Nutanix NCP-BC-7.5 - Nutanix Certified Professional - Business Continuity (NCP-BC) 7.5

The fundamental purpose of a " Test Failover " in Nutanix Disaster Recovery is to provide a non-disruptive way to validate the recovery process. During this test, virtual machines are cloned from their most recent snapshots and powered on at the recovery site. If an administrator incorrectly maps the " Test Network " to the actual " Production Network " (VLAN/Subnet) at the recovery site, they create two significant risks.

First, this configuration can lead to immediate IP address conflicts. Because the test VMs have the exact same IP addresses as the live production VMs, having them active on the same logical production network will disrupt routing and potentially cause service outages for real users. Second, it defeats the " isolation " between production and test workflows. A valid DR test should occur in a " sandbox " where test applications can crash or exhibit errors without any possibility of affecting the live environment. By using the production network, the administrator is effectively running a " live " test on the production infrastructure, which is a dangerous violation of standard BCDR best practices. To avoid these outcomes, the administrator must map the test network to a dedicated, isolated VLAN or overlay network at the recovery AZ that has no physical or logical path back to the production segment.

Validation is a core pillar of a robust Business Continuity and Disaster Recovery (BCDR) strategy. Nutanix provides built-in orchestration through Recovery Plans, which automate the failover process of virtual machines between sites. When a " Test Failover " is executed, the system performs all the necessary steps, such as booting VMs in an isolated network, applying network mappings, and executing any custom scripts. To provide visibility into this process, Nutanix generates an automated execution report upon completion of any Recovery Plan task. This report provides a detailed chronological breakdown of every action performed by the orchestrator, including the exact start and end times for each stage (e.g., " Replication Check, " " Power On, " " IP Assignment " ). This built-in reporting is superior to manual event log filtering because it aggregates all related activities into a single, digestible summary that specifically tracks the performance of the DR plan. For leadership and compliance teams, these execution reports serve as documented proof that the RTO (Recovery Time Objective) is achievable and that every orchestrated step was validated during the test window.

Nutanix NearSync replication is designed to provide very low RPOs (1 to 15 minutes) by using " Lightweight Snapshots " (LWS). To maintain a 1-minute RPO, the system requires sufficient network bandwidth to transfer the delta changes before the next snapshot interval begins.

If the network bandwidth is insufficient or if the VM ' s data change rate (churn) suddenly spikes beyond the network ' s capacity to keep up, the system is designed to prioritize protection over RPO strictness. In this scenario, the Nutanix Cerebro service will automatically " downshift " the replication from NearSync to standard Asynchronous replication mode. This transition allows the system to use more traditional, robust snapshots that can handle longer transfer times, ensuring that the VM remains protected, even if the RPO temporarily increases to an hourly interval. Once the network conditions improve or the data churn decreases, the system will automatically attempt to " upshift " back to the 1-minute NearSync schedule. This behavior prevents application performance issues like write-pausing (Option D) or I/O degradation (Option A) and avoids unnecessary failovers (Option C), providing a resilient and adaptive data protection mechanism.

Replication in a Nutanix environment always begins with an " initial seed " . This first replication task is a full, 1-to-1 copy of all the data blocks currently occupied by the virtual machines on the source cluster. Unlike subsequent incremental snapshots—which only transfer the changed blocks—the initial seed requires sufficient physical or logical space at the destination to hold the entire data set of the protected VMs.

In this scenario, the administrator attempted to protect 4TB of virtual machine data but restricted the destination container ' s capacity to a mere 200GB. Because the destination container reports only 200GB of available space, the replication job will immediately stall or fail to progress as soon as the incoming data stream exceeds that limit. Nutanix replication requires a " landing zone " that can accommodate the full size of the initial snapshot before it can begin the process of data reduction (like compression or deduplication) at the remote site. To fix this, the administrator must increase the advertised capacity of the VMData container on Cluster B to at least 4TB (plus overhead for future growth and snapshots) to allow the initial full seed to complete successfully, thereby establishing the baseline for the BCDR protection schedule.

In a Nutanix legacy Protection Domain (PD) configuration, three primary elements must be in place for data protection to occur: the entities (VMs), the remote site (destination), and the schedule. Even if a VM has been added to a Protection Domain (negating Option A), the cluster will not take any action unless it is explicitly told " when " and " how often " to do so.

