NCP-MCI-6.5 Nutanix Certified Professional - Multicloud Infrastructure (NCP-MCI) v6.5 exam Questions and Answers

Nutanix clusters are resilient to a drive, node, block, and rack failures because they use redundancy factor 2 by default, allowing Nutanix clusters to self-heal2. Failure scenarios can be thought of in terms of fault domains, which are the physical or logical parts of a computing environment or location that are adversely affected when a device or service experiences an issue or outage3. There are four fault domains in a Nutanix cluster: Disk, Node, Block, and Rack4. Block and Rack are two options that are available for expanding the failure domain level of a cluster. Block fault tolerance is enabled by default and ensures that data is replicated across different blocks in a cluster5. Rack fault tolerance has to be configured manually and ensures that data is replicated across different racks in a cluster4.

References: 1: Behavioral Learning Tools - Prism Central Resource Management - Nutanix 2: How Nutanix Handles Failures | Node Failure 3: Failure Domain Considerations - Nutanix Support & Insights 4: [Understanding Fault Domains and Rack Awareness - Nutanix] 5: [Nutanix Cluster Architecture Overview - Nutanix Bible]

According to the web search results, one possible cause of inter-VM communication failure between hosts is that the switch is not configured to allow VLAN 15 traffic. VLAN 15 is the default VLAN ID used by AHV for internal communication between CVMs and hosts. If the switch blocks or drops VLAN 15 packets, it will prevent inter-VM communication across hosts4. To enable full inter-VM communication, the administrator should update the switch to specifically allow VLAN 15 traffic on the ports connected to the AHV hosts.

According to the web search results, the cluster redundancy factor (RF) determines how many copies of the cluster metadata and configuration data are stored on different nodes. By default, the cluster RF is 2, which means that there are three copies of the Zookeeper and Cassandra data on the cluster. If the cluster RF is increased to 3, then there will be five copies of the Zookeeper and Cassandra data on the cluster12. This means that the Zookeeper component can tolerate two failures, as it can still operate with a quorum of three nodes out of five3.

However, the container replication factor (RF) determines how many copies of the VM data and oplog are stored on different nodes. The container RF can be set independently for each container, and it can be different from the cluster RF. For example, a container can have RF 2 even if the cluster has RF 34. In this case, the container will only have two copies of the VM data and oplog on the cluster, regardless of the cluster RF. This means that the Extent Groups component can only tolerate one failure, as it needs at least one copy of the VM data and oplog to be available5.

Therefore, if the administrator increases the cluster RF to 3, but does not modify the containers, then the new values in the data resiliency dashboard will be Zookeeper = 2 and Extent Groups = 1.

According to the web search results, two steps that should be taken to prepare for relocating an AHV cluster to a new datacenter during a maintenance window are:

• Shut down all user VMs in the cluster: This step is necessary to ensure that there is no data loss or corruption during the relocation process. The user VMs can be shut down either individually or in bulk by using the Prism Element web console or the acli command-line interface1.
• Stop all Nutanix Files clusters: If the AHV cluster hosts any Nutanix Files clusters, they should be stopped before relocating the cluster. Nutanix Files clusters are composed of one or more virtual machines that provide file services to clients. Stopping a Nutanix Files cluster will stop all the file server VMs and release the resources they consume2. The Nutanix Files clusters can be stopped by using the Prism Element web console or the ncli command-line interface3.

The correct answer is C. The VLAN was not created on the upstream switches.

A VLAN (virtual local area network) is a logical segmentation of a physical network that allows devices on the same VLAN to communicate with each other, regardless of their physical location. A VLAN also isolates the devices on different VLANs from each other, unless there is a router or a layer 3 switch that can route traffic between VLANs. To create a VLAN, the administrator needs to configure the network devices that are involved in the VLAN, such as switches, routers, and hosts. The administrator also needs to assign a unique VLAN ID to each VLAN, which is a number between 1 and 4094 that identifies the VLAN1.

