NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Questions and Answers

NC2 on AWS allows for the dynamic addition ofAmazon EBS volumesto bare-metal nodes to expand the cluster ' s storage capacity beyond the local NVMe drives. According to Nutanix architectural guidelines, once these EBS volumes are attached and integrated into the storage pool, the capacitycan only be increased. Reducing the storage capacity by removing or shrinking attached EBS volumes is not a supported operation because it would risk data loss and disrupt the Distributed Storage Fabric (DSF) which expects consistent disk availability. Therefore, administrators should carefully size their initial EBS requirements, knowing that they can scale up to meet demand but cannot scale back the capacity of individual existing volumes without a complex data migration or cluster redeployment.

With the Nutanix AOS Pro licensing, several advanced features and add-on products become available. Specifically, in the AWS cluster deployment wizard, the following add-ons are available:

Files:

Nutanix Files provides a software-defined, scale-out file storage solution that simplifies the management and scaling of unstructured data.

Advanced Replication:

Advanced Replication features in Nutanix include synchronous and asynchronous replication capabilities, allowing for robust disaster recovery and data protection solutions.

DARE (Data-At-Rest Encryption):

DARE ensures that all data stored on Nutanix clusters is encrypted, providing a higher level of security for sensitive information.

These features are included in the AOS Pro licensing tier, offering enhanced data management, protection, and security capabilities.

Nutanix Licensing Guide

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Advanced Features

Within an NC2 environment, the Cluster Protect feature can ensure the protection of:

Nutanix Files: This provides file services within the Nutanix ecosystem, and Cluster Protect can safeguard the data stored in Nutanix Files.

Virtual Machine Disks: This ensures that the data stored on virtual machine disks is protected, providing backup and recovery options for the virtual machines running within the cluster.

Nutanix Cloud Clusters on AWS Administration

Nutanix AOS 6.7 Documentation

The 192.168.5.0/24 range is often reserved for internal cluster communication within Nutanix deployments.

Using this CIDR range for other purposes could lead to network conflicts and connectivity issues, as it might interfere with the internal operations and communication channels of the Nutanix cluster.

Ensuring that the CIDR range is not overlapping with any reserved ranges is crucial for maintaining proper network connectivity and cluster functionality.

Refer to the Nutanix documentation on network configuration and best practices for NC2 deployments to confirm reserved IP ranges and their appropriate use.

A standard NC2 deployment typically requires a management subnet and a public subnet for basic internet and console access. However, when moving to aFlow-based deployment(using Flow Virtual Networking), the architecture becomes more complex, requiringManagementandFlow Virtual Networksubnets specifically tailored for the overlay. TheManagement subnetis used for the bare-metal hosts and CVMs to communicate with the NC2 portal and Prism Central. TheFlow Virtual Network subnet(often the Transit VPC subnet) is required to host the distributed gateways that manage encapsulated Geneve traffic. These subnets are essential for segregating the management traffic from the virtualized workload traffic, ensuring that the software-defined overlay has a dedicated and secure path through the AWS VPC infrastructure.

The requirement for two private subnets in the NC2 cluster configuration workflow serves the same purposes:

One subnet is designated for user VMs, ensuring user workloads are separated from management operations.

The other subnet is designated for cluster management, maintaining the integrity and security of management processes and internal communications.

Nutanix Clusters on AWS Deployment Guide

Nutanix Cloud Clusters on AWS Administration

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as " U " (which likely stands for " Unavailable " or " Unreachable " ). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an " U " status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the " Organizations " section.

Select " Add Cloud Account " and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

The scalability of Nutanix Cloud Clusters (NC2) on AWS is a critical architectural consideration for high-growth environments. While earlier versions or specific regions might have different baseline limits, the maximum size for a single NC2 cluster on AWS is officially supported up to28 nodes. This limit is designed to balance the performance benefits of the Nutanix Distributed Storage Fabric (DSF) with the underlying AWS bare-metal infrastructure and networking constraints. Expanding a cluster to this size allows for significant workload consolidation and high availability within a single management domain. Administrators must ensure that their AWS account quotas and VPC subnet sizing are sufficient to accommodate the vCPU and IP address requirements associated with a 28-node deployment to prevent provisioning failures.

