Nutanix NCP-BC-7.5 - Nutanix Certified Professional - Business Continuity (NCP-BC) 7.5

In Nutanix Disaster Recovery using Protection Domains (PDs), " Activate " is a high-level command used to promote a remote site to an active state. This is typically reserved for an unplanned failover scenario when the primary site is completely offline. If an administrator mistakenly uses " Activate " for a test instead of the proper " Test Failover " workflow, the secondary cluster will begin treating the replicated snapshots as active, live virtual machines. This process involves promoting the storage and registering the VMs to the local hypervisor.

To return to a steady state where the production cluster is the only active site, the administrator must perform a cleanup on the DR cluster. The " Deactivate " command on the DR cluster serves two main purposes: it changes the Protection Domain status from " Active " back to " Standby " and provides an option to " Destroy VMs " associated with that PD. Choosing to destroy the VMs on the DR cluster is essential to prevent duplicate VM instances or IP address conflicts when production resumes. Simply deleting the VMs manually (Option C) is insufficient because it does not reset the PD ' s metadata status in the Nutanix Cerebro service. By deactivating the PD and destroying the VMs at the DR site, the administrator ensures that the DR site returns to its role as a passive replication target, allowing the primary production cluster to continue its operations without being impacted by the accidental activation.

The " Test Failover " feature in Nutanix Disaster Recovery is a critical tool for ensuring that a BCDR plan is actually functional before a real disaster occurs. The primary goal of a test failover is to validate the entire recovery orchestration—including power-on sequences, script execution, and network mappings—in a completely non-disruptive manner.

During a test failover, the virtual machines are recovered at the destination site using the most recent snapshots, but they are typically connected to an " Isolated " or " Test " network. This allows the administrator to log into the recovered VMs and verify that the application starts correctly without causing any IP address conflicts or interference with the live production systems at the primary site. Unlike a " Planned Failover " or " Unplanned Failover, " a test failover does not move the production workload (negating Option B) and does not stop ongoing replication (negating Option D). It is purely a validation task designed to identify gaps in the Recovery Plan, such as missing dependencies or incorrect network assignments, thereby providing confidence that the organization ' s RTO and RPO goals can be met during a real emergency.

By default, Nutanix clusters use the same management network interface (eth0) for administrative tasks and replication traffic. In high-traffic environments or over narrow WAN links, replication can consume all available bandwidth, impacting management accessibility or other VM traffic. When a new dedicated high-speed link (such as a 10G connection) is added specifically for BCDR, the cluster must be instructed to move its replication traffic to that new path.

The Nutanix solution for this is " Network Segmentation for DR. " This feature allows the administrator to define a new, dedicated network for disaster recovery and replication. By configuring segmentation, the administrator assigns a specific virtual interface (typically ntnx0) and a dedicated set of IP addresses for each Controller VM (CVM) on the new 10G link. Once enabled, the Cerebro and Stargate services will bind to these new " segmented " IPs for all site-to-site data transfers. This effectively offloads replication from the management network, ensuring that the 10G link is fully utilized for BCDR while the management network remains stable for administrative tasks. This configuration provides both better performance for replication (meeting aggressive RPOs) and better overall cluster security and stability through traffic isolation.

In a Nutanix Synchronous Replication or Metro Availability setup, data is mirrored in real-time, but the " intelligence " required to automate a failover resides outside of the two primary clusters. Without a Witness VM (Option C), the secondary cluster cannot distinguish between a total primary site failure and a simple network partition between the two data centers. If the clusters lose communication but there is no Witness to act as an independent tie-breaker, the secondary cluster will stay in a " Standby " state and will not automatically " promote " its storage to " Active " or power on the VMs. This is a safety mechanism to prevent " split-brain " where two clusters might try to serve the same data, leading to corruption. To enable automatic failover, a Witness VM must be deployed at a third, independent site and registered to both clusters. The Witness allows the secondary site to verify that the primary site has indeed failed; once verified, the Witness grants the " lock " to the secondary site, allowing the automated failover process to begin. Thus, the lack of a Witness is the " most likely cause " for why a failover test would fail to trigger automatically during a storage or site outage.

Nutanix NearSync replication uses Lightweight Snapshots (LWS) to achieve RPOs as low as 1 minute. To maintain this aggressive schedule, the system must be able to replicate all the " delta " changes (the data that has changed since the last snapshot) within the RPO window. If the data change rate (churn) of the VM increases, or if the available network bandwidth decreases, the system may find that it cannot complete the replication of one LWS before the next one is due.

When the Nutanix Cerebro service detects that it is consistently missing its NearSync target, it will automatically " downshift " the replication to a standard Asynchronous schedule (typically hourly) to ensure that the VM remains protected at a manageable frequency. This is a self-healing mechanism designed to prevent replication jobs from stacking up and causing cluster instability. Insufficient bandwidth (Option D) is the most common cause for this downshift, as the " Snapshot-on-wire " cannot be moved fast enough to satisfy the 5-minute requirement. While high RTT (Option A) is a requirement for Synchronous replication, NearSync is designed to handle higher latencies (up to 80ms or more), making bandwidth the primary bottleneck in these troubleshooting scenarios.