In Nutanix AHV, the administrator can create a Nutanix managed network with a specific VLAN ID for guest VMs. This network can be assigned to VM NICs using Prism Element or Prism Central. However, creating a Nutanix managed network does not automatically create the VLAN on the upstream switches that connect the AHV hosts. The administrator needs to manually configure the upstream switches to allow the VLAN traffic on the ports that connect to the AHV hosts. The administrator also needs to ensure that the upstream switches are interconnected physically or virtually and can forward traffic between different VLANs if needed2.

Therefore, if an administrator has created a Nutanix managed network with a VLAN ID of 512 and notices that the VMs on that network can only communicate with other VMs on the same host, but not with VMs on different hosts in the cluster, the most likely cause of this issue is that the VLAN was not created on the upstream switches. This means that the switches are dropping or blocking the traffic with VLAN ID 512 and preventing it from reaching other hosts or VMs. To resolve this issue, the administrator should create the VLAN on the upstream switches and allow it on the ports that connect to the AHV hosts3.

An Application Security Policy is a security feature in Nutanix AHV that can be used to restrict network communication between virtual servers based on a variety of criteria, such as IP address, port, and protocol. By creating a policy that restricts communication to authorized hosts and applying it to the servers in enforce mode, the administrator can prevent unauthorized communication between virtual servers.

https://www.nutanix.com/products/ahv

According to the Nutanix Support & Insights web search result1, if the owner Controller VM becomes unavailable, the address moves to another Controller VM, ensuring that it is always available. This IP address is also used as a cluster-wide address by clients configured as part of Nutanix Files and other products. Therefore, the host will automatically redirect I/O and VMs will continue running without any interruption.

According to the Nutanix Support & Insights web search result3, shadow clones are vDisk copies that are created by the cluster when a vDisk is read by multiple VMs. Shadow clones are immutable copies of a vDisk that are stored in different nodes in the cluster, and are used to improve read performance and reduce network traffic. Shadow clones are automatically created and deleted by the cluster, based on the demand and availability of resources.

https://portal.nutanix.com/page/documents/details?targetId=Prism-Central-Guide-Prism-v5_10:mul-pc-install-scratch-c.html

 According to the Nutanix Support & Insights web search result4, Prism Central can be installed manually on an AHV cluster by using three disk images: boot, home, and data. These disk images must be downloaded from the portal for the Prism Central VM and uploaded to an image service on the AHV cluster. The boot image contains the operating system and kernel for Prism Central. The home image contains the configuration files and logs for Prism Central. The data image contains the database and application files for Prism Central.

Prism Central is a multi-cluster manager that provides a single, centralized management interface for Nutanix environments1. Prism Central can be deployed in different configuration scenarios, depending on the network and security requirements of the environment. Some of the valid scenarios are:

• Environments use Network Address Translation (NAT): NAT is a method of mapping one IP address space to another by modifying network address information in IP datagram packet headers while they are in transit across a traffic routing device2. NAT can be used to enable communication between Prism Central and Prism Elements that are in different networks or subnets3. For example, Prism Central can be deployed in a public cloud and use NAT to access Prism Elements that are in a private data center3.
• Prism Elements and Prism Central are in different subnets: A subnet is a logical subdivision of an IP network that allows multiple networks to share a single physical network4. Prism Elements and Prism Central can be in different subnets as long as they can communicate with each other through routing or NAT3. For example, Prism Central can be deployed in a management subnet and access Prism Elements that are in different application subnets3.
• Environments do not have Internet access: Internet access is not required for the deployment of Prism Central, as long as the environment meets the prerequisites and considerations for installing or upgrading Prism Central. For example, Prism Central can be deployed in a dark site, which is an environment that does not have Internet access or has restricted Internet access. In this case, the administrator needs to manually enable microservices infrastructure and download the required software packages from another source.

According to the web search results, one recommended configuration change to improve throughput for a custom backup application that requires a 2TB disk and runs on Windows is to span the 2TB disk across four vDisks. Spanning is a technique that allows you to create a single logical disk from multiple physical disks. Spanning can improve throughput by distributing I/O requests across multiple disks and reducing contention5. To span a disk across four vDisks, the administrator should create four vDisks of equal size (500 GB each) and attach them to the VM. Then, in Windows Disk Management, create a spanned volume from the four vDisks and format it as NTFS6.