Ensure the specialist is assigned the RBAC role with proper permissions (Answer A):

Role-Based Access Control (RBAC) ensures that the specialist has the necessary permissions to troubleshoot and manage the NC2 environment. This avoids unnecessary privilege escalations and maintains security.

Confirm the Support Authorization on the organization is set to Full Access (Answer C):

Setting the Support Authorization to Full Access allows the Nutanix support specialist to have the required access to investigate and resolve issues in the environment. This is essential for effective troubleshooting.

Nutanix RBAC Documentation

Nutanix Support Access Guide

Successful onboarding of an AWS environment into the Nutanix Cloud Clusters ecosystem requires a precise set of administrative permissions to be present on the account used for initial configuration. Specifically, the AWS user must haveCreateRoleFullAccessto allow the automated scripts to generate the necessary service-linked roles. Additionally, the user must possessIAMFullAccessto manage identity policies andAWSCloudFormationFullAccessto execute the deployment templates. This specific combination ensures that the NC2 portal can correctly configure the " Cross-Account Role " which serves as the primary communication bridge between the Nutanix management plane and the AWS infrastructure APIs. Failing to provide any of these three core permissions will result in an " Insufficient Permissions " alert during the cloud account registration process.

In the NC2 console, an organization is used to segregate clusters based on specific requirements. This segregation allows administrators to manage clusters more effectively by grouping them according to business units, projects, or other criteria. This organizational structure helps in maintaining clear boundaries and applying specific policies or permissions to different clusters within the same NC2 environment.

Nutanix Cloud Clusters on AWS Administration

Nutanix Certified Professional - Cloud Integration - AWS

AHV Metro Availability provides a synchronous replication solution for zero-RPO disaster recovery.

For this to function correctly within an NC2 on AWS environment, the clusters must be architected to survive anAvailability Zone (AZ)failure while maintaining the extremely low latency required for synchronous operations. The supported configurations include havingtwo NC2 clusters running in the same AWS region but in different AZs, ensuring that if one zone goes offline, the other can immediately take over. Additionally, asingle-node NC2 clustercan be used as a target in a different AZ within the same region for specific low-footprint synchronous requirements. Deploying across different regions is not suitable for Metro Availability due to the high latency of inter-region traffic, which would exceed the requirements for synchronous data writes.

To enable inbound internet access to Virtual Servers in an NC2 cluster on AWS for the HTTPS protocol, the administrator should use an AWS Network Load Balancer (NLB).

Configure the NLB listener to listen on TCP port 443, which is the standard port for HTTPS traffic.

Create a target group in AWS, and register the servers (Virtual Servers in the NC2 cluster) as targets within this group.

Ensure the NLB is properly configured with an Elastic IP (EIP) if required, to provide a static IP address for the load balancer.

Verify that the security groups and network ACLs associated with the load balancer and the target group allow inbound traffic on port 443.

Refer to AWS documentation on Network Load Balancers and Nutanix NC2 on AWS integration guides for step-by-step instructions on setting up and configuring the necessary components for enabling HTTPS access.

Nutanix offers tailored licensing models for different workload types within NC2 to optimize costs. ForVDI-specific clusters, Nutanix utilizes auser-based consumption model. In this scenario, pricing is determined by the number of concurrent users, which is ideal for elastic desktop environments where the number of active VMs fluctuates. Conversely,general-purpose clusterstypically default to acapacity-based method. Here, consumption is calculated based on the total provisioned capacity (cores or TiB) of the cluster, providing predictable costs for steady-state server workloads. These models allow organizations to align their software spend directly with their actual resource utilization patterns. It is important to note that switching between portfolio types (NCI and AOS) is generally restricted once a cluster is deployed.

