Nutanix Certified Professional Network & Security v6.10

QUESTION NO: 1
A VM with IP address 172.20.10.5 on a Subnet with CIDR 172.20.10.0/24 is unable to be routed externally from the VPC.
The VPC is successfully peered via BGP... However, when checking the BGP Session, no routes are being advertised by the VPC.
What is the most likely configuration issue?

A. The VPC does not have a NO-NAT network configured to advertise the routes. B. The VM does not have a Floating IP assigned to allow external connectivity. C. A network Policy is blocking outbound access for the VM. D. There is no default route within the VPC to send traffic to the NAT external network.

Correct Answer: A

QUESTION NO: 2
An administrator has been tasked with creating a security policy to protect specific virtual network interfaces (vNICs) within a VM in a Flow Virtual Networking setup.
How can the administrator ensure that only a specific vNIC is protected by the policy?

A. Create a general policy for all vNICs and assign it to the VM. The system will automatically select the vNIC to protect. B. Use subnet categorization to create a vNIC-specific policy, securing the selected vNIC based on its associated subnet. C. Configure an entity group with a VM and a subnet, and apply the policy to the entity group, including categories for both VM and subnet. D. Apply the policy to the VM, and then use network segmentation to isolate the vNIC.

Correct Answer: B

QUESTION NO: 3
What is the first step in preparing a Nutanix cluster for Flow Virtual Networking?

A. Install the latest version of Acropolis OS (AOS) on all nodes. B. Configure the VLANs on the physical network switches. C. Enable the Network Controller in Prism Central. D. Install the Nutanix Flow Controller on all cluster nodes.

Correct Answer: C

QUESTION NO: 4
An administrator is designing a VPC for a three-tier application. The workloads must communicate with the Internet using source NAT and also communicate with on-premises networks 10.50.0.0/16 and 172.20.32.0/20 with no address translation. In the Create VPC dialog, the administrator can associate external subnets and specify destination prefixes.
Which configuration satisfies the requirements?

A. Associate a NONAT external network only; set Destination Prefixes to 0.0.0.0/0. B. Associate a NAT external network for 0.0.0.0/0 and a NONAT external network for 10.50.0.0/16, 172.20.32.0/20. C. Associate a NAT external network only; set Destination Prefixes to 0.0.0.0/0, 10.50.0.0/16, 172.20.32.0/20. D. Associate a NONAT external network for 0.0.0.0/0 and a NAT external network for 10.50.0.0/16, 172.20.32.0/20.

Correct Answer: B

QUESTION NO: 5
An administrator has a VPC with a single active gateway node that successfully peers with an external router using a single BGP GW and session.
To eliminate a single point of failure, the administrator deploys a second BGP gateway to the VPC. After the second gateway is added and shows a healthy state, the external router still only sees a single BGP session.
What is the most likely reason for the second session not being established on the external router?

A. The BGP Hold-down timer on the external router is set too high. B. The external router needs BGP peering configuration pointing to the IP address of the first gateway node. C. Network Security Groups are blocking BGP traffic from the second gateway's IP address. D. The second BGP gateway requires a BGP session configured to peer with the external router.

Correct Answer: D

QUESTION NO: 6
A customer wants to migrate VMs from a VLAN Basic Subnet to an Overlay Subnet with the same IP prefix.
Which migration approach ensures minimal disruption?

A. Change IPAM mode to unmanaged to allow manual IP assignment. B. Create a Layer 2 connectivity between the subnets and perform live migration. C. Enable trunk mode on VLAN to allow multiple subnets on the same interface. D. Perform cold migration, acknowledging that ingress/egress connections will not be preserved.

Correct Answer: B

QUESTION NO: 7
An administrator wants to configure the subnet 10.1.1.0/24 to stretch across two VPCs over a Network Gateway in VXLAN mode. The VMs on this subnet need to communicate with a traffic pattern of size 2000 Bytes.
What is the minimum MTU required in the underlay network to ensure communication happens without fragmentation or traffic drops?

A. 2058 Bytes B. 2108 Bytes C. 2116 Bytes D. 9216 Bytes

Correct Answer: A

QUESTION NO: 8
An administrator must delegate management of a single tenant VPC to a junior engineer. The engineer should be able to modify that VPC but must not see or change any other VPCs or networking configurations in Prism Central.
The administrator wants to meet this requirement using RBAC.
Which action should the administrator take to meet this requirement?

A. Assign a Custom Role cloned from Network Infrastructure Admin and restrict its scope to the desired VP B. Assign a Custom Role cloned from VPC Admin and restrict its scope to the desired VPC. C. Assign the VPC Admin role and restrict its scope to the desired VPC. D. Assign the Network Infrastructure Admin role and restrict its scope to the desired VPC.

Correct Answer: C

QUESTION NO: 9
During a security review, the administrator confirms that the existing security policy does not explicitly allow traffic from Environment: Development to Environment: Production. A VM in the Development category was still able to reach a Production VM over IPv6.
What is the most likely cause of this behavior?

A. The policy was misconfigured and allowed all Layer 2 broadcast traffic. B. The VM was using a static IPv6 address. C. An isolation policy was incorrectly applied instead of an application policy. D. The Allow All IPv6 option in the policy was selected.

Correct Answer: D

QUESTION NO: 10
An administrator plans to upgrade the Network Controller in a Flow Virtual Networking deployment. The environment includes multiple AHV clusters managed by Prism Central.
Which prerequisite must be verified before upgrading the Network Controller?

A. Flow Network Security must be upgraded to the target release before upgrading the Network Controller. B. Each cluster must be running the Flow Network Security version specified as compatible with the target Network Controller release. C. Each cluster must be running AHV versions compatible with the target Network Controller release. D. Network Controller Prism Element upgrades must be applied before before Network Controller Prism Central upgrades can be applied.

Correct Answer: A

Nutanix Certified Professional Network & Security v6.10 - NCP-NS Exam Questions