Free Practice Questions for Nutanix NCP-CN Exam

The NKPA course emphasizes that NKP’s fleet management capabilities allow administrators to manage multiple Kubernetes clusters, including lightweight clusters on edge devices, by attaching them to an NKP workspace. With the NKP Ultimate license tier, the administrator has access to advanced fleet management features, including GitOps-based application deployment across attached clusters.

The most efficient way to lifecycle manage application deployments across the 30 edge devices is to create a new workspace and attach the 30 edge devices to this workspace using the Attach Cluster functionality (Option D). Once attached, NKP can use GitOps (via Flux) to push applications to all clusters in the workspace simultaneously, ensuring consistent deployment and lifecycle management. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For managing edge devices with lightweight Kubernetes, attach the clusters to an NKP workspace using the Attach Cluster feature, enabling centralized application deployment and lifecycle management via GitOps.” The administrator can use the kubeconfig files to attach each cluster via the NKP UI or CLI (e.g., nkp attach cluster).

Incorrect Options:

A. Create a GitHub configuration for each device: This is manual and inefficient compared to NKP’s centralized GitOps management.

B. Create a script to automate deployment: Scripting is error-prone and lacks NKP’s built-in fleet management capabilities.

C. Delete lightweight Kubernetes and deploy new clusters: This is unnecessary, as NKP can manage existing clusters, including lightweight ones.

As per the NKPA 6.10 documentation and cluster autoscaler behavior, when nodes are scaled down in NKP (or any CAPI-managed environment), the node is deleted from the infrastructure provider (vSphere, AWS, Nutanix, etc.). This effectively removes it from both the cluster and the underlying hypervisor or cloud provider, thus freeing up resources and reducing costs.

The Nutanix Kubernetes Platform (NKP) leverages Cluster API (CAPI) to manage the lifecycle of Kubernetes clusters. When preparing machine images for NKP deployment, the Nutanix Image Builder (NIB) or Kubernetes Image Builder (KIB) process is used to create custom machine images that are compatible with NKP’s infrastructure requirements. According to the NKPA course, the primary purpose of this process is to create CAPI-compliant images that can be used as the base for NKP cluster nodes.

The NKPA course explains that NKP uses CAPI to provision and manage Kubernetes clusters, and CAPI requires machine images that meet specific criteria, such as including the necessary Kubernetes components, container runtimes, and operating system configurations. The NIB/KIB process ensures that the images are pre-configured with these components, making them suitable for use as NKP worker and control plane nodes. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The Nutanix Image Builder (NIB) or Kubernetes Image Builder (KIB) is used to create CAPI-compliant machine images that include the required OS, Kubernetes binaries, and dependencies for NKP cluster nodes.”

These images are typically based on supported operating systems like Rocky Linux or Ubuntu, as provided by Nutanix, and are customized to include the container runtime (e.g., containerd), kubeadm, and other dependencies required for CAPI-based cluster provisioning. The resulting images are stored in a location accessible to the NKP deployment process, such as a local registry or Nutanix Prism Central.

Incorrect Options:

A. Hardening an OS image with client-supplied hardening scripts: While hardening the OS is a good practice, it is not the primary purpose of the NIB/KIB process. The NKPA course notes that hardening can be applied as part of image customization, but the core goal is to ensure CAPI compliance, not just hardening.

B. Creating a custom user account for NKP admins to ensure access to NKP nodes: The NIB/KIB process does not focus on creating user accounts. User access is managed through Kubernetes RBAC or external identity providers, as covered in the NKPA course’s authentication section.

C. Tagging the image to be used specifically for NKP: Tagging may occur as part of image management, but it is not the primary purpose. The NKPA course emphasizes CAPI compliance over tagging.

According to the NKPA 6.10 documentation, the Pre-provisioned infrastructure provider (CAPPP) requires the user to provide an inventory file of the servers that will become the cluster nodes. This inventory file contains connection information (IP addresses, credentials, etc.) for each pre-provisioned node, enabling the Cluster API to connect and configure these servers directly during cluster creation.

The NKPA course explains that NKP’s fleet management capabilities allow centralized policy federation and management of multiple Kubernetes clusters from a single pane of glass, while workspaces provide isolation for different teams or groups. To meet the requirement of federating policy while separating clusters by group, the IT team needs the NKP Ultimate license, which includes advanced fleet management features.

With NKP Ultimate, the IT team can:

Create three workspaces (one for each group: Fin VD, Fin Insurance, Fin Travel).

Assign the corresponding Kubernetes clusters to each workspace, ensuring isolation between groups.

Use NKP’s fleet management to apply policies (e.g., RBAC, monitoring, logging) across all clusters from a single pane of glass, such as the NKP UI or CLI.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “NKP Ultimate provides fleet management for centralized policy federation across multiple clusters, using workspaces to isolate clusters for different teams or groups.” This setup ensures that each group’s clusters are separated while maintaining centralized policy management, aligning with the IT team’s requirements.

Incorrect Options:

B. NKP Starter: The Starter license lacks fleet management and workspace isolation features, making it unsuitable for this scenario.

C. NKP Pro with projects: Projects are sub-divisions within workspaces for resource allocation, not for cluster isolation or fleet management. NKP Pro may not include full fleet management capabilities.

D. NKP Pro with workspaces: While NKP Pro supports workspaces, it may not provide the full fleet management needed for centralized policy federation across all clusters. NKP Ultimate is the better fit.

As per the NKPA 6.10 documentation under “Day 2 Operations: Managing Applications”, the recommended procedure to enable an application (like NKP Insights) involves accessing the cluster’s Application Dashboard. The NKP Insights application does not appear in the general category list if the cluster does not have the correct context or if the application category is not globally enabled.

