NCP-CI-AWS Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam Free Practice Exam Questions (2026 Updated)

In an NC2 on AWS environment, licensing Microsoft Windows Server workloads can be complex due to cloud mobility rights.

If an organization does not have existing licenses with Software Assurance to support " Bring Your Own License " (BYOL) on cloud hardware, they must acquire licenses through the cloud provider. The most integrated and efficient way to achieve this for Nutanix clusters is to select theLicense Includedoption during the host provisioning process in the NC2 console. By purchasing nodes with licenses included, the cost of the Windows Server OS is bundled with the instance hourly rate provided by AWS. This ensures full compliance with Microsoft licensing terms without requiring a separate purchase through external marketplaces or resellers for the cloud-resident VMs.

Nutanix offers a free trial to allow organizations to test NC2 capabilities.

This trial is flexible; users can initiate a separate 30-day free trial for each supported cloud provider, such as AWS and Azure, allowing for independent evaluations of different cloud environments. It is important to note that the " free " aspect of the trial applies only to theNutanix software licensing. The user is still responsible for allAWS infrastructure costs(bare-metal instances, storage, and data transfer) incurred during the trial period. Additionally, users are not restricted to the trial alone; they can choose to activate aPay-As-You-Go (PAYG)subscription even while the free trial is active to ensure a smooth transition to production after the evaluation ends.

For issues related to cloud hardware support such as EC2 instances, VPC, etc., the public cloud vendor (AWS in this case) should be contacted. AWS provides support and documentation for their infrastructure and services, ensuring that users can get assistance for any hardware or cloud-specific queries.

Nutanix Support and Insights

When deploying Nutanix Cloud Clusters (NC2) on AWS, administrators have two primary workflows: allowing the NC2 portal to automate resource creation or using existing resources. The " Bring Your Own " (BYO) model is characterized by the requirement that the administrator manually prepares the underlying AWS infrastructure before initiating the Nutanix cluster deployment. Specifically, the actions ofcreating an AWS VPCandcreating the required subnets(such as management and User VM subnets) are exclusive to the BYO workflow. In the automated " Nutanix-managed " workflow, the NC2 portal uses CloudFormation to provision these network resources automatically. While setting up IAM users and permissions is necessary for both models to allow the NC2 console to interact with the AWS API, the pre-existence of the VPC and subnet architecture is the defining prerequisite for a BYO deployment.

When reserving licenses for Nutanix Cloud Clusters (NC2), administrators must understand the inclusion of add-ons within different tiers. For organizations requiring multi-protocol storage, the Nutanix Unified Storage (NUS) add-on is flexible and can be associated with either the NCI Pro or NCI Ultimate licensing tiers. Furthermore, the NCI Ultimate tier is designed to be comprehensive; it automatically includes high-value features such as Advanced Replication and Security (Microsegmentation) by default. This simplifies the licensing process because these features do not require separate manual applications once the Ultimate tier is selected. While NCI Ultimate is feature-rich, it does not include the NUS add-on by default, which remains a capacity-based selection that must be specifically managed alongside the base license tier.

To ensure that the newly created NC2 organization named Finance can only deploy clusters into certain cloud regions, the administrator should specify the allowed regions during the cloud account configuration.

This action restricts the regions available for cluster deployment, ensuring compliance with organizational policies or regulatory requirements.

The allowed regions can be set in the cloud account settings associated with the Finance NC2 organization, defining the geographical scope of operations.

Refer to the Nutanix documentation on NC2 cloud account configuration and region restrictions.

While Nutanix provides multiple management interfaces, each serves a distinct purpose in the hybrid cloud lifecycle. Prism Central and Prism Element are used for managing software-level entities like VMs, storage containers, and replication policies. However, for thedefinitive status of the cluster ' s cloud infrastructure—including whether the bare-metal nodes are provisioned, if the cluster is in a " Healthy, " " Degraded, " or " Failed " state, or if a " boot timeout " has occurred—administrators must usethe NC2 Portal. The NC2 Portal acts as the primary orchestration layer that bridges Nutanix and AWS; it is the only console that displays specific cloud deployment tasks, hardware replacement status, and AWS-raised infrastructure events in a unified view.