According to the web search results, three storage optimizations that should be set on a dedicated storage container for a VDI solution with persistent desktops are compression, deduplication and erasure coding. Compression is a technique that reduces the size of data by removing redundant information. Deduplication is a technique that eliminates duplicate copies of data blocks and stores only unique blocks. Erasure coding is a technique that increases usable capacity by reducing the replication factor of data blocks and using parity information instead7. These three optimizations can improve performance and save storage space for VDI workloads, especially during a node failure event when data needs to be rebuilt from parity information8. The administrator can enable these optimizations by using Prism Element web console or ncli command-line interface9.

Nutanix supports two types of deduplication: post-process and inline. Post-process deduplication runs periodically on a schedule and can be enabled on any cluster. Inline deduplication runs in real time before data is written to disk and can be enabled only on all-flash clusters.

Therefore, by checking the type of storage and the type of deduplication, you can determine if you can enable inline deduplication on a storage container or not.

 Nutanix inline deduplication is a feature that reduces the stored size and avoids duplicate data on a storage container1. It is recommended only on some specific scenarios, such as when using Nutanix Files or virtual desktop infrastructure (VDI) workloads12.

The correct answer is A. Long term storage of data which is written once and read infrequently.

Erasure Coding is a feature that increases the usable capacity on a Nutanix cluster by reducing the amount of data replication. Instead of replicating data, Erasure Coding uses parity information to rebuild data in the event of a disk failure. The capacity savings of Erasure Coding is in addition to deduplication and compression savings1.

Erasure Coding is most beneficial for scenarios where the data is written once and read infrequently, such as long term storage of archival data, backup data, or cold data. This is because Erasure Coding has some trade-offs and limitations that may affect the performance and availability of the cluster. Some of these trade-offs and limitations are2:

• Erasure Coding requires more CPU and memory resources than replication, as it involves more complex calculations for encoding and decoding data.
• Erasure Coding increases the network bandwidth consumption, as it involves more data transfers between nodes for encoding and decoding data.
• Erasure Coding reduces the resiliency of the cluster, as it can tolerate fewer node failures than replication. For example, a cluster with redundancy factor 2 can tolerate one node failure with replication, but only two disk failures with Erasure Coding.
• Erasure Coding is not effective for workloads that have many overwrites or random writes, as it involves more overhead for updating the parity information.
• Erasure Coding is not supported for some features, such as volume groups, file server VMs, or Metro Availability.

Therefore, if an administrator needs to configure a container on a Nutanix cluster, they should enable Erasure Coding only if the container will store data that is written once and read infrequently. This way, they can maximize the capacity savings of Erasure Coding without compromising the performance and availability of the cluster.

According to the Nutanix Support & Insights web search result2, VM NICs on AHV can operate in two modes: Access and Trunked. Access NICs are the default, and allow one VLAN on the NIC. Trunked NICs allow multiple VLANs on a single NIC for VMs that are VLAN aware. If you must use trunked NICs, follow the steps described in the web search result2. Therefore, the most efficient way to have a VM on an AHV cluster with access to multiple VLANs is to update a vNIC on the VM to operate in trunked mode for all desired VLANs.

This will allow the administrator to quickly identify VMs that are overprovisioned or underutilized based on their performance metrics.

https://www.nutanix.com/support-services/training-certification/certifications/certification-details-nutanix-certified-professional-multicloud-infrastructure-6_5

Port 389 is the default port for LDAP without SSL encryption. Port 636 is used for LDAP over SSL (LDAPS). Port 3268 and 3269 are used for Global Catalog (GC) and Global Catalog over SSL (GCSSL), respectively2.

Active-Active is a bond mode that allows all uplinks in the bond to be used simultaneously for traffic transmission and reception. This bond mode provides load balancing and increased bandwidth for the AHV host and its VMs. Active-Active bond mode uses a hashing algorithm based on source MAC addresses to distribute traffic across different uplinks in the bond. Each individual VM NIC uses only a single bond member interface at a time, but multiple VM NICs are spread across different bond member interfaces. As a result, it is possible for a Nutanix AHV node with two 10 Gb interfaces to use up to 20 Gbps of network throughput, while individual VMs have a maximum throughput of 10 Gbps6.

