NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Free Practice Exam Questions (2026 Updated)

When opting for a native networking deployment (Standard AWS Networking), the architectural requirements differ from an overlay-based setup.

This configuration typically requiresone private management subnetto house the bare-metal hosts and Controller VMs (CVMs). To facilitate outbound communication and administrative access,two public subnetsare required—one for the NAT Gateway to provide internet access to the private nodes, and another to host resources like the Prism load balancer. Finally,one or more User VM (UVM) subnetsare created to host the actual workloads. Unlike Flow Virtual Networking, which uses a single transit VPC, native networking relies on these multiple standard AWS subnets to segregate management, public-facing, and workload traffic within the VPC.

TheCluster Protectfeature is the native Nutanix solution designed specifically for NC2 on AWS to protect both the cluster data and thePrism Centralmanagement instance. Unlike standard replication, Cluster Protect utilizesAmazon S3 bucketsto store snapshots of the cluster configuration, Prism Central metadata, and User VM data. This is considered the " best way " for native protection because the entire recovery workflow is orchestrated directly from theNC2 console. If a cluster or an entire Availability Zone fails, the administrator can use the NC2 portal to redeploy the cluster and restore the Prism Central instance and data from the S3 bucket, eliminating the need for third-party backup software while maintaining a simple cloud-native recovery path.

Traffic from the on-premises network is not permitted by VM and Management security groups:

Ensure that the security groups assigned to the VMs and management interfaces in AWS allow inbound traffic from the on-premises network. Without appropriate security group rules, the traffic will be blocked.

The AWS VPC traffic is blocked by a firewall in the on-premises network:

Check if the firewall on the on-premises network is configured to allow traffic from the AWS VPC. Firewalls may have restrictive rules that block incoming traffic, preventing communication.

Refer to AWS documentation on security groups and firewalls and Nutanix documentation on configuring networking for NC2 clusters.

AVTEP (VXLAN Tunnel Endpoint) Gatewayshowing a status of " Down " indicates a connectivity or configuration failure within the control plane. In an NC2 environment, the gateway relies on consistent communication withPrism Central (PC)for management and synchronization, as well asNTP and DNSfor time-sync and name resolution. If the route tables in the AWS VPC are missing the necessary entries to reach these management services, the VTEP gateway will fail to initialize or maintain its heartbeat, resulting in a " Down " status. While on-premises reachability is important for traffic flow, the failure to create the extension entirely usually points to these missing internal routes that prevent the Nutanix software components from coordinating correctly within the cloud environment.

For environments requiring highly flexible and complex network addressing,Flow Virtual Networking (FVN)is the superior choice over standard native AWS networking. Native AWS networking is often restricted by the CIDR blocks of the VPC, and managing non-contiguous ranges across multiple subnets can become administratively burdensome.FVNuses an overlay architecture (Geneve) that abstracts the User VM networking from the physical AWS VPC infrastructure. This allows administrators to define virtual networks and subnets using any IP range, including multiplenon-contiguous CIDR ranges, without being constrained by the primary VPC address space. This flexibility is essential for large-scale deployments or multi-tenant environments where overlapping or non-standard IP schemes must be supported seamlessly.

A valid CIDR range: A CIDR (Classless Inter-Domain Routing) range is necessary for creating the subnets within the VPC. This range defines the IP address space for the cluster and its components.

A my.nutanix.com account: This account is required to access Nutanix services, including the NC2 console, manage licenses, and perform other administrative tasks.

AWS Direct Connect and an on-premises Prism Central environment are not prerequisites for deploying an NC2 on AWS cluster. While Direct Connect can be used for enhanced network performance and connectivity, it is not a requirement for deployment. Similarly, having an on-premises Prism Central environment is not mandatory for NC2 deployment on AWS.

Refer to the Nutanix documentation on NC2 prerequisites and setup guides, and AWS documentation on VPC and subnet creation.

