NCP-CI-AWS Exam Dumps - Nutanix Certified Professional (NCP) Questions and Answers

When creating a new NC2 cluster using an existing AWS VPC infrastructure, two private subnets are needed. These subnets are used as follows:

One private subnet for user VMs, which houses the virtual machines that users interact with.

Another private subnet for cluster management, which is used for internal cluster operations and management tasks, ensuring that management traffic is isolated from user traffic for security and performance reasons.

Nutanix Support and Insights

Nutanix Cloud Clusters on AWS Administration

While NC2 bare-metal instances come with high-performance local NVMe storage, many organizations require additional capacity to support large data sets or long-term storage needs. For instance types that support Amazon EBS attachment, theminimum number of additional EBS volumesthat can be added per node is1. Adding even a single EBS volume allows the Nutanix cluster to expand its storage pool beyond the physical limitations of the bare-metal chassis. Administrators can then increase this capacity as needed, although once attached, these volumes typically cannot be removed or decreased. This flexibility is key for scaling storage-intensive applications without necessarily increasing the compute node count, thereby optimizing the overall TCO of the cloud cluster.

To establish full connectivity between the company’s on-premises datacenter and the AWS cloud, the following AWS offerings will satisfy this requirement:

AWS VPN: This service allows you to create a secure connection between your on-premises network or other remote network and your AWS VPC using an IPsec VPN tunnel. It is suitable for low to moderate bandwidth requirements and provides secure, encrypted connections.

Direct Connect: AWS Direct Connect is a dedicated network connection from your premises to AWS. It provides a private, high-bandwidth, low-latency connection which is ideal for high-throughput applications and workloads that need consistent network performance.

AWS VPN Documentation

AWS Direct Connect Documentation

In an NC2 environment using Flow Virtual Networking (FVN), the External Routable Prefix (ERP) is used to identify the address space that can reach external networks. If the ERP is correctly configured in both the Transit and User VPCs but outbound communication still fails, the issue typically lies within the virtual routing table. A static route (such as 0.0.0.0/0) must be manually added to the User VPC routing table with the next hop set to the overlay-external-subnet. Without this explicit static route, the virtual router within the User VPC does not know how to direct traffic toward the Transit VPC for outbound delivery, even if the address ranges are theoretically compatible. Verifying this routing path is a standard step in ensuring overlay workloads can reach on-premises or internet resources.

AVTEP (VXLAN Tunnel Endpoint) Gatewayshowing a status of " Down " indicates a connectivity or configuration failure within the control plane. In an NC2 environment, the gateway relies on consistent communication withPrism Central (PC)for management and synchronization, as well asNTP and DNSfor time-sync and name resolution. If the route tables in the AWS VPC are missing the necessary entries to reach these management services, the VTEP gateway will fail to initialize or maintain its heartbeat, resulting in a " Down " status. While on-premises reachability is important for traffic flow, the failure to create the extension entirely usually points to these missing internal routes that prevent the Nutanix software components from coordinating correctly within the cloud environment.

To add an AWS account to the NC2 console, an AWS IAM user needs to be configured with the appropriate permissions to manage the EC2 resources. The required permission for the IAM user includes full access to manage EC2 instances, volumes, and related resources.

AmazonEC2FullAccess:

This permission grants full access to all EC2 resources, including the ability to create, modify, and delete instances, volumes, security groups, and more.

Essential for NC2 operations to manage the lifecycle of EC2 instances and associated components within the AWS environment.

Why Not Other Permissions:

IAMFullAccess: Grants full access to IAM resources but not specifically needed for EC2 operations.

IAMReadOnlyAccess: Only provides read access to IAM resources, insufficient for managing EC2 instances.

AmazonEC2ReadOnlyAccess: Provides read-only access to EC2 resources, insufficient for creating or modifying instances and other resources.

AWS IAM Policies Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for IAM User Permissions

The exhibit shows two cloud accounts, one for Azure and one for AWS, with their statuses indicated. The AWS cloud account status is marked as " U " (which likely stands for " Unavailable " or " Unreachable " ). This indicates that the AWS cloud account configuration is not properly connected or accessible.

Status Check:

The AWS cloud account is marked with an " U " status, meaning it is not active or accessible.

This status prevents the creation of an NC2 cluster because the necessary cloud resources cannot be allocated or managed without a proper connection.

Action:

The best course of action is to create a new cloud account in the organization. This involves setting up the cloud account details correctly and ensuring it is properly configured to communicate with Nutanix and AWS.

Steps to Create a New Cloud Account:

Log in to the Nutanix console.

Navigate to the " Organizations " section.

Select " Add Cloud Account " and provide the required AWS credentials and permissions.

Ensure the new cloud account is active and correctly configured.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for Cloud Account Management

When setting up a landing zone for Nutanix clusters on AWS, having only private subnets for cluster management and user VMs is not sufficient for full cluster functionality. Nutanix clusters often need to communicate with the internet for updates, patches, and other cloud services.

VPC Configuration:

The VPC already has two private subnets (one for cluster management and one for user VMs).

Additional Requirements:

To access public services like S3 or for the cluster nodes to reach Nutanix services for updates, a public subnet is essential.

Why Public Subnet for Internet Access?:

A public subnet allows resources within it to communicate directly with the internet, which is necessary for accessing Nutanix ' s update servers, applying patches, and other maintenance tasks.

This subnet typically includes an internet gateway, enabling instances in the public subnet to receive and send traffic directly to the internet.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Networking Best Practices

Nutanix Networking and Subnet Configuration Guidelines

To correctly route traffic in a hybrid environment using Flow Virtual Networking, administrators must distinguish between internal private traffic and external internet traffic. Internal traffic usingRFC 1918address ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) should be routed to theoverlay-external-subnet-no-nat. This ensures that traffic directed to the on-premises data center retains its original IP address for auditing and security purposes. Conversely, all other traffic (0.0.0.0/0), typically destined for the internet, should be routed to theoverlay-external-subnet-nat. This configuration allows the NAT Gateway to handle internet-bound requests while maintaining a transparent, non-NAT path for corporate internal communication.

To create a CloudFormation stack, the AWSCloudFormationFullAccess role is required.

This role grants the necessary permissions to create, update, and delete CloudFormation stacks, which are essential for deploying and managing AWS infrastructure using CloudFormation templates.

CloudFormation stacks are often used to automate the deployment of complex infrastructures, including those required for NC2 on AWS.

Proper permissions ensure that the deployment process is seamless and adheres to the security and operational policies of the organization.

Refer to the AWS IAM documentation for details on the AWSCloudFormationFullAccess role and Nutanix documentation on prerequisites for deploying NC2 on AWS.