Free Nutanix NCP-CN Practice Exam with Questions & Answers | Set: 3

The NKPA course specifies that the Nutanix Image Builder (NIB), used for creating custom machine images for NKP cluster nodes, supports specific Linux distributions that are compatible with Nutanix infrastructure and Kubernetes requirements. For NKP v2.12.x, the supported distributions for NIB are Ubuntu and Rocky Linux, as these are tested and optimized for NKP deployments, ensuring stability and compatibility with Cluster API (CAPI) and Nutanix AHV.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP Image Builder (NIB) supports Ubuntu and Rocky Linux as base distributions for creating custom images for NKP cluster nodes, ensuring compatibility with Kubernetes and Nutanix infrastructure.” Ubuntu provides a widely-used, well-supported base with long-term support (LTS) versions, while Rocky Linux is a CentOS replacement that Nutanix has adopted for its reliability and enterprise focus, especially after CentOS 8’s end-of-life in 2021.

Incorrect Options:

B. Fedora: Fedora is not a supported distribution for NIB in NKP, as it is more suited for bleeding-edge development rather than production Kubernetes environments.

D. CentOS: CentOS 8 reached end-of-life in December 2021, and Nutanix has shifted to Rocky Linux as its replacement for NKP image building. The course does not list CentOS as a supported option for NIB in NKP v2.12.x.

According to the NKPA 6.10 documentation, the FIPS Compliant Build feature is exclusively available for Enterprise tier licensing. This ensures compliance with NIST security standards and provides hardened cryptographic capabilities throughout the Kubernetes cluster stack.

Exact extract from documentation:

“The FIPS-compliant build feature is included in the NKP Enterprise tier, enabling deployments in environments that require strict security compliance.”

The Nutanix Kubernetes Platform (NKP) uses the Kubernetes Image Builder (KIB) or Nutanix Image Builder (NIB) to create custom machine images for NKP management and worker nodes. These images are tailored to include specific versions of Kubernetes, container runtimes (e.g., containerd), and other dependencies. The NKPA course specifies that KIB relies on Ansible playbooks to configure the image, and the versions of packages like Kubernetes and containerd are defined in Ansible configuration files.

The correct location to verify the package versions is ansible/group_vars/all/defaults.yaml. This file contains the default variables used by Ansible during the image-building process, including the versions of Kubernetes and containerd. For example, it may include entries like kubernetes_version: 1.30.5 and containerd_version: 1.7.22. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To ensure the correct versions of Kubernetes and containerd are used in KIB, check the ansible/group_vars/all/defaults.yaml file, which specifies the package versions for the image build.” The engineer can review and modify this file to confirm that the security team’s authorized versions (Kubernetes 1.30.5 and containerd 1.7.22) are being used.

Incorrect Options:

A. config/pulumi/vars/pulumi.kib.config: Pulumi is an infrastructure-as-code tool, but it is not used by KIB for specifying package versions. The NKPA course does not reference this file.

B. terraform/vars/default/terraform.tfvars: Terraform is used for infrastructure provisioning, not for defining software versions in KIB images.

D. The custom image's .env file: KIB does not use a .env file for version configuration; Ansible variables are used instead.

As per the NKPA 6.10 documentation and cluster autoscaler behavior, when nodes are scaled down in NKP (or any CAPI-managed environment), the node is deleted from the infrastructure provider (vSphere, AWS, Nutanix, etc.). This effectively removes it from both the cluster and the underlying hypervisor or cloud provider, thus freeing up resources and reducing costs.

To create a FIPS-compliant NKP deployment in an air-gapped environment, the following must be done:

Verify the OS (RHEL) itself is in FIPS mode.

When building the image, include both the offline fips and fips overrides to ensure the image and components are built in compliance.

When deploying the cluster, include FIPS-specific references for both Kubernetes and etcd components.

Exact extract:

“For FIPS deployments, ensure the OS is in FIPS mode, and include both offline fips and fips overrides during image creation to ensure compliant images and deployment.”

When mirroring the NKP bundle to a private registry, the recommended method is to use the nkp bundle push or similar commands with the --to-registry option, specifying the target registry along with the credentials (--to-registry-username and --to-registry-password).

Key reference from documentation:

“Use the --to-registry flag along with --to-registry-username and --to-registry-password to push the NKP bundle to a private registry.”

The NKPA course details that NKP Platform Applications, such as Grafana Logging, Grafana Loki, and Project Logging, are deployed to Kubernetes clusters to provide monitoring and logging capabilities. To ensure these components are automatically deployed to new workload clusters in a workspace, the administrator must enable them in the Application section under the workspace configuration in the NKP UI.

The course explains that the Application section allows administrators to select and configure platform applications that should be applied to all clusters within a workspace. By enabling Grafana Logging, Grafana Loki (for log aggregation), and Project Logging (for project-specific log management), these components are automatically deployed as part of the cluster provisioning process. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To deploy platform applications like Grafana Loki and logging components to new clusters, configure them in the Application section of the workspace settings in the NKP UI.”

Incorrect Options:

A. Enable them in the Insights section under workspace: The Insights section is for analytics and monitoring dashboards, not for deploying logging components.

B. Enable them in the Projects section under workspace: Projects are sub-divisions within workspaces for resource allocation, not for configuring platform applications.

C. Enable them in the Clusters section under workspace: The Clusters section is for managing cluster settings, not for enabling platform applications.

As per the NKPA 6.10 documentation under “Day 2 Operations: Managing Applications”, the recommended procedure to enable an application (like NKP Insights) involves accessing the cluster’s Application Dashboard. The NKP Insights application does not appear in the general category list if the cluster does not have the correct context or if the application category is not globally enabled.

The specific procedure to enable NKP Insights includes:

Navigate to the Clusters section from the left-side menu.

Select View Details for the target cluster (prod-01 in this case).

In the Application Dashboard of that specific cluster, locate the NKP Insights application.

Click the three-dot menu (ellipsis) for NKP Insights and select Enable.

As stated in the NKPA 6.10 documentation, when using external storage (such as AWS S3) with Loki for log storage, AWS credentials must be provided securely. This typically involves creating a Kubernetes Secret containing the static AWS credentials (access key ID and secret access key), which are referenced in the override ConfigMap to authenticate Loki’s S3 storage backend.

Key reference from documentation:

“For Loki to store logs in an S3 bucket, AWS credentials must be created as a Kubernetes secret and referenced in the storage configuration.”

According to the NKPA 6.10 documentation under the “Preparing for FIPS Compliance” section, the first step for enabling FIPS in an NKP environment is to ensure that the underlying operating system (OS) or OS images are correctly configured for FIPS mode. The Nutanix Kubernetes Platform can only leverage FIPS-compliant cryptographic modules if the underlying OS is already configured for FIPS operation.

Specifically, the documentation states:

"Before enabling FIPS in NKP, ensure that the OS or OS images are prepared and configured to operate in FIPS mode, following the vendor’s guidelines. Once the OS is in FIPS mode, the NKP cluster components can be provisioned with FIPS support."

This foundational step is critical to ensure cryptographic consistency and compliance throughout the NKP stack.