When extending a Layer 2 subnet from on-premises to NC2 on AWS, the default gateway often remains at the on-premises location.

For Virtual Machines (VMs) running on the NC2 cluster in AWS to communicate with resources outside their immediate subnet, their traffic must be directed back through the tunnel to the on-premises gateway. This is achieved by configuring arouting policyon the NC2 cluster with aForward action. This policy identifies traffic destined for the gateway and encapsulates it via the VTEP (VXLAN Tunnel Endpoint) using port 4789. Without this forward action policy, the AWS-based VMs would attempt to find a local gateway within the AWS VPC, resulting in a loss of connectivity for any North-South traffic.

TheCluster Protectfeature is the native Nutanix solution designed specifically for NC2 on AWS to protect both the cluster data and thePrism Centralmanagement instance. Unlike standard replication, Cluster Protect utilizesAmazon S3 bucketsto store snapshots of the cluster configuration, Prism Central metadata, and User VM data. This is considered the " best way " for native protection because the entire recovery workflow is orchestrated directly from theNC2 console. If a cluster or an entire Availability Zone fails, the administrator can use the NC2 portal to redeploy the cluster and restore the Prism Central instance and data from the S3 bucket, eliminating the need for third-party backup software while maintaining a simple cloud-native recovery path.

To resolve the IP conflict issue when an EC2 instance is powered on in a subnet also used by Nutanix NC2, the administrator should block or exclude the IP address used by the NC2 VM from being assigned to EC2 instances. This can be done by configuring the IP address management (IPAM) settings to ensure that the specific IP addresses allocated to the NC2 VMs are not used by EC2 instances, preventing IP conflicts and ensuring smooth operation of both environments.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

In an NC2 heterogeneous cluster (mixing different host types), the ability to addAmazon EBS volumesfor supplemental storage capacity is governed by both host compatibility and cluster redundancy rules. First, the administrator must ensure that the selected host types actually support EBS attachment; if the current selection does not, they mustadd a host type that supports EBS volumes. Second, the cluster must maintain its Replication Factor (RF) integrity. If the number of nodes for a specific storage-heavy host type is not amultiple of the RF(e.g., needing 4 nodes for RF2), the system may restrict storage expansion to prevent data unavailability during a failure. By ensuring the node count aligns with RF requirements and using compatible bare-metal instances, the administrator can unlock the EBS volume configuration options within the deployment workflow.

To deploy an NC2 cluster using an existing AWS network, the NAT Gateway should be placed in a public subnet. A public subnet is one that has a route to an Internet Gateway, allowing the NAT Gateway to provide outbound internet access for resources in private subnets. The NAT Gateway is used to enable instances in private subnets to access the internet while keeping them secure by not exposing them directly to the public internet.

Nutanix Cloud Clusters (NC2) on AWS Documentation

Gateway Endpoint:

A Gateway Endpoint in AWS allows you to connect to supported AWS services privately without going through the public internet. This setup provides secure and efficient connectivity directly from the corporate VPC to the required AWS services.

Gateway Endpoints support services such as Amazon S3 and DynamoDB and are ideal for scenarios where private connectivity to these services is needed.

Refer to the AWS documentation on VPC endpoints, specifically Gateway Endpoints, and the Nutanix documentation on configuring private connectivity for NC2 deployments.

When a catastrophic failure occurs, such as an entire AWS Availability Zone (AZ) becoming unavailable, the Cluster Protect feature provides a cloud-native orchestrated recovery path. The critical first step for an administrator to trigger the recovery workflow is to manually set the cluster to the " Failed " state within the NC2 console. Marking the cluster as failed signals the NC2 portal that the original infrastructure is non-functional and initiates the logic required to redeploy the cluster in a healthy, alternative AZ. Without this manual confirmation, the portal may continue attempting to reach the original nodes. Once the " Failed " state is confirmed, the portal provides the subsequent options to provision new bare-metal hardware and re-hydrate data from the Amazon S3 snapshots.