Therefore, if an administrator needs to optimize for maximum single VM throughput, they should select Active-Active bond mode for their AHV cluster. This bond mode can be configured using Prism Element UI or manage-ovs commands on each AHV host7. No additional configuration is required on the upstream switch side, as long as the switches are interconnected physically or virtually and both uplinks trunk the same VLANs8.

In Nutanix AHV, when creating a virtual switch and trying to add network interfaces (NICs) to it, the NICs must be connected to the network before they can be selected and assigned to the switch. If the interfaces are showing as disconnected, the system will not allow them to be added to a virtual switch because it cannot verify their operational status or the presence of a live network connection.

It is a standard requirement for the interfaces to have physical connectivity (i.e., network cables plugged in and connected to a live switch port) so that the AHV host can detect the link status as up. Once the interfaces are connected and recognized by the host, they can then be added to a virtual switch in the Nutanix AHV.

It's important to note that while the command-line interface (CLI) is indeed a powerful tool for managing network configurations on AHV hosts, and some configurations do indeed require CLI, the inability to select disconnected interfaces is not specifically a limitation that requires the use of CLI to overcome. The focus should be on ensuring that the physical connectivity is established for the interfaces in question.

This behavior is consistent with networking best practices and Nutanix's network configuration guidelines, as detailed in the Nutanix AHV Networking Guide. This guide explains the requirements and procedures for configuring virtual switches and managing NICs in a Nutanix AHV environment.

According to the Dell Unity: Data Reduction Technical White Paper1, snapshots and clones on Dell Unity use the Copy-on-Write (CoW) algorithm to maximize efficiency and effectiveness. CoW is a technique that defers the copying of data until it is modified. This means that snapshots and clones only consume space when changes are made to the source or the clone, respectively. CoW also preserves the original data in case of a rollback or recovery operation.

Nutanix Move is a tool that allows you to migrate VMs from different sources to Nutanix AHV with minimal downtime and complexity. Nutanix Move supports migration from Hyper-V to AHV, including VMs configured for UEFI-boot. UEFI stands for Unified Extensible Firmware Interface, which is a standard for the software interface between the operating system and the firmware. UEFI-boot is a mode of booting that uses UEFI instead of BIOS (Basic Input/Output System) to load the operating system. UEFI-boot offers some advantages over BIOS-boot, such as faster boot time, larger disk support, and better security features1.

To migrate a VM configured for UEFI-boot from a Nutanix Hyper-V cluster to AHV, you need to use Nutanix Move and follow these steps2:

• Download and deploy the Nutanix Move appliance on the AHV cluster.
• Log in to the Nutanix Move web console and add the source Hyper-V environment and the target AHV environment.
• Create a migration plan and select the VMs that you want to migrate. You can choose either automatic or manual preparation mode for the migration.
• Start the migration plan and monitor the progress. The migration plan will perform data seeding, which is the process of copying the VM data from the source to the target in the background.
• When the data seeding is complete, perform a cutover, which is the process of shutting down the source VMs and powering on the target VMs. The cutover will also configure the boot device for the UEFI-boot VMs on AHV.
• Verify that the migrated VMs are working as expected on AHV.

References: 1: UEFI Boot - Nutanix Support & Insights 2: Hyper-V to AHV and Hyper-V to Nutanix Clusters on AWS VM Migration - Nutanix Support & Insights

According to the web search results, the two impacts on the cluster that will result from increasing the vCPU count on all of the VDI VMs are:

• Increase CPU utilization%: CPU utilization is the percentage of time that a CPU is busy executing instructions5. By increasing the vCPU count on all of the VDI VMs, the administrator will increase the demand for CPU resources on the cluster, which will increase the CPU utilization percentage6.
• Increase CPU ready%: CPU ready is the percentage of time that a vCPU is ready to run but is waiting for a physical CPU to become available5. By increasing the vCPU count on all of the VDI VMs, the administrator will increase the contention for physical CPU resources on the cluster, which will increase the CPU ready percentage6. A high CPU ready percentage can indicate performance issues such as latency or slowdowns5.