The Nutanix disaster recovery capabilities include recovery plans that define how entities are recovered in the event of a failure. There is a limit to the number of entities that can be managed within a single recovery plan.

Entity Limit:

According to Nutanix documentation, the maximum number of entities that can be recovered using a single recovery plan is 300. Exceeding this limit will cause issues during the execution of the recovery plan.

Impact of Exceeding the Limit:

If the number of entities in a recovery plan exceeds the supported limit, the recovery process may fail or not execute correctly, as observed in the scenario.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Disaster Recovery Best Practices Documentation

In an NC2 environment using Flow Virtual Networking (FVN), routing traffic between the AWS cloud and on-premises environments requires specific configuration of the Transit VPC and User VPCs.

To ensure that traffic reaching the on-premises environment is not subjected to Network Address Translation (NAT)—which would obscure the original IP addresses and potentially break connectivity for certain applications—the routing tables must point to the correct internal gateway interface. Theoverlay-external-subnet-nonatacts as the designated gateway for traffic that should be routed without address translation. Verifying that the " Next Hop " for on-premises prefixes is set to this specific subnet ensures that internal communication remains transparent and complies with standard corporate networking and security policies.

To correctly route traffic in a hybrid environment using Flow Virtual Networking, administrators must distinguish between internal private traffic and external internet traffic. Internal traffic usingRFC 1918address ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) should be routed to theoverlay-external-subnet-no-nat. This ensures that traffic directed to the on-premises data center retains its original IP address for auditing and security purposes. Conversely, all other traffic (0.0.0.0/0), typically destined for the internet, should be routed to theoverlay-external-subnet-nat. This configuration allows the NAT Gateway to handle internet-bound requests while maintaining a transparent, non-NAT path for corporate internal communication.

Bare-metal EC2 instances are a specialized resource in AWS, and their availability can sometimes be limited within a specific region or Availability Zone. If an administrator attempts to expand an NC2 cluster and the requested instance types are out of stock at the AWS level, the NC2 console will attempt to provision the nodes but will eventually reach aretry limit and fail. The portal does not indefinitely hold the cluster in maintenance mode. Instead, the administrator is responsible for verifying node availability through the AWS Service Health Dashboard or AWS support. If the desired instance type (e.g., i3.metal) is unavailable, the administrator may need to consider expanding into a different Availability Zone or choosing a different supported instance type to satisfy the expansion requirement.

Monitoring the health and connectivity of stretched Layer 2 networks is vital for maintaining seamless hybrid cloud operations.

In a Nutanix environment managed via Prism Central, the specific location to verify the operational status of these extensions is underNetwork and Security, specifically within theNetwork Servicessection labeledSubnet Extensions. This dashboard provides visibility into the VTEP (VXLAN Tunnel Endpoint) gateways and the specific subnets that have been extended from the on-premises environment to NC2 on AWS. Administrators can check if the tunnel is " Up " or " Down " and view performance metrics associated with the stretched segment. Ensuring the status is monitored here allows for rapid troubleshooting of connectivity issues that might prevent virtual machines from communicating across the hybrid link.

For mission-critical workloads, the Recovery Time Objective (RTO) is a primary concern.

Multicloud Snapshot Technology (MST)coupled with aPilot Light Deploymentprovides the necessary infrastructure to support an automated recovery plan. In a Pilot Light scenario, a small, " always-on " version of the Nutanix cluster (usually the minimum number of nodes) is maintained in AWS to host Prism Central and handle background replication tasks. Because the management layer is already active, recovery plans can be fully automated to power on VMs and adjust networking instantly upon failure. In contrast, a " Zero Compute " deployment lacks an active management interface, requiring manual intervention to provision a cluster before recovery can begin, which significantly increases RTO and prevents full automation.

During the NC2 cluster creation process, the administrator is presented with options for the licensing portfolio they wish to utilize. Nutanix has transitioned to theNCI (Nutanix Cloud Infrastructure)portfolio, but the legacyAOSportfolio is still available for certain customers. If the " AOS Licenses " option appears greyed out or unselectable, it is typically becausethe administrator did not select AOS in the licensing section of the NC2 Creation Wizard. The wizard requires an explicit choice early in the workflow to determine which features and software tiers (Pro, Ultimate, etc.) will be available for selection later. If the portfolio is not correctly identified at the start, the specific license keys or reservations associated with the legacy AOS model will not be recognized by the deployment engine, defaulting instead to the newer NCI-based consumption model.