To manage outbound traffic and prevent unfiltered internet access without deploying a dedicated firewall appliance, administrators can leverage aProxy Server. WhenFlow Virtual Networking (FVN)is implemented, it allows for sophisticated routing and encapsulation that can be integrated with an AWS Proxy server. This configuration forces all traffic exiting the Nutanix User VPCs to pass through the proxy for inspection and filtering based on corporate security policies. This setup is particularly effective for clusters requiring AOS updates or access to specific Nutanix cloud endpoints while maintaining a " locked-down " posture for User VMs. It provides an administrative chokepoint for traffic without the complexity of managing third-party firewall rules or NAT Gateway filters.

A valid CIDR range: A CIDR (Classless Inter-Domain Routing) range is necessary for creating the subnets within the VPC. This range defines the IP address space for the cluster and its components.

A my.nutanix.com account: This account is required to access Nutanix services, including the NC2 console, manage licenses, and perform other administrative tasks.

AWS Direct Connect and an on-premises Prism Central environment are not prerequisites for deploying an NC2 on AWS cluster. While Direct Connect can be used for enhanced network performance and connectivity, it is not a requirement for deployment. Similarly, having an on-premises Prism Central environment is not mandatory for NC2 deployment on AWS.

Refer to the Nutanix documentation on NC2 prerequisites and setup guides, and AWS documentation on VPC and subnet creation.

When a " boot timeout " alert occurs during a cluster expansion, it often indicates that the NC2 console requested a new instance from AWS, but the instance failed to reach a " healthy " state within the allotted time. While networking can be a factor, common " hard " stops at the AWS API level includeService QuotasandInstance Limits. AWS accounts have default limits on the number of bare-metal instances (like i3.metal or i4i.metal) that can be active in a single region. If the expansion request exceeds thevCPU quotaor the specificinstance type limit, AWS will deny the request or fail to provision the hardware. Administrators must verify these quotas in the AWS Service Quotas console and request an increase to support the additional nodes required for the Nutanix cluster.

While NC2 on AWS runs on bare-metal EC2 instances, hardware-level events or maintenance notifications are initially generated by the AWS infrastructure. To provide a streamlined management experience, Nutanix integrates these AWS-specific events directly into theNC2 console ' s notification center. This allows administrators to monitor for issues such as scheduled reboots, hardware degradations, or instance status checks without constantly switching between the Nutanix and AWS management portals. While Prism Central and Prism Element provide software-level alerts for the Nutanix OS, the NC2 portal is the primary location for alerts related to the underlying cloud lifecycle and infrastructure events that may impact cluster health.

For the NC2 cluster deployed in the North Virginia region (us-east-id), consuming IPs from the 10.78.2.0/24 range, the subnets configured within the same CIDR range of 10.78.0.0/16 will be recognized.

The subnetDR01 (10.78.2.0/24)is directly within the range of the deployed cluster.

The subnetL2stretch (10.19.101.0/24)is also configured in the NC2 AWS VPC, although not in the immediate range of the cluster, it may show up due to broader network configurations for stretched L2 operations.

SubnetsVDI (10.78.130.0/22)andDR02 (10.79.120.0/24), although part of the same VPC, are not directly within the immediate CIDR range or may not be recognized in this specific configuration scenario.

Refer to the Nutanix documentation on NC2 AWS VPC subnet configurations and Prism Element settings for detailed guidelines on network visibility and configuration.

For issues related to cloud hardware support such as EC2 instances, VPC, etc., the public cloud vendor (AWS in this case) should be contacted. AWS provides support and documentation for their infrastructure and services, ensuring that users can get assistance for any hardware or cloud-specific queries.