According to section 5 of the exam blueprint guide1, one of the topics covered is live migration. Live migration is the process of moving a running VM from one host to another without any downtime or interruption of service. To perform live migration, there are some prerequisites that must be met, such as:

• All AHV hosts have IP addresses in the same subnet
• All VMs are configured for the same VLAN
• The source and destination hosts have enough resources to accommodate the VM
• The VM does not have any PCI devices attached

According to the Troubleshoot high memory issues on Azure virtual machines web search result2, one of the common factors in a low memory situation is over-provisioning memory for a VM. Over-provisioning memory can cause memory pressure, which leads to swapping and degraded performance. Therefore, to fix this issue, the administrator should reduce the amount of memory assigned to the VM, based on the average hardware requirements for that operating system and application load.

The task that needs to be performed when time is not synchronizing properly after deploying a cluster is NTP configuration. In the Nutanix Multicloud Infrastructure (NCP-MCI) 6.5, Network Time Protocol (NTP) is used to synchronize the system time across all the nodes in a cluster. If the time is not synchronizing properly, it indicates that there might be an issue with the NTP configuration. Therefore, checking and correcting the NTP configuration would be the appropriate action to resolve this issue. The other options like DNS configuration, HA configuration, and SMTP configuration are not directly related to time synchronization in a cluster.

A Compute Only node is a node that does not have any local storage devices and only provides compute resources to the cluster2. A Compute Only node does not run a CVM, but instead relies on the CVMs of other nodes to access the distributed storage fabric2

According to the Nutanix Prism Central Guide, role-based access control (RBAC) in Prism Central allows you to create custom roles and assign them to users or groups based on the categories of the entities they need to manage1. Categories are key-value pairs that you can assign to entities such as VMs, hosts, clusters, images, etc. to group them logically2. For example, you can create a category key called “OS” and assign values such as “Linux” or “Windows” to different VMs based on their operating system.

In the exhibit, the Linux Admin role has been created with the following settings:

• The role has the “VM Admin” permission, which allows the user to perform all actions on VMs3.
• The role has been assigned to the admin1 user.
• The role has been scoped to the entities that have the category key “OS” and the value “Linux”.

However, the admin1 user does not have access to all Linux VMs in the environment. This means that some of the Linux VMs do not have the proper category assigned to them. To grant the proper access, the administrator should add the category key “OS” and the value “Linux” to each Linux VM that needs to be managed by the Linux Admin role. This can be done either individually or in bulk through Prism Central4. Once the categories are added, the admin1 user will be able to see and manage all Linux VMs in the environment.

The correct answer is B. The existing and the expansion node are on different VLANs.

The output shows that the new node has a br0-up bond with four interfaces: eth0, eth1, eth2, and eth3. The bond is configured with LACP active and LACP fallback set to false. This means that the bond will only work if the upstream switch supports LACP and is configured to form an LACP group with the four interfaces. However, the output also shows that the bond has no IP address assigned to it, which indicates that the bond is not operational. One possible reason for this is that the existing and the expansion node are on different VLANs, and the upstream switch is not configured to allow the VLAN traffic on the LACP group. This would prevent the new node from communicating with the cluster and being discovered by the Expand Cluster function in Prism.

To verify this, the administrator can check the VLAN configuration on the upstream switch and compare it with the existing nodes. Alternatively, the administrator can use the “manage_ovs show_uplinks” command on an existing node and compare the output with the new node. If there is a VLAN mismatch, the administrator can either change the VLAN configuration on the switch or on the new node to match the existing nodes.

"An administrator has been tasked with increasing security on Nutanix cluster by disabling password authentication when accessing the CVM and AHV hosts and instead moving to key-based SSH, What is the easiest way for the administrator to meet these needs? Enable Cluster Lockdown and provide an RSA key."