For a VM to be accessible over the internet through a load balancer, the VM itself must have a public IP address.

In this case, the health check for the VM target is failing and the DNS returns a " NOT Found " message because web-1 does not have a public IP assigned.

Without a public IP, the load balancer cannot route traffic to web-1 from the internet.

Assigning a public IP to web-1 ensures that the VM can be accessed via the load balancer, resolving the connectivity issue.

Refer to the AWS documentation on network load balancers and public IP assignments, and Nutanix documentation on VM network configurations.

When using the Nutanix Cluster Protect feature to recover a failed NC2 cluster on AWS, and the management Prism Central (PC) instance is hosted on a separate, healthy cluster, a specific orchestration sequence must be followed. The process begins in the NC2 console, where the administrator must manually change the status of the cluster to Failed. This step is critical as it signals the portal to initiate the recovery workflow and release associated cloud resources. Next, the administrator uses the console to redeploy the cluster, which provisions new bare-metal instances and installs the AOS software. Once the infrastructure is ready, Multicloud Snapshot Technology (MST) must be redeployed or re-enabled on the new cluster to re-establish the connection to the Amazon S3 bucket containing the snapshots. Finally, the User VMs (UVMs) are recovered and hydrated from these snapshots. This specific order ensures that the target environment and management links are fully operational before data restoration commences.

To manage outbound traffic and prevent unfiltered internet access without deploying a dedicated firewall appliance, administrators can leverage aProxy Server. WhenFlow Virtual Networking (FVN)is implemented, it allows for sophisticated routing and encapsulation that can be integrated with an AWS Proxy server. This configuration forces all traffic exiting the Nutanix User VPCs to pass through the proxy for inspection and filtering based on corporate security policies. This setup is particularly effective for clusters requiring AOS updates or access to specific Nutanix cloud endpoints while maintaining a " locked-down " posture for User VMs. It provides an administrative chokepoint for traffic without the complexity of managing third-party firewall rules or NAT Gateway filters.

To ensure that NC2 VMs can access AWS resources without traversing the internet, the administrator can use AWS VPC Peering and Interface Endpoints. Both methods ensure that traffic stays within the AWS network, maintaining security and efficiency.

Interface Endpoint:

Interface Endpoints allow you to privately connect your VPC to supported AWS services. They use AWS PrivateLink to route traffic directly to services within the AWS network, bypassing the public internet.

Steps:

Create an interface endpoint for the required service in the AWS VPC console.

Ensure the security groups and route tables are configured to allow traffic to the interface endpoint.

VPC Peering:

VPC Peering allows the routing of traffic between VPCs using private IP addresses, without the need for internet gateways, NAT devices, or VPN connections.

Steps:

Create a VPC peering connection between the VPCs.

Update the route tables to direct traffic between the peered VPCs.

Ensure security group rules allow the necessary traffic between VPCs.

AWS VPC Peering Documentation

AWS Interface Endpoint Documentation

Nutanix Cloud Clusters on AWS Administration Guide

When creating user VM subnets for multiple NC2 clusters in AWS, the best approach is to create guest-VM subnets for each cluster. This ensures that each cluster has its own dedicated subnets, which simplifies network management and avoids potential IP conflicts.

Advantages of Dedicated Subnets:

Isolation: Each cluster operates in its own subnet, providing better isolation and security.

Management: Easier to manage and troubleshoot network issues when each cluster has its own subnets.

Scalability: More scalable as each subnet can be managed and expanded independently.

Steps to Create Guest-VM Subnets:

Identify the IP range for each subnet.

In the AWS VPC console, create a new subnet for each cluster using the identified IP ranges.

Associate the new subnets with the respective clusters during or after the cluster deployment process.

Why Not Shared Subnets:

Shared subnetscould lead to IP conflicts and make network management more complex, especially as the number of clusters grows.

Nutanix Cloud Clusters on AWS Administration Guide

AWS VPC Subnet Creation Documentation