The specific procedure to enable NKP Insights includes:

Navigate to the Clusters section from the left-side menu.

Select View Details for the target cluster (prod-01 in this case).

In the Application Dashboard of that specific cluster, locate the NKP Insights application.

Click the three-dot menu (ellipsis) for NKP Insights and select Enable.

A bastion host in a dark site environment serves as a secure entry point for managing the NKP deployment, providing access to the cluster infrastructure without direct Internet connectivity. The NKPA course outlines the prerequisites for preparing a Linux VM as a bastion host, focusing on secure access and time synchronization, which are critical for air-gapped Kubernetes deployments.

Get or create SSH Keys (Option B):The bastion host requires SSH keys to enable secure, passwordless access to the NKP cluster nodes and other infrastructure components (e.g., Nutanix AHV hosts). The NKPA course specifies that SSH keys must be generated or obtained and configured on the bastion host to facilitate secure communication during deployment and management tasks. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For a bastion host in an NKP dark site deployment, ensure SSH keys are created or obtained to enable secure access to cluster nodes and infrastructure.” The engineer can generate SSH keys using ssh-keygen and distribute the public key to the target systems.

Enable NTP Service (Option D):Time synchronization is essential in Kubernetes clusters to ensure consistent logging, certificate management, and scheduling. In a dark site with no Internet access, the bastion host must be configured to synchronize time with an internal NTP (Network Time Protocol) server or act as an NTP server itself. The NKPA course emphasizes enabling the NTP service on the bastion host to maintain accurate time across the air-gapped environment. The NCP-CN 6.10 Study Guide notes: “Enable the NTP service on the bastion host to ensure time synchronization in a dark site NKP deployment, as Kubernetes requires accurate time for proper operation.” The engineer can enable NTP using commands like systemctl enable ntpd and configure it to use an internal time source.

Incorrect Options:

A. Install LDAP Server: LDAP is used for centralized authentication, but it is not a requirement for a bastion host in an NKP dark site deployment. The course focuses on SSH access instead.

C. Install Docker: While Docker is needed on Kubernetes nodes for container runtimes, the bastion host’s role is to provide secure access and management, not to run containers.

The NKPA course addresses resource contention in Kubernetes clusters, where one application (e.g., ApplicationB) consumes excessive resources, impacting others (e.g., ApplicationA). To mitigate this, the course recommends implementing Quotas and Limit Ranges.

Resource Quotas restrict the total amount of CPU, memory, and other resources a namespace can consume, ensuring fair resource allocation across teams.

Limit Ranges set minimum and maximum resource limits for individual pods and containers within a namespace, preventing any single application from monopolizing resources.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To prevent resource contention in NKP clusters, apply Resource Quotas to limit namespace resource usage and Limit Ranges to enforce pod and container resource boundaries.” For example, the administrator can create a ResourceQuota to cap ApplicationB’s namespace resource usage and a LimitRange to restrict its pod resource requests/limits, ensuring ApplicationA has sufficient resources.

Incorrect Options:

B. Setting up Network Policies: Network Policies control network traffic, not resource usage.

C. Configuring RBAC: RBAC manages access permissions, not resource allocation.

D. Implementing Continuous Deployment (CD): CD automates deployments but does not address resource contention.

Attaching an existing Amazon EKS cluster to NKP for fleet management involves integrating the cluster into NKP’s management plane, which requires specific preparatory steps. The NKPA course outlines that the first step is to create a service account with cluster-admin permissions in the EKS cluster. This service account is used by NKP to authenticate and manage the cluster, enabling operations like monitoring, scaling, and application deployment.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide explains: “To attach an external Kubernetes cluster, such as Amazon EKS, to NKP, a service account with cluster-admin role bindings must be created to allow NKP to interact with the cluster’s API server.” The service account is configured with a token that NKP uses to authenticate requests. The NKPA course provides detailed steps, including creating the service account, assigning the cluster-admin ClusterRole, and generating a token for NKP integration. This step is critical to ensure NKP has the necessary permissions to manage the EKS cluster.

Incorrect Options:

A. Configure a ConfigMap according to EKS configuration: While ConfigMaps may be used for specific configurations, they are not the first step for attaching an EKS cluster. The NKPA course prioritizes service account creation.

C. Configure HAProxy to get connected to EKS clusters: HAProxy is a load balancer, not required for attaching EKS clusters to NKP. EKS uses AWS-native load balancers, and NKP connects via the Kubernetes API.

D. Deploy cert-manager in the EKS clusters: Cert-manager is used for certificate management, not a prerequisite for attaching EKS clusters. The NKPA course does not list it as a required step.

The NKPA course specifies that air-gapped deployments and centralized fleet management of multiple clusters are advanced features of NKP, requiring the NKP Ultimate license tier. The Ultimate tier includes support for air-gapped environments (via Air-Gapped Bundles) and fleet management capabilities, such as attaching and managing multiple clusters under a single management plane, which is critical for the national defense company’s scenario.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “The NKP Ultimate license tier is required for air-gapped deployments and centralized management of multiple Kubernetes clusters, providing the necessary tools for secure, isolated environments.” This ensures the company can deploy and manage their three clusters in an air-gapped setup while maintaining strict data security.

Incorrect Options:

A. NKP Starter: The Starter tier lacks air-gapped and fleet management features.

C. NKP Pro: The Pro tier may support some advanced features but not air-gapped deployments or full fleet management.

D. NKP UI: This is not a license tier; it’s a UI component of NKP.