Question 1

[Manage Building an NKP Cluster]
A company has decided to expand NKP to features that require higher product tiers, like fleet-
management and additional infrastructure providers. The company has already obtained the
necessary licensing. Which action is required when adding and activating a license from NKP Starter
to a higher-tier product?

Accepted Answer

C

Explanation: Upgrading a Nutanix Kubernetes Platform (NKP) license is a privileged administrative action. According to the official Nutanix documentation, only a user assigned the Global License Administrator role has the necessary permissions to add and activate a new license key. If the current user session does not have this role, the user must log out and log back in with an account that possesses these specific privileges to access the license management features in the NKP web console and apply the higher-tier license.

Question 2

[Conduct NKP Fleet Management]
A Cloud Engineer wishes to attach existing AKS clusters to a newly deployed NKP management
cluster.
What should the engineer consider specific to attaching these types of clusters to NKP?

Accepted Answer

A

Explanation: To attach an existing Azure Kubernetes Service (AKS) cluster to Nutanix Kubernetes Platform (NKP) for fleet management, a new service account must be created on the AKS cluster. The default kubeconfig file generated by the Azure CLI (az aks get-credentials) uses an Azure-specific authentication provider that requires interactive login or an existing Azure session. NKP's Kommander component, which runs as a service, cannot use this mechanism. Instead, it requires a self-contained, non-interactive authentication method, which is achieved by creating a service account and using its long-lived authentication token to build a new, compatible kubeconfig file for the attachment process.

Question 3

[Prepare the Environment for an NKP Deployment] A company is required by NIST to follow FIPS guidelines for compliance. What is the first step for enabling FIPS in NKP?

Accepted Answer

C

Explanation: Enabling Federal Information Processing Standards (FIPS) compliance for Nutanix Kubernetes Platform (NKP) is a multi-layered process that begins at the operating system level. Before any NKP components can be installed or configured for FIPS mode, the underlying OS on the nodes must be hardened and prepared according to the specific OS vendor's FIPS guidelines. This foundational step ensures that the core cryptographic modules used by the system are FIPS 140-2 validated, which is a mandatory prerequisite for the entire platform to operate in a compliant manner.

Question 4

[Perform Day 2 Operations]
A dev team needed to optimize their logging system to be more robust, because the CPU and
memory limits were insufficient, which caused delays in log collection and processing during times of
high demand.
After a deep performance analysis, they decided to increase the CPU limits from 1 to 4 and the
memory from 1000Mi to 4Gi.
Which ConfigMap should the development team run with custom resource requests and limit values
for fluentd?

Accepted Answer

B

Explanation: To customize a platform add-on like the logging operator in Nutanix Kubernetes Platform (NKP), you must create a ConfigMap with a specific name ( -overrides) in the kommander namespace. The question requires increasing Fluentd's CPU and memory limits. Option B presents a syntactically correct YAML definition for a ConfigMap named logging-operator-logging-overrides. The data key values.yaml contains a properly structured YAML block that sets the fluentd.resources.limits and fluentd.resources.requests to the desired values of 4 CPU and 4Gi memory, which directly addresses the performance issue described.

Question 5

[Prepare the Environment for an NKP Deployment] When deploying NKP using the Nutanix provisioning method (CAPX), what are the supported OS platforms?

Accepted Answer

B

Explanation: According to the official Nutanix Karbon Platform (NKP) documentation, when deploying Kubernetes clusters using the Nutanix provisioning method (CAPX), the supported guest operating systems for worker nodes are specific versions of Rocky Linux and Ubuntu. The documentation explicitly lists Rocky Linux 8.7 and Ubuntu 22.04 as the validated and supported platforms. This ensures that the underlying nodes are fully compatible with the Cluster API Provider for Nutanix (CAPX) for automated lifecycle management, scaling, and operations within the Nutanix Cloud Platform.

Question 6

[Prepare the Environment for an NKP Deployment] A Platform Engineer is preparing machine images for NKP through the NIB or KIB process. What is the purpose of doing this?

Accepted Answer

D

Explanation: The primary purpose of using Nutanix Image Builder (NIB) or Karbon Image Builder (KIB) is to prepare a base OS image with all the necessary software components required by the Cluster API (CAPI) framework. Nutanix Kubernetes Platform (NKP) leverages CAPI for the lifecycle management of Kubernetes clusters. The image building process installs specific versions of kubeadm, kubelet, and containerd onto the image. This makes the resulting image "CAPI-compliant," enabling NKP to successfully bootstrap and manage the virtual machines as Kubernetes nodes.