Nutanix Support and Insights

To establish full connectivity between the company’s on-premises datacenter and the AWS cloud, the following AWS offerings will satisfy this requirement:

AWS VPN: This service allows you to create a secure connection between your on-premises network or other remote network and your AWS VPC using an IPsec VPN tunnel. It is suitable for low to moderate bandwidth requirements and provides secure, encrypted connections.

Direct Connect: AWS Direct Connect is a dedicated network connection from your premises to AWS. It provides a private, high-bandwidth, low-latency connection which is ideal for high-throughput applications and workloads that need consistent network performance.

AWS VPN Documentation

AWS Direct Connect Documentation

Monitoring the health and connectivity of stretched Layer 2 networks is vital for maintaining seamless hybrid cloud operations.

In a Nutanix environment managed via Prism Central, the specific location to verify the operational status of these extensions is underNetwork and Security, specifically within theNetwork Servicessection labeledSubnet Extensions. This dashboard provides visibility into the VTEP (VXLAN Tunnel Endpoint) gateways and the specific subnets that have been extended from the on-premises environment to NC2 on AWS. Administrators can check if the tunnel is " Up " or " Down " and view performance metrics associated with the stretched segment. Ensuring the status is monitored here allows for rapid troubleshooting of connectivity issues that might prevent virtual machines from communicating across the hybrid link.

Cross Cluster Live Migration allows for the movement of running virtual machines between different Nutanix clusters with zero downtime.

For this feature to be supported in an NC2 on AWS environment, the deployment must utilizeFlow Virtual Networking (FVN). FVN provides the advanced software-defined networking overlay required to maintain consistent network state and connectivity for the VM as it moves between different physical bare-metal hosts in separate clusters. Standard AWS networking lacks the specific overlay capabilities necessary to handle the seamless IP mobility and session persistence required for a live migration between cloud clusters. Therefore, ensuring FVN is correctly configured is a prerequisite for achieving live mobility within the AWS NC2 ecosystem.

To avoid IP address conflicts and ensure there are no configuration issues when reusing an existing AWS subnet, the administrator should take the following actions:

aCLI > net.add_to_ip_blacklist 10.79.4.200 aCLI > net.add_to_ip_blacklist 10.79.4.201 (Answer A):

This command adds the specified IP addresses to the blacklist, preventing AHV IPAM from assigning these addresses to any VMs. This ensures that the existing EC2 instances with IPs 10.79.4.200 and 10.79.4.201 are not allocated to other VMs in the NC2 cluster.

Configure the AHV IPAM to use DHCP range 10.79.4.2 -10.79.4.253 (Answer D):

By configuring the AHV IPAM to use a specific DHCP range, you ensure that the IP addresses assigned to the EC2 instances (10.79.4.200 and 10.79.4.201) are not included in the DHCP pool. This prevents IP address conflicts within the subnet.

Nutanix aCLI Reference

Nutanix NC2 on AWS Documentation

AWS VPC and Subnet Basics

Flow Virtual Networking (FVN)provides an advanced software-defined networking layer that supports three specific types of connectivity models for NC2 clusters. First,NAT (Network Address Translation)networks allow User VMs to access external resources (like the internet) using the gateway ' s IP, providing a layer of security. Second,No-NATnetworks allow for transparent routing between the Nutanix overlay and on-premises or other VPC environments, preserving the original VM IP addresses. Third,L2 Stretchednetworks (Subnet Extensions) use VXLAN tunnels to extend a single broadcast domain from an on-premises data center to the cloud cluster. These three types allow administrators to tailor their network architecture based on the specific security and connectivity requirements of each workload hosted in the cloud.

Multicloud Snapshot Technology (MST)provides a cost-effective DR solution by offloading snapshots to cloud storage, but it has specific architectural limitations. First, it is currently limited to theAHV hypervisor; workloads running on ESXi are not supported for MST-based protection. Second, Nutanix allows for the simultaneous use of multiple protection layers; specifically,MST DR and Cluster Protectfeatures can be configured together to provide both local and remote resilience. It is also important to note that MST is designed for asynchronous recovery and is not compatible with Zero-RPO solutions like synchronous replication or AHV Metro at this time. Understanding these hypervisor and configuration constraints is essential when designing a disaster recovery strategy that relies on cloud object storage.