Multicloud Snapshot Technology (MST)provides a cost-effective DR solution by offloading snapshots to cloud storage, but it has specific architectural limitations. First, it is currently limited to theAHV hypervisor; workloads running on ESXi are not supported for MST-based protection. Second, Nutanix allows for the simultaneous use of multiple protection layers; specifically,MST DR and Cluster Protectfeatures can be configured together to provide both local and remote resilience. It is also important to note that MST is designed for asynchronous recovery and is not compatible with Zero-RPO solutions like synchronous replication or AHV Metro at this time. Understanding these hypervisor and configuration constraints is essential when designing a disaster recovery strategy that relies on cloud object storage.

Synchronous replication in Nutanix Cloud Clusters (NC2) on AWS requires extremely low latency, typically less than 5ms round-trip time (RTT). To achieve this, clusters must be located within the same AWS region, often within different Availability Zones or the same VPC.

Supported networking configurations for this high-speed data exchange include using standard native AWS networking on both clusters to ensure direct, low-latency communication. Additionally, a hybrid setup where one cluster utilizes native networking and the remote cluster uses Flow Virtual Networking (FVN) is supported, provided the underlying network infrastructure satisfies the latency requirements for synchronous operations. This ensures that data is written to both clusters simultaneously before an acknowledgment is sent to the application, providing zero recovery point objective (RPO).

In a Layer 2 stretched environment where the default gateway resides on-premises, a " Forward policy " is used to route traffic from the cloud back to the data center. If the on-premises data center goes completely offline, the on-premises gateway is no longer reachable, which would halt all North-South communication for the VMs failed over to AWS. To restore full service, the administrator must not only failover the VMs to the NC2 cluster but also remove the Forward policy on the on-premises cluster (or specifically update the routing logic to ensure the AWS cluster takes over gateway duties). This allows the cloud cluster to stop attempting to tunnel traffic to the missing on-premises gateway and instead utilize local cloud-based exit points for network traffic, restoring external connectivity.

To successfully onboard an AWS account into the NC2 console, the administrator must deploy a specific CloudFormation stack that establishes the necessary trust relationship and permissions. This process is highly sensitive as it involves the creation of IAM roles that allow Nutanix to orchestrate AWS resources. Consequently, the user executing this script must possessIAMFullAccessto create and modify these security identities andAWSCloudFormationFullAccessto manage the lifecycle of the stack itself. Without these high-level administrative permissions, the deployment will fail, preventing NC2 from obtaining the " secret " keys and roles required to launch bare-metal instances. This one-time setup is fundamental to the security architecture of the hybrid cloud environment.

Nutanix provides a flexible licensing model for NC2, allowing customers to use their existingon-premises licensesthrough reservation. A key benefit of this approach is thatreserved licensed capacity automatically handles incidental overages. If a cluster temporarily scales out and exceeds the reserved capacity, the Nutanix billing system accounts for the excess usage automatically, typically by drawing from the associated Pay-As-You-Go (PAYG) account or consumption credits. This ensures that the cluster remains operational and compliant even during unexpected spikes in demand. Administrators can manage these reservations through the Nutanix portal, allowing them to balance their committed on-premises license spend with the variable needs of their cloud-resident clusters.

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as " U " (which likely stands for " Unavailable " or " Unreachable " ). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an " U " status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the " Organizations " section.

Select " Add Cloud Account " and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

When performing a migration from an NC2 environment to a Nutanix on-premises environment, the task should be performed using the NC2 Prism Central. This is because NC2 Prism Central provides a centralized management interface that allows administrators to manage and migrate workloads between cloud and on-premises environments seamlessly.

Nutanix Cloud Clusters (NC2) Documentation

Nutanix Community Guide

To enable inbound internet access to Virtual Servers in an NC2 cluster on AWS for the HTTPS protocol, the administrator should use an AWS Network Load Balancer (NLB).

Configure the NLB listener to listen on TCP port 443, which is the standard port for HTTPS traffic.

Create a target group in AWS, and register the servers (Virtual Servers in the NC2 cluster) as targets within this group.

Ensure the NLB is properly configured with an Elastic IP (EIP) if required, to provide a static IP address for the load balancer.

Verify that the security groups and network ACLs associated with the load balancer and the target group allow inbound traffic on port 443.

Refer to AWS documentation on Network Load Balancers and Nutanix NC2 on AWS integration guides for step-by-step instructions on setting up and configuring the necessary components for enabling HTTPS access.