 Cluster Lockdown mode disables password authentication when accessing the CVM and AHV hosts and instead requires key-based SSH. To enable Cluster Lockdown mode, you need to provide an RSA key.

Therefore, by enabling Cluster Lockdown mode and providing an RSA key, you can increase security on Nutanix cluster by disabling password authentication when accessing the CVM and AHV hosts and instead moving to key-based SSH with minimal effort.

https://next.nutanix.com/how-it-works-22/streamlined-login-and-increase-security-key-based-ssh-login-37397

Configure VM-Host affinity for the nodes that meet the application’s GPU requirement. This is because VM-Host affinity allows the administrator to specify which nodes a VM can run on or must not run on1. By creating a VM-Host affinity rule that binds the application VM to the three nodes that have the physical GPU, the administrator can ensure that the VM will always run on a node that meets its requirement, regardless of any HA or migration events. This also allows the other nodes in the cluster to host other VMs without any restrictions.

The issue described pertains to the inability to ping the IPMI IPs after moving the IPMI network links to the actual switches with specific VLAN configurations. The two changes that the administrator needs to make are:

A. SSH to AHV and set the VLAN ID using IPMI Tool: Since all VLANs are tagged in the new network configuration, the IPMI network interface needs to be aware of the VLAN it’s supposed to communicate on. This can be achieved by setting the VLAN ID using the IPMI Tool on the AHV.

C. SSH to AHV and change the IP address using IPMI tool: If the IPMI IP addresses were initially set in a different subnet that is not routable in the new network configuration, the administrator would need to change the IPMI IP addresses to match the new network configuration. This can be done by SSHing to the AHV and using the IPMI Tool to change the IP address.

A storage policy can be associated with a VM. A storage policy is a set of rules that define how data objects are stored and protected. It specifies the characteristics of storage, data protection, and data placement for virtual disks that are assigned to a VM. Subnets, catalogs, and categories are not associated with storage policies.https://portal.nutanix.com/page/documents/details?targetId=Prism-Central-Guide-vpc_2022_6:mul-cluster-storage-policy-summary-view-pc-r.html

A bond is a logical interface that combines two or more physical interfaces on an AHV host. A bond provides high availability and load balancing for the network traffic of the host and its VMs. A bond can have different modes that determine how the traffic is distributed and how the bond handles failures of the physical interfaces. The most common bond modes are active-backup, active-active, and LACP1.

Nutanix recommends including at least two physical interfaces in every bond to ensure high availability and redundancy. If one of the physical interfaces fails or is disconnected, the other interface can take over the traffic without affecting the connectivity of the host or its VMs. Having at least two physical interfaces in a bond also allows for maintenance operations such as firmware upgrades or cable replacements without downtime2.

Nutanix does not recommend including NIC models from different vendors in the same bond, as this may cause compatibility issues or performance degradation. Nutanix also does not recommend using only one physical interface in a bond, as this provides no redundancy or load balancing benefits3.

https://portal.nutanix.com/page/documents/details?targetId=Prism-Central-Guide-vpc_2023_3:mul-cluster-storage-policy-pc-c.html

According to the image description, the exhibit shows a screenshot of a computer screen with a table of data. The table has 6 columns and 4 rows. The columns are labeled “Date”, “Time”, “Status”, “Details”, “Configuration”, and “Duration”. The rows contain information about different configurations and their statuses. The background is a light blue color. There is a pop-up message on the bottom right corner of the screen that reads “This question has been answered. Click here to enable the edit button.”

Based on the table data, it seems that the screenshot is taken from the Prism Central web console, showing the results of a cluster health check report. The report shows that there are four failed checks: Host Password Policy, CVM Password Policy, NTP Configuration, and Cluster Time Skew2. These checks indicate that some initial cluster configuration tasks were missed during the deployment process.

The Host Password Policy check verifies that the host passwords are not set to default values and are compliant with the password policy defined in Prism Central3. The CVM Password Policy check verifies that the CVM passwords are not set to default values and are compliant with the password policy defined in Prism Central4. These checks are important for ensuring the security and compliance of the cluster. Therefore, changing the host and CVM passwords from their default values and following the password policy guidelines are two initial cluster configuration tasks that were missed.

