Nutanix NCP-CI-AWS - Nutanix Certified Professional - Cloud Integration - AWS (NCP-CI-AWS 6.10) Exam

To protect workloads on an NC2 cluster on AWS, deploying strategies that ensure high availability and disaster recovery are essential. The two valid options are:

Create a Second NC2 Cluster in a Different Availability Zone:

High Availability: Deploying a second NC2 cluster in a different availability zone ensures that workloads can be quickly recovered in case of an availability zone failure.

Disaster Recovery: This setup enables asynchronous replication between clusters, providing a robust disaster recovery solution.

Use an Existing On-Prem Nutanix Cluster as a Disaster Recovery Target:

Hybrid DR: Leveraging an existing on-premises Nutanix cluster for disaster recovery provides a cost-effective and efficient DR solution.

Replication: Set up replication policies to ensure data is consistently copied from the NC2 cluster on AWS to the on-premises cluster.

Why Not Other Options:

One-node cluster in another availability zone: Not a valid DR solution as a single-node cluster cannot provide the required resilience and high availability.

Deploy a cluster across two availability zones: While this can enhance availability, it is not a typical approach for Nutanix clusters which are designed to operate within a single availability zone for simplicity and performance reasons.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Disaster Recovery Best Practices

AWS Availability Zones and Disaster Recovery Documentation

Flow Virtual Networking (FVN)introduces a software-defined overlay that requires significant management overhead for handling VPC transit, encapsulation, and complex routing tables. Due to the resource-intensive nature of managing these advanced networking services, Nutanix restricts the supported Prism Central (PC) instance sizes for FVN deployments. OnlyLarge and Extra LargePrism Central instances are supported to ensure there is adequate CPU and memory available to run the virtual routing and gateway components effectively. Smaller PC instances (Small or Medium) lack the necessary performance headroom and may experience latency or management failures when trying to process the continuous network synchronization required by the FVN overlay in a production cloud environment.

The Nutanix Create Cluster wizard may not support selecting subnets that have both IPv4 and IPv6 CIDR blocks due to compatibility or configuration constraints.

When a subnet with both CIDR blocks is present, it can cause issues in the selection process during cluster creation, as the system might not be able to properly handle or recognize the dual-stack configuration.

Ensuring that the management subnet has only an IPv4 CIDR block, without an IPv6 CIDR block, could resolve this issue and allow for successful selection in the cluster creation wizard.

Refer to the Nutanix and AWS documentation on subnet configuration and requirements for NC2 cluster deployments, specifically addressing IPv4 and IPv6 compatibility and constraints.

To provide VMs with outbound internet connectivity in AWS using a private subnet, the administrator needs to create the following components in the VPC:

Private Subnet: A private subnet is required to house the VMs that need outbound internet access but do not require direct inbound access from the internet.

NAT Gateway: A NAT (Network Address Translation) Gateway is necessary to allow instances in the private subnet to connect to the internet or other AWS services while preventing the internet from initiating a connection with those instances.

Public EIP (Elastic IP Address): An EIP is associated with the NAT Gateway to provide a persistent public IP address that allows outbound internet traffic from the private subnet to be routed correctly.

Route Table: A route table is configured to route traffic from the private subnet to the NAT Gateway for outbound internet access.

AWS NAT Gateway Documentation

AWS VPC Subnet Basics

To correctly route traffic in a hybrid environment using Flow Virtual Networking, administrators must distinguish between internal private traffic and external internet traffic. Internal traffic usingRFC 1918address ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) should be routed to theoverlay-external-subnet-no-nat. This ensures that traffic directed to the on-premises data center retains its original IP address for auditing and security purposes. Conversely, all other traffic (0.0.0.0/0), typically destined for the internet, should be routed to theoverlay-external-subnet-nat. This configuration allows the NAT Gateway to handle internet-bound requests while maintaining a transparent, non-NAT path for corporate internal communication.

When selecting the NC2 subscription plan from the Nutanix Billing portal, the available options include:

Pay-as-you-Go (PayG): A flexible payment option where users are billed based on their actual usage, providing cost efficiency for variable workloads.

Bring your own License (BYOL): Allows users to utilize existing Nutanix licenses they have purchased, offering a cost-effective way to leverage existing investments in Nutanix software.

Refer to the Nutanix billing and subscription documentation for detailed descriptions of subscription plans and their benefits.

The role of " Customer Administrator " in Nutanix Cloud Integration with AWS (NC2) is designed to meet the requirements of creating and managing multiple organizations and clusters, as well as managing user access for the entire company.

Roles and Permissions:

Customer Administrator: This role has the broadest set of permissions, allowing the user to create and manage organizations, clusters, and user access across the entire company. It encompasses administrative control over multiple aspects of the NC2 environment.

Capabilities:

Organization Management: Ability to create and manage multiple organizations.

Cluster Management: Full control over creating, configuring, and managing clusters.

User Access Management: Manage user roles and permissions, ensuring that the right individuals have access to the necessary resources.

Why Not Other Roles:

Organization Administrator: Limited to managing organizations but not clusters and user access at the company level.

Customer Security Administrator: Focuses on security aspects, lacking broader administrative capabilities.

Cluster Administrator: Limited to managing clusters without the ability to manage organizations and user access comprehensively.

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Role-Based Access Control Documentation

In Nutanix Cloud Integration with AWS, specifically version 6.7, the role that allows full access to clusters created within an organization is the Organization Administrator.

The Organization Administrator role has the highest level of privileges within an organization, enabling the user to manage all aspects of the clusters, including creation, modification, and deletion.

This role is designed to oversee and control the entire organization ' s resources, ensuring comprehensive management capabilities over all clusters and associated resources.

Refer to the Nutanix documentation on roles and permissions for NC2 on AWS for further details.

For mission-critical workloads, the Recovery Time Objective (RTO) is a primary concern.

Multicloud Snapshot Technology (MST)coupled with aPilot Light Deploymentprovides the necessary infrastructure to support an automated recovery plan. In a Pilot Light scenario, a small, " always-on " version of the Nutanix cluster (usually the minimum number of nodes) is maintained in AWS to host Prism Central and handle background replication tasks. Because the management layer is already active, recovery plans can be fully automated to power on VMs and adjust networking instantly upon failure. In contrast, a " Zero Compute " deployment lacks an active management interface, requiring manual intervention to provision a cluster before recovery can begin, which significantly increases RTO and prevents full automation.

To control network traffic at the individual User VM (UVM) subnet level, creating a custom security group is the appropriate action. This approach allows for fine-grained control over inbound and outbound traffic rules that can be applied to specific subnets or individual instances within those subnets.

Custom Security Group:

Custom security groups enable administrators to define specific traffic rules tailored to the needs of individual subnets or VMs. This includes specifying allowed IP ranges, ports, and protocols.

By applying these custom security groups to the UVMs, the organization can control access and enhance security according to their policies and requirements.

Steps to Create a Custom Security Group:

Navigate to the AWS Management Console and go to the VPC service.

Select " Security Groups " under the " Security " section.

Click on " Create Security Group " and define the name, description, and VPC.

Add inbound and outbound rules according to the desired traffic control policies.

Attach the custom security group to the UVMs or subnets in question.

Nutanix Cloud Clusters on AWS Administration Guide

AWS Security Group Documentation

Nutanix Best Practices for Security Groups