Synchronous replication in Nutanix Cloud Clusters (NC2) on AWS requires extremely low latency, typically less than 5ms round-trip time (RTT). To achieve this, clusters must be located within the same AWS region, often within different Availability Zones or the same VPC.

Supported networking configurations for this high-speed data exchange include using standard native AWS networking on both clusters to ensure direct, low-latency communication. Additionally, a hybrid setup where one cluster utilizes native networking and the remote cluster uses Flow Virtual Networking (FVN) is supported, provided the underlying network infrastructure satisfies the latency requirements for synchronous operations. This ensures that data is written to both clusters simultaneously before an acknowledgment is sent to the application, providing zero recovery point objective (RPO).

To correctly route traffic in a hybrid environment using Flow Virtual Networking, administrators must distinguish between internal private traffic and external internet traffic. Internal traffic usingRFC 1918address ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) should be routed to theoverlay-external-subnet-no-nat. This ensures that traffic directed to the on-premises data center retains its original IP address for auditing and security purposes. Conversely, all other traffic (0.0.0.0/0), typically destined for the internet, should be routed to theoverlay-external-subnet-nat. This configuration allows the NAT Gateway to handle internet-bound requests while maintaining a transparent, non-NAT path for corporate internal communication.

When connectivity is required between two separate AWS VPCs—one hosting native EC2 instances and the other hosting an NC2 cluster—and advanced overlay networking (FVN) is not in use, the most straightforward solution is VPC Peering. Configuring VPC Peering in Amazon Web Services allows for the routing of traffic between the two VPCs using private IP addresses as if they were on the same network. This method requires the least administrative effort because it does not require the deployment of new software overlays like FVN or the management of a complex Transit Gateway. Administrators simply need to establish the peering connection and update the route tables in both VPCs to allow traffic to flow between the respective CIDR ranges, providing secure, high-performance connectivity.

When establishing a landing zone in a brand new AWS region for NC2 with Flow Virtual Networking (FVN), the network team must provision specific subnets to support the management plane and the transit architecture. The first essential component is theFVN Overlay External Subnet, which resides within the Transit VPC and acts as the entry/exit point for traffic moving between the overlay network and external environments like the internet or on-premises data centers. The second requirement is a dedicatedPrism Central subnet, which is necessary to host the Prism Central instance that will manage the NC2 clusters within that region. These subnets provide the structural foundation for the software-defined networking overlay, ensuring that management traffic is properly segregated from user workload traffic and that the transit gateway logic has a designated physical network path.

While NC2 bare-metal instances come with high-performance local NVMe storage, many organizations require additional capacity to support large data sets or long-term storage needs. For instance types that support Amazon EBS attachment, theminimum number of additional EBS volumesthat can be added per node is1. Adding even a single EBS volume allows the Nutanix cluster to expand its storage pool beyond the physical limitations of the bare-metal chassis. Administrators can then increase this capacity as needed, although once attached, these volumes typically cannot be removed or decreased. This flexibility is key for scaling storage-intensive applications without necessarily increasing the compute node count, thereby optimizing the overall TCO of the cloud cluster.

To successfully onboard an AWS account into the NC2 console, the administrator must deploy a specific CloudFormation stack that establishes the necessary trust relationship and permissions. This process is highly sensitive as it involves the creation of IAM roles that allow Nutanix to orchestrate AWS resources. Consequently, the user executing this script must possessIAMFullAccessto create and modify these security identities andAWSCloudFormationFullAccessto manage the lifecycle of the stack itself. Without these high-level administrative permissions, the deployment will fail, preventing NC2 from obtaining the " secret " keys and roles required to launch bare-metal instances. This one-time setup is fundamental to the security architecture of the hybrid cloud environment.