D) are reactive measures that do not address the root cause of configuration errors, and disabling logging (Option C) hinders troubleshooting.

In Nutanix Self-Service (Calm), to share a Runbook across multiple projects, it must be published to the Marketplace.

When an administrator selects an existing Runbook and chooses the "Publish" option:

Secret Handling:The system strictly enforces thatsecrets (passwords/keys) are not published. The administrator is required to verify that no secret values are hardcoded. Any sensitive variables are stripped or must be set to runtime input during the publication process.

Project Selection:During the publication or approval workflow via theMarketplace Manager, the administrator configures theProject Sharingsettings. This determines which projects have access to view and execute the Runbook from the Marketplace.

It is not necessary to clone the Runbook first; the publication process itself creates the Marketplace entry derived from the source Runbook.

Among the options provided, calm_unique is the standard built-in macro provided by the Self-Service engine.

Purpose:The @@{calm_unique}@@ macro generates a unique, short alphanumeric string at runtime.

Use Case:It is widely used in Blueprints to ensure uniqueness for VM names, hostname prefixes, or other resources that cannot have duplicate identifiers within the infrastructure (e.g., naming a VM Web-@@{calm_unique}@@ to prevent naming collisions).

Other Options:calm_date, calm_generate_uuid, and calm_math are not standard built-in macro names in the Self-Service macro library (though calm_time and calm_now exist for time-based operations).

When creating a Runbook that involves power cycling a VM (Restart), there is a gap in connectivity while the Guest OS reboots and network services initialize.

If the Runbook moves immediately from the "VM Restart" task to the "Add new credential" task (which likely uses SSH or PowerShell to connect to the VM), the connection will fail because the VM is not yet accessible.

To correct this, the administrator must insert a Delay task between the restart and the configuration step.

The sequence should be:

VM Restart:Initiates the reboot.

Delay:Pauses the runbook execution for a set duration (e.g., 60-120 seconds) to allow the OS to boot.

Add new credential:Executes the script once the VM is back online.

Nutanix Calm documentation states thatApplication Profiles (App Profiles)define:

Default variable values

Deployment targets (cluster, subnet, environment)

Runtime configuration differences across environments

App Profiles act aslogical deployment configurationswithin a blueprint, allowing the same blueprint to be deployed differently across staging, test, or production environments.

Thus, the correct answer isC. App Profiles.

According to the Nutanix Prism Central Admin Guide, a category is a grouping of entities into key-value pairs. Categories are used to group entities (such as VMs, hosts, or subnets) based on specific criteria (e.g., Department: Marketing or Environment: Production).

Once entities are assigned to a category, administrators can link policies (such as security, protection, or automation playbooks) to the category rather than to individual entities. This allows for scalable and dynamic management, as any new entity tagged with that category will automatically inherit the associated policies.

To provide users with access to Nutanix Self-Service (formerly Calm), an administrator must configure Role-Based Access Control (RBAC) within the context of a Project.

Access to Self-Service is not global; it is defined at the Project level.1An administrator must:

Add the user (or their Active Directory group) to a Project.

Assign a Roleto that user within the project.

Project Admin:Full control over the project.2

Developer:Can create blueprints and applications.

Consumer:Can only launch blueprints available in the Marketplace.3

Operator:Can perform day-2 operations on existing applications.4

Without an assigned role in a project, a user cannot access the Self-Service portal features or view any blueprints.

To automate actions based on a signal from a third-party monitoring tool, the administrator should use the Webhook Trigger in Nutanix Intelligent Operations (X-Play).

Webhook Trigger:The administrator creates a playbook that starts with a Webhook Trigger. This generates a unique URL.

Integration:The third-party tool is configured to send an HTTP POST request (the notification) to this unique URL when the "low capacity" threshold is reached.

Automation:Receiving this signal automatically triggers the playbook to execute the expansion tasks (e.g., calling APIs to provision more VDI nodes or expand storage), removing the manual step.

While "Alert" (Option D) is used for native Nutanix alerts, the "Webhook" is the designated mechanism for receiving external events.

In Nutanix Self-Service (Calm),Endpointsare external execution targets used by Playbooks and Runbooks to run scripts or automation tasks. Nutanix documentation specifies the followingvalid Endpoint types:

Windows Endpoint

Linux Endpoint

Database Endpoints(e.g., PostgreSQL, MySQL)

HTTP/Webhook Endpoints

Calm identifiesWindowsandLinuxmachines as valid, manageable Endpoints, meaning administrators can run scripts, commands, and automation tasks on them.

Why the correct answer is B (Windows)

Windows is explicitly listed as a supported Endpoint type.It supports script execution (PowerShell), credential storage, and remote orchestration through Calm.

Why the other options are incorrect

❌A. API Gateway

An API Gateway isnot an Endpoint typein Self-Service; it is not used for script execution or orchestration.

❌C. CentOS

Although CentOS is a Linux distribution, Calm doesnotregister distribution-specific Endpoints like "CentOS."

Instead, it uses thegeneric Linux Endpoint type, not OS-specific entries.

Therefore, "CentOS" isnota selectable Endpoint type.

❌D. Kubernetes

A Kubernetes cluster can be integrated with Nutanix, but it isnot classified as a Playbook/Runbook Endpointin Self-Service.

Kubernetes resources are handled through Calm Blueprints—not through Endpoint registration for automation tasks.