Nutanix Certified Professional - Network and Security (NCP-NS) 7.5 Sample Questions:

1. An administrator is using Flow Network Security to secure a 3-tier application and has already created and assigned the categories. The administrator does not have the details of the rules that need to be allowed to secure the application. How can the administrator use Flow Network Security to monitor the traffic and help with the policy creation without impacting the applications connectivity?

A) Create the Policy in Monitor mode, review the discovered traffic, allow the required traffic flows, and move Policy to Enforce mode.
B) Redirect the traffic to a Syslog server and monitor the traffic on the syslog server and then create the Flow Network Security policy based on monitored data in syslog server.
C) Use service insertion to redirect traffic through a monitoring service to capture the application traffic and create the Flow Network Security policy based on data captured in monitoring service.
D) Create the Policy in Save mode, review the discovered traffic, allow the required traffic flows, and move Policy to Enforce mode.

2. A junior network operator is assigned two predefined roles in Prism Central... Role A: Prism Viewer Role B:
VPC Admin The operator reports being able to successfully create, update, and delete Virtual Private Clouds (VPCs). However, the operator is unable to create a VM into the VPC. How does Prism Central determine the operator's effective permissions?

A) The Prism Viewer role's permissions take precedence, preventing any write operations from the VPC Admin role.
B) The permissions of the VPC Admin role override the more restrictive Prism Viewer role.
C) The permissions are the union of both roles, granting VPC management rights and global read-only access.
D) The system applies the principle of "most privilege," granting the highest level of access from any assigned role.

3. Which step is required before placing the Flow Network Security software bundle on a local web server?

A) Enable Direct Upload in Life Cycle Manager so the bundles can be transferred automatically to the Nutanix cluster.
B) Extract the downloaded bundle using 7zip and upload it directly to Prism Central.
C) Perform an inventory on the Nutanix cluster before transferring any bundle files to the web server.
D) Set up a local web server and download both the required software LCM bundle and compatibility bundle.

4. How can the administrator discover the root cause of the issue?

A) Check if traffic isolation has been configured on the Database tier and ensure that there is no policy preventing App tier communication with the Database tier.
B) Confirm that Inter-VM connectivity is enabled within the VM networking settings and that VMs in the Database tier are configured correctly to accept inbound traffic.
C) Verify that the port 3306 is open on the external gateway and that SNAT is not being applied for internal communication.
D) Check the security policies again to ensure that the rule allowing port 3306 from Web - > Database is applied and active, then check the policy enforcement mode to ensure it is in Enforcement Mode.

5. An enterprise has deployed a VPC called FinanceVPC using Nutanix Flow Virtual Networking. The Finance team needs the following connectivity: Internal servers in the VPC must reach an on-premises corporate data- center via a point-to-point encrypted link. Some servers in the VPC must also access the public internet with source NAT and receive inbound access via floating IPs. The corporate network uses overlapping IP space with other VPCs in the environment, so address translation is necessary for those workloads. The networking design must support routing via BGP for future site expansions and provide low-latency north-south connectivity. Which actions should the administrator take to satisfy this requirement?

A) Use a No-NAT External Network for the on-premises link and a NAT External Network for Internet access. Configure a VPN tunnel to the on-premises location and enable BGP on the VPC router for the on-premises link.
B) Use two No-NAT External Networks-one for the on-prem link and one for Internet access; configure static routes for both without NAT.
C) Use a single No-NAT External Network for both on-prem and Internet access; configure BGP and direct routing out to the internet without NAT.
D) Use a single NAT External Network for both the on-prem link and Internet access; configure a default route to the external network and enable SNAT and floating IPs for all traffic.

Solutions: