The Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS6.7) Exam (NCP-CI-AWS)

Synchronous replication requires extremely low latency (sub-5ms) and a reliable high-speed connection between the primary and secondary storage controllers. While Flow Virtual Networking (FVN) supports various architectures, the most robust and supported way to enable synchronous replication for NC2 clusters in the same region is to ensure thatboth clusters reside within the same AWS VPC. This placement minimizes network hops and avoids the added latency that might be introduced by VPC Peering or a Transit Gateway between separate VPCs. By sharing the same VPC, the clusters can communicate via the same internal AWS network fabric, providing the deterministic performance required for zero-RPO data protection and Metro Availability configurations.

For environments requiring highly flexible and complex network addressing,Flow Virtual Networking (FVN)is the superior choice over standard native AWS networking. Native AWS networking is often restricted by the CIDR blocks of the VPC, and managing non-contiguous ranges across multiple subnets can become administratively burdensome.FVNuses an overlay architecture (Geneve) that abstracts the User VM networking from the physical AWS VPC infrastructure. This allows administrators to define virtual networks and subnets using any IP range, including multiplenon-contiguous CIDR ranges, without being constrained by the primary VPC address space. This flexibility is essential for large-scale deployments or multi-tenant environments where overlapping or non-standard IP schemes must be supported seamlessly.

When managing Nutanix licenses for NC2, administrators can reserve capacity from their existing licenses to ensure dedicated resource availability for cloud deployments.

This reserved capacity is flexible; it is not tied to a single cluster but can cover the usage of all NC2 clusters operating within the same workspace, simplifying license management across multiple deployments. Furthermore, these reservations are not permanent. If a company decides to shift workloads back to their data center, an administrator can unreserve the license by updating the reserved capacity to zero in the Nutanix portal, making that capacity available again for on-premises cluster consumption. This provides a seamless way to manage hybrid cloud licensing costs.

To control network traffic at the individual User VM (UVM) subnet level, creating a custom security group is the appropriate action. This approach allows for fine-grained control over inbound and outbound traffic rules that can be applied to specific subnets or individual instances within those subnets.

Custom Security Group:

Custom security groups enable administrators to define specific traffic rules tailored to the needs of individual subnets or VMs. This includes specifying allowed IP ranges, ports, and protocols.

By applying these custom security groups to the UVMs, the organization can control access and enhance security according to their policies and requirements.

Steps to Create a Custom Security Group:

Navigate to the AWS Management Console and go to the VPC service.

Select " Security Groups " under the " Security " section.

Click on " Create Security Group " and define the name, description, and VPC.

Add inbound and outbound rules according to the desired traffic control policies.

Attach the custom security group to the UVMs or subnets in question.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Security Groups

When creating user VM subnets for multiple NC2 clusters in AWS, the best approach is to create guest-VM subnets for each cluster. This ensures that each cluster has its own dedicated subnets, which simplifies network management and avoids potential IP conflicts.

Advantages of Dedicated Subnets:

Isolation: Each cluster operates in its own subnet, providing better isolation and security.

Management: Easier to manage and troubleshoot network issues when each cluster has its own subnets.

Scalability: More scalable as each subnet can be managed and expanded independently.

Steps to Create Guest-VM Subnets:

Identify the IP range for each subnet.

In the AWS VPC console, create a new subnet for each cluster using the identified IP ranges.

Associate the new subnets with the respective clusters during or after the cluster deployment process.

Why Not Shared Subnets:

Shared subnetscould lead to IP conflicts and make network management more complex, especially as the number of clusters grows.

Nutanix Cloud Clusters on AWS Administration Guide

AWS VPC Subnet Creation Documentation

AVTEP (VXLAN Tunnel Endpoint) Gatewayshowing a status of " Down " indicates a connectivity or configuration failure within the control plane. In an NC2 environment, the gateway relies on consistent communication withPrism Central (PC)for management and synchronization, as well asNTP and DNSfor time-sync and name resolution. If the route tables in the AWS VPC are missing the necessary entries to reach these management services, the VTEP gateway will fail to initialize or maintain its heartbeat, resulting in a " Down " status. While on-premises reachability is important for traffic flow, the failure to create the extension entirely usually points to these missing internal routes that prevent the Nutanix software components from coordinating correctly within the cloud environment.

The clusters that are to be protected must be registered with the same instance of Prism Central (Answer C):

For Cluster Protect to function correctly, all clusters intended for protection must be registered under the same Prism Central instance. This ensures consistent management and coordination of protection policies and operations across clusters.

The Cluster Protect feature requires AOS version 6.7 or higher (Answer D):

Cluster Protect is a feature that is available starting from AOS version 6.7. To utilize this feature, ensure that the Nutanix clusters are running this version or a newer one.

Nutanix Cluster Protection Documentation

Nutanix AOS Release Notes

To manage outbound traffic and prevent unfiltered internet access without deploying a dedicated firewall appliance, administrators can leverage aProxy Server. WhenFlow Virtual Networking (FVN)is implemented, it allows for sophisticated routing and encapsulation that can be integrated with an AWS Proxy server. This configuration forces all traffic exiting the Nutanix User VPCs to pass through the proxy for inspection and filtering based on corporate security policies. This setup is particularly effective for clusters requiring AOS updates or access to specific Nutanix cloud endpoints while maintaining a " locked-down " posture for User VMs. It provides an administrative chokepoint for traffic without the complexity of managing third-party firewall rules or NAT Gateway filters.

When a node is marked as " Condemned, " it indicates that the system has determined that the node is no longer reliable for operations. As part of the automated recovery and protection process, the following action is typically taken:

The node has a power reset sent to it (Answer A):

In most cases, a condemned node undergoes a power reset as an initial recovery attempt. This action attempts to reboot the node to bring it back to a healthy state. If the reset fails, further manual or automated steps may be required to address the hardware or software issue.

Nutanix Cluster Management Documentation

Nutanix Support Knowledge Base