References: 1: VM Details View - Nutanix Support & Insights 2: Cluster Health - Nutanix Support & Insights 3: Host Password Policy - Nutanix Support & Insights 4: CVM Password Policy - Nutanix Support & Insights

According to the Nutanix Support & Insights, in a two-node ROBO cluster with a witness VM, if one node goes down, the other node sends a leadership request to the witness VM and goes into single-node mode. The cluster remains available and can tolerate another failure of either the witness VM or the network link.

One node hosts two VMs while the node being upgraded is in maintenance mode. This is because Nutanix supports a feature called Rolling Upgrade that allows upgrading AHV on a cluster without any downtime or impact to the VMs. The Rolling Upgrade feature performs the upgrade one node at a time, by putting the node in maintenance mode, evacuating the VMs to other nodes, upgrading AHV, and then bringing the node back online. The VM-VM anti-affinity policy ensures that the four VMs are not placed on the same node during the evacuation process, so one node will host two VMs temporarily while the other node is being upgraded.

The best method to provide access for a user to view real-time performance metrics for all VMs on all clusters across the datacenter is to configure AD authentication create a custom role, assign the user to the role, and apply the role to all clusters and VMs. This method accomplishes this with the least effort and ongoing maintenance because:

• AD authentication allows Nutanix Prism Central to integrate with an existing Active Directory (AD) domain and use AD users and groups for authentication and authorization5. This simplifies user management and avoids creating local users on Prism Central.
• Creating a custom role allows Nutanix Prism Central to define granular permissions for different actions and entities based on specific needs6. This ensures that users only have access to what they need and nothing more.
• Assigning the user to the custom role allows Nutanix Prism Central to grant access rights for that user based on the role definition7. This avoids assigning permissions individually for each user.
• Applying the role to all clusters and VMs allows Nutanix Prism Central to propagate the access rights for that role across all entities in scope8. This ensures that users can view real-time performance metrics for all VMs on all clusters without having to configure each entity separately.

References: 1: Health Dashboard - Prism Element Guide 2: Understanding Native VLANs - Cisco 3: VMs may lose network connectivity if connected to virtual network with … - Nutanix Support & Insights 4: VLAN Configuration - AHV Networking Guide 5: Active Directory Authentication - Prism Central Guide 6: Create Custom Roles - Prism Central Guide 7: Assign Roles - Prism Central Guide 8: Apply Roles - Prism Central Guide

Nutanix provides two types of granular RBAC for AHV hosts: category based and cluster based3. Category based RBAC allows administrators to assign roles to users or groups based on categories, which are key-value pairs that can be applied to various entities in Prism Central, such as clusters, hosts, VMs, images, and networks. Categories can be used to group entities by different criteria, such as department, project, environment, or location. For example, an administrator can create a category key named Department and assign different values to it, such as Finance, Marketing, or Engineering. Then, the administrator can apply this category to different clusters or hosts and assign roles to users or groups based on this category. This way, users or groups can have different levels of access to different clusters or hosts depending on their department4.

Cluster based RBAC allows administrators to assign roles to users or groups based on specific clusters registered in Prism Central. For example, an administrator can create a role named Cluster Admin and assign it to a user or group for a particular cluster. This way, the user or group can have full access to that cluster and its hosts and VMs, but not to other clusters5.

According to the Nutanix Prism Element Guide, Prism Element uses a single SSL certificate on a Nutanix cluster. The certificate is used to secure the communication between the web browser and the Prism web console. The certificate is also used to authenticate the cluster to external services, such as Active Directory, SMTP, and SNMP. The certificate can be either self-signed or signed by a trusted certificate authority (CA). The certificate can be replaced or renewed through the Prism web console or the ncli command-line interface.

According to the Nutanix Support & Insights, IPAM enables AHV to assign IP addresses automatically to VMs using DHCP. You can configure each virtual network and associated VLAN with a specific IP subnet, associated domain settings, and group of IP address pools available for assignment.