Question 7

[Conduct NKP Fleet Management]
Some time ago, an EKS cluster was attached to be managed with NKP (Fleet Management). Now, a
Platform Engineer has been asked to disconnect the EKS cluster from NKP for licensing reasons. After
disconnecting the cluster, the developers realized that application changes are still being reflected in
the EKS cluster, despite the fact that the EKS cluster was successfully detached from NKP. How should
the engineer resolve this issue?

Accepted Answer

D

Explanation: Nutanix Kubernetes Platform (NKP) uses a GitOps model, powered by Flux, to manage attached clusters. When a cluster is detached using the nkp detach command, NKP removes it from its central management plane. However, this process intentionally does not uninstall the Flux components or disable the GitOps configuration on the detached cluster itself. This ensures that running applications are not disrupted. As a result, the Flux controller on the EKS cluster remains active and continues to synchronize with the management Git repository, applying any new changes. To stop this behavior, the administrator must manually suspend the Flux GitRepository resource on the detached cluster, which halts the synchronization process.

Question 8

[Perform Day 2 Operations]
A Platform Engineer has a requirement for backup and recovery and would like to leverage an Out-
Of-The-Box solution distributed with NKP. What is the backup and recovery solution distributed for
NKP?

Accepted Answer

C

Explanation: Nutanix Kubernetes Platform (NKP) provides an integrated add-on for Velero, an open-source tool designed specifically for backing up and restoring Kubernetes cluster resources and persistent volumes. This out-of-the-box integration allows platform engineers to manage the lifecycle of Kubernetes applications, including disaster recovery, by leveraging a Kubernetes-native solution. Velero captures the state of cluster resources and can back them up to an object store, making it the distributed backup solution for NKP.

Question 9

[Prepare the Environment for an NKP Deployment]
A Platform Engineer is deploying a new NKP cluster that has internet connectivity. Now, a Cloud
Administrator and Security Administrator are discussing the security of communications between the
NKP Kubernetes cluster and the container registry. The engineer proposes to have an on-prem
private registry.
What is the most significant reason that the engineer should create a private registry instead of
configuring a secure connection between the NKP cluster and Github (SaaS)?

Accepted Answer

A

Explanation: In an air-gapped Nutanix Kubernetes Platform (NKP) deployment, the Konvoy bootstrap image must be made available to the local Docker daemon on the bastion host before initiating the bootstrap cluster creation. The docker load command is the standard and officially documented method for this task. It directly loads an image from a tar archive (.tar file) into the local image cache on the bastion host. This makes the image accessible for the konvoy up command, which creates the temporary bootstrap cluster.

Question 10

[Conduct NKP Fleet Management]
At a national defense company, protecting sensitive data is their top priority. With the increase in
cyber-attacks, they have decided to implement an air-gapped Kubernetes environment to manage
their critical applications, ensuring that no information could leak to the outside. The Kubernetes
environment has three clusters deployed for their applications with centralized management. What
type of licensing is required to enable this environment?

Accepted Answer

B

Explanation: The scenario requires a solution that supports both the centralized management of multiple Kubernetes clusters and deployment in an air-gapped environment. According to the Nutanix Kubernetes Platform (NKP) licensing model, the NKP Ultimate tier is specifically designed for these advanced requirements. It includes all the features of the Pro tier, such as multi-cluster management, and adds critical capabilities for operating in disconnected, high-security environments, which is essential for a national defense company.

Question 11

[Manage Building an NKP Cluster]
A Cloud Engineer is deploying an NKP management cluster and plans to deploy multiple NKP
workload clusters from it. The management cluster will be on Nutanix infrastructure, but the NKP
workload clusters may be deployed in multiple provisioning environments, such as:
Nutanix
AWS
AzureWhen the engineer deploys an NKP workload cluster in AWS, which two default behaviors will
be performed by NKP on this newly-deployed cluster? (Choose two.)

Accepted Answer

A, D

Explanation: When a new workload cluster is associated with a Nutanix Kubernetes Platform (NKP) workspace, it inherits the configurations defined at the workspace level by default. This ensures consistency across all clusters managed within that logical boundary. Specifically, NKP automatically deploys any applications that have been "enabled" for the workspace onto the new cluster. Additionally, the cluster's GitOps agent is configured to sync with all Git repositories that have been added as sources to the workspace, facilitating continuous delivery of applications and configurations.

Question 12

[Prepare the Environment for an NKP Deployment]
A Platform Engineer is deploying a new NKP cluster that has internet connectivity. Now, a Cloud
Administrator and Security Administrator are discussing the security of communications between the
NKP Kubernetes cluster and the container registry. The engineer proposes to have an on-prem
private registry.
What is the most significant reason that the engineer should create a private registry instead of
configuring a secure connection between the NKP cluster and Github (SaaS)?

Accepted Answer

B, C

Explanation: Deploying Nutanix Kubernetes Platform (NKP) in a dark site, or air-gapped environment, means there is no external internet connectivity. Therefore, all software components must be made available locally. The Air-Gapped Bundle (B) is a downloadable package provided by Nutanix that contains all the necessary container images and binaries for the NKP deployment. Once obtained, these container images must be hosted in a location accessible to the new Kubernetes cluster. An existing local container registry (C) is required to store these images. During deployment, the NKP cluster is configured to pull images from this local registry instead of public ones on the internet.

Question 13

[Manage Building an NKP Cluster]
A Platform Engineer needs to create an NKP cluster on vSphere infrastructure, using the vSphere
provisioning method. The cluster needs to have 3 worker node pools:
First node pool should consist of 6 worker nodes
Second node pool should consist of 3 worker nodes
Third node pool should consist of 3 worker nodesAdditionally, the worker nodes in the first node pool
should be set to 10 CPUs, the second node pool workers should be set to 8 CPUs, and the third node
pool workers should be set to 6 CPUs. What is the proper way to create the NKP cluster using the
NKP CLI?

Accepted Answer

A

Explanation: The correct procedure for creating a Nutanix Kubernetes Platform (NKP) cluster with multiple, distinct worker node pools via the CLI is a multi-step process. First, the nkp create cluster command is executed. This command provisions the Kubernetes control plane and the initial, default worker node pool, as specified by the --worker-replicas and --worker-cpus parameters. Subsequently, each additional worker node pool must be created individually by executing the nkp create nodepool command for each new pool, again specifying its unique configuration with the appropriate parameters. This sequential approach is the standard, documented method for building complex cluster topologies.

Question 14

[Prepare the Environment for an NKP Deployment]
A Platform Engineer is deploying a new NKP cluster that has internet connectivity. Now, a Cloud
Administrator and Security Administrator are discussing the security of communications between the
NKP Kubernetes cluster and the container registry. The engineer proposes to have an on-prem
private registry.
What is the most significant reason that the engineer should create a private registry instead of
configuring a secure connection between the NKP cluster and Github (SaaS)?

Accepted Answer

D

Explanation: The most significant reason for using an on-premise private registry is to enhance security and privacy. A private registry keeps proprietary container images, which may contain sensitive application code and configurations, within the organization's security perimeter. This prevents exposure to the public internet, reduces the attack surface from external threats, and provides granular control over image access and distribution. While a secure connection to a public registry encrypts data in transit, the images themselves are still stored on a third-party, multi-tenant platform, which may not meet an organization's stringent security, compliance, or data sovereignty requirements.

Question 15

[Conduct NKP Fleet Management]
A Platform Engineer is deploying a new Kubernetes application in Amazon Web Services (AWS)
Elastic Container Service for Kubernetes (EKS) and Azure Kubernetes Service (AKS). The engineer’s
team has decided to use a custom image instead of the default images provided by AWS or Azure for
their clusters. What functionality will the engineer lose in both AWS EKS and Azure AKS by choosing
to use a custom image?

Accepted Answer

C

Explanation: When using a custom image for worker nodes in managed Kubernetes services like AWS EKS or Azure AKS, you forgo the provider's optimizations. The default, provider-supplied images are pre-configured with essential components, including bootstrap scripts that enable nodes to automatically discover and join the cluster's control plane. This bootstrap process is critical for built-in autoscaling to function correctly; without it, newly scaled nodes will fail to register. Furthermore, these default images are hardened, patched, and maintained by the cloud provider, so using a custom image transfers the full responsibility for security configuration and ongoing maintenance to the user, thereby losing the built-in security capabilities.

Free Nutanix NCP-CN Actual Exam Questions