If no new snapshots are being created locally and replication is not starting, the most likely issue is that no " Schedule " has been configured for that Protection Domain. The schedule defines the RPO (e.g., hourly, daily) and the retention period for the snapshots. Without an active schedule, the Cerebro service simply has no instruction to initiate the snapshot process. While a missing vStore mapping (Option C) would cause the " replication " to fail, the " local snapshots " would still be created in the PD. Similarly, low bandwidth throttling (Option D) would cause the replication to move slowly or time out, but it would not prevent the initial creation of the local recovery points. Therefore, verifying the presence of a valid, active replication schedule is the mandatory first step for an administrator when a Protection Domain appears to be " idle " despite having VMs assigned to it.

Following a successful unplanned failover, the " Recovery Site " has technically become the new " Production Site " . However, the data protection relationship is now one-sided; while the VMs are running at the recovery site, they are likely no longer being replicated anywhere because the original protection policy was designed to move data from the (now failed) primary site to the recovery site.

The most critical post-failover task is to " re-protect " the workloads. This involves updating the Protection Policies in Prism Central to establish a new replication direction, typically from the current active site (the old recovery site) back to the original primary site (once it is restored) or to a third availability zone. Without re-protection, the business is running its production workloads without a safety net, leaving them vulnerable to a second failure. Deleting recovery points (Option A) is dangerous as it removes the only historical data available. Leaving the environment as-is (Option B) ignores the lack of ongoing protection. Initiating an immediate failback (Option D) is often impossible or unwise until the original site is fully stabilized and the data has been synchronized back. Therefore, establishing a new protection stream is the mandatory next step for operational resilience.

Nutanix supports software-based data-at-rest encryption for AHV workloads. This encryption is typically managed through " Storage Policies " in Prism Central, which are applied to virtual machines based on their " Categories " . For example, a policy might state that any VM in the Compliance:Encrypted category must have its data encrypted on the disk.

When a failover occurs, the VM moves to the recovery cluster. While the data that was replicated is already encrypted, the " Active " Storage Policy at the recovery site must be verified. If the recovery cluster does not have the same Storage Policy configuration or if the VM-to-Policy association was lost during the transition, the AOS storage engine at the recovery site will treat the VM as a standard, non-encrypted workload. This results in " newly written data " (writes occurring after the failover) being stored in plain text. To fix this, the administrator must " reassign " or refresh the Storage Policies and Categories at the recovery site. This ensures that the encryption rules are actively enforced on the new cluster, maintaining the organization ' s security posture post-disaster. This cleanup step is vital for compliance-heavy environments where encryption-at-rest is a mandatory requirement.

The Nutanix Cloud Gateway serves as a critical bridge between on-premises Nutanix clusters and the Nutanix Cloud Availability Zone (AZ). Its primary role is to provide a secure, encrypted tunnel for replicating recovery points and managing disaster recovery orchestration metadata. When utilizing standard IPSec for this traffic, the system architecture imposes certain throughput limitations based on the processing capabilities of the gateway instance. For a single Nutanix Cloud Gateway, the maximum supported bandwidth for IPSec-encrypted traffic is 1 Gbps.

This 1 Gbps limit is an important consideration for BCDR planning, as it defines the maximum " Snapshot-on-wire " throughput available for a given protection policy. If an organization has a high data change rate (churn) that exceeds 1 Gbps of sustained replication traffic, the Recovery Point Objective (RPO) may be at risk of lag. While the physical network link might be 10 Gbps or higher, the encryption overhead of the IPSec protocol within the gateway VM is the limiting factor. To achieve higher aggregate throughput, administrators would need to deploy multiple gateways or consider high-performance direct connectivity options if available. Understanding this 1 Gbps threshold ensures that administrators can accurately size their replication windows and manage expectations for initial seed transfers and ongoing delta synchronization to the cloud AZ.

This question refers to the behavior of Nutanix Metro Availability in conjunction with a Witness VM during a site-to-site communication failure. Metro Availability provides a zero-RPO, synchronous replication solution. To prevent " split-brain " (where both sites try to serve the same data independently), the Witness VM acts as a tie-breaker. When the two clusters lose connectivity with each other, both will immediately attempt to contact the Witness to " acquire the lock " on the protection domain. The Witness is programmed to prioritize the original " Active " site. If the primary cluster can reach the Witness, it will successfully acquire the lock and continue serving I/O locally to the guest VMs, ensuring zero downtime for the applications. The secondary site, unable to reach the primary or acquire the lock from the Witness, will transition its storage container to an " Inactive " state to protect data integrity. The administrator must manage this state by ensuring the Witness is always reachable from both clusters via independent network paths. If the primary site cannot reach the Witness, it will stop serving I/O to prevent inconsistent data states, highlighting the critical importance of Witness availability in a high-availability BCDR design.