NearSync replication is a Nutanix technology that provides RPOs as low as 1 minute by using " Lightweight Snapshots " (LWS). However, NearSync has specific operational requirements to maintain its aggressive schedule . If the system detects that it cannot maintain the 15-minute RPO using lightweight snapshots, it will automatically " downshift " to a standard Asynchronous (hourly) replication mode to ensure that protection is not lost entirely.

One of the most common triggers for this temporary transition is the addition of a new virtual machine to the category associated with the Protection Policy. When a new VM is added, the Nutanix cluster must perform a " full initial sync " (also known as a seed replication) to transfer all the VM ' s data to the remote site. Because a full seed replication involves transferring much more data than a standard delta update, it often exceeds the time window and processing capabilities of the NearSync LWS engine. To handle this large data transfer safely, the system switches to the Async (hourly) schedule, which uses more robust but slower snapshot mechanisms. Once the initial sync of the new VM is complete and the clusters are in a " consistent " state, the system will automatically attempt to " upshift " back to the NearSync schedule to restore the 15-minute RPO. This behavior ensures that the system handles growth and changes in the environment while maintaining the highest possible level of protection without administrative intervention.

Testing is the most vital component of a resilient BCDR strategy, as it proves that recovery objectives (RTO/RPO) are achievable before a real emergency occurs. The Nutanix " Test Failover " feature is purpose-built for this requirement. Unlike a Planned Failover (which shuts down production) or an Unplanned Failover (which assumes production is dead), a Test Failover performs a non-disruptive validation.

During a Test Failover, the orchestration engine uses the most recent snapshots to power on VMs at the destination cluster. To satisfy the " without impacting production " requirement, the test VMs are typically attached to an " Isolated " or " Test " network segment that has no route to the live production network. This prevents IP address conflicts and service interference while allowing the administrator to log into the recovered VMs and verify that applications start correctly. Simple " Validation " (Option A) only checks the configuration settings and connectivity but does not actually test the power-on sequence or application logic. By executing a full Test Failover, the organization gains documented proof of its DR readiness, identifying potential issues like missing dependencies or incorrect boot orders without causing any disruption to the users currently accessing the primary site.

Synchronous replication is designed for zero data loss by requiring that every write be acknowledged at both the primary and recovery sites before the application can proceed. This creates a " hard " dependency on the network link between the two clusters . If the network connectivity is interrupted (e.g., during scheduled maintenance), the primary cluster will be unable to receive acknowledgments from the remote site.

By default, if the synchronous link is broken, the primary cluster may pause I/O to the protected VMs to prevent data inconsistency, which would cause the VMs to become unresponsive to users. To prevent this during planned maintenance while ensuring that the VMs stay online at the primary site, the administrator should temporarily transition the protection mode. Changing the Protection Policy from " Synchronous " to " Asynchronous " (Option C) removes the real-time write-mirroring requirement. This allows the VMs to continue serving local I/O independently of the remote site ' s status. While this technically increases the RPO during the maintenance window, it ensures application availability. Once the maintenance is complete and network connectivity is restored, the administrator can change the policy back to Synchronous. The system will then perform a catch-up sync and return to the Zero-RPO state once the data at both sites is identical again. This operational maneuver is a standard best practice for managing " stretched " cluster environments during infrastructure updates.

Hardening a Nutanix cluster for Business Continuity involves implementing security controls that protect recovery data from unauthorized destruction. In many modern cyberattacks, specifically ransomware, the goal is not just to encrypt production data but also to delete the snapshots and backups that would allow for recovery. To satisfy the requirement that only authorized modifications occur, the administrator must move beyond simple Role-Based Access Control (RBAC) and implement an " Approval Policy " .

The Approval Policy feature in Prism Central forces a secondary layer of validation for sensitive operations like snapshot deletion. When a user tries to delete a recovery point, the Nutanix orchestration engine captures the request and holds it in a " Pending " state. The request must be reviewed and approved by a designated person with approval authority. This ensures that even if an administrator ' s account is compromised, the attacker cannot immediately wipe out the snapshots needed to restore the environment. This " multi-person control " is a recognized security best practice for protecting mission-critical data. While cluster lockdown (Option C) prevents unauthorized SSH access, it does not manage the logical management of data through the Prism UI. An Approval Policy provides the specific " modification and deletion " control requested, ensuring that the cluster ' s recovery points remain a reliable " source of truth " following a security incident or administrative error.

Nutanix uses a " Roll-up " retention strategy to optimize storage while maintaining a range of recovery options. This strategy keeps all high-frequency recovery points for the most recent period and then consolidates (rolls up) older snapshots into daily or weekly points as they age.

For a policy with a 1-hour RPO and 5-day retention, the system is designed to provide granular recovery for the immediate past. By default, Nutanix retention logic maintains the hourly snapshots for the current 24-hour window. As snapshots move past the 24-hour mark, they are " rolled up " into a single daily snapshot to save space while still providing a 5-day historical view. Therefore, after six days of operation, the administrator will find approximately 24 hourly recovery points for the most recent 24 hours, followed by several daily recovery points representing the previous four days. This approach balances the need for surgical " point-in-time " recovery (to combat recent data corruption or ransomware) with the need for long-term historical data, ensuring that the BCDR solution is both effective and storage-efficient.