To avoid IP address conflicts and ensure there are no configuration issues when reusing an existing AWS subnet, the administrator should take the following actions:

aCLI > net.add_to_ip_blacklist 10.79.4.200 aCLI > net.add_to_ip_blacklist 10.79.4.201 (Answer A):

This command adds the specified IP addresses to the blacklist, preventing AHV IPAM from assigning these addresses to any VMs. This ensures that the existing EC2 instances with IPs 10.79.4.200 and 10.79.4.201 are not allocated to other VMs in the NC2 cluster.

Configure the AHV IPAM to use DHCP range 10.79.4.2 -10.79.4.253 (Answer D):

By configuring the AHV IPAM to use a specific DHCP range, you ensure that the IP addresses assigned to the EC2 instances (10.79.4.200 and 10.79.4.201) are not included in the DHCP pool. This prevents IP address conflicts within the subnet.

Nutanix aCLI Reference

Nutanix NC2 on AWS Documentation

AWS VPC and Subnet Basics

Nutanix Cloud Clusters on AWS requires bare-metal EC2 instances to run the Nutanix AHV hypervisor and the Controller VMs (CVMs).

Nutanix supports specific " metal " instance types that provide the necessary hardware access for the hypervisor to manage resources efficiently. The primary supported instance types include thei3.metal, which is optimized for high I/O workloads; thei3en.metal, which offers more storage capacity and higher network bandwidth; and thei4i.metal, which utilizes the latest Intel Ice Lake processors for superior compute and storage performance. Other instance types listed, such as virtualized " xlarge " or " micro " instances, do not provide the bare-metal access required to run the Nutanix software stack in an NC2 environment.

The NC2 Tile within the my.nutanix.com portal is the correct interface to deploy NC2. This portal provides an integrated and user-friendly interface specifically designed for deploying and managing Nutanix Clusters on AWS.

NC2 Deployment Interface:

NC2 Tile within the my.nutanix.com portal: This portal provides the necessary tools and options to deploy and manage NC2 clusters. It includes functionalities for setting up the clusters, configuring network settings, and managing resources.

Advantages:

User-Friendly Interface: Simplifies the deployment process with a guided setup.

Integrated Tools: Provides access to all necessary tools for managing the deployment and monitoring of NC2 clusters.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix my.nutanix.com Portal Documentation

Nutanix Best Practices for Cluster Deployment

Synchronous replication requires extremely low latency (sub-5ms) and a reliable high-speed connection between the primary and secondary storage controllers. While Flow Virtual Networking (FVN) supports various architectures, the most robust and supported way to enable synchronous replication for NC2 clusters in the same region is to ensure thatboth clusters reside within the same AWS VPC. This placement minimizes network hops and avoids the added latency that might be introduced by VPC Peering or a Transit Gateway between separate VPCs. By sharing the same VPC, the clusters can communicate via the same internal AWS network fabric, providing the deterministic performance required for zero-RPO data protection and Metro Availability configurations.

To SSH into a Controller VM (CVM) in an NC2 on AWS cluster without on-premises connectivity, the administrator needs to ensure that the security settings allow SSH access from the Jump Host. This involves editing the User Management Network Security Group to permit SSH traffic from the Jump Host IP.

Deploy Jump Host:

Ensure the Jump Host is deployed in a public subnet with an Elastic IP (EIP) assigned for external access.

Edit User Management Network Security Group:

Locate the security group associated with the user management network.

Modify the inbound rules to allow SSH (port 22) from the Jump Host ' s IP address. This ensures that the Jump Host can establish an SSH connection to the CVM.

Steps to Edit Security Group:

Navigate to the EC2 dashboard in the AWS Management Console.

Select " Security Groups " under the " Network and Security " section.

Find and select the appropriate security group.

Edit the inbound rules to add a new rule:

Type: SSH

Protocol: TCP

Port Range: 22

Source: Custom IP (enter the Jump Host ' s public IP address)

Additional Configuration:

Ensure that the CVM itself allows SSH connections and that no internal firewall rules block the traffic.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Secure Access