NCP-CN Nutanix Exam Lab Questions

The Nutanix Kubernetes Platform (NKP) uses the Kubernetes Image Builder (KIB) or Nutanix Image Builder (NIB) to create custom machine images for NKP management and worker nodes. These images are tailored to include specific versions of Kubernetes, container runtimes (e.g., containerd), and other dependencies. The NKPA course specifies that KIB relies on Ansible playbooks to configure the image, and the versions of packages like Kubernetes and containerd are defined in Ansible configuration files.

The correct location to verify the package versions isansible/group_vars/all/defaults.yaml. This file contains the default variables used by Ansible during the image-building process, including the versions of Kubernetes and containerd. For example, it may include entries like kubernetes_version: 1.30.5 and containerd_version: 1.7.22. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To ensure the correct versions of Kubernetes and containerd are used in KIB, check the ansible/group_vars/all/defaults.yaml file, which specifies the package versions for the image build.” The engineer can review and modify this file to confirm that the security team’s authorized versions (Kubernetes 1.30.5 and containerd 1.7.22) are being used.

Incorrect Options:

A. config/pulumi/vars/pulumi.kib.config: Pulumi is an infrastructure-as-code tool, but it is not used by KIB for specifying package versions. The NKPA course does not reference this file.

B. terraform/vars/default/terraform.tfvars: Terraform is used for infrastructure provisioning, not for defining software versions in KIB images.

D. The custom image's .env file: KIB does not use a .env file for version configuration; Ansible variables are used instead.

When attaching an Amazon EKS cluster to NKP for fleet management, persistent volume (PV) errors during application deployments often indicate issues with storage configuration. The NKPA course identifies a common cause:the absence of a default StorageClass. Kubernetes requires a default StorageClass to automatically provision PVs for PersistentVolumeClaims (PVCs) when none is specified. Without a default, applications fail to bind PVCs, resulting in deployment errors.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For attached EKS clusters, ensure a default StorageClass is configured to support dynamic provisioning of persistent volumes. Review existing StorageClasses and set one as default using the storageclass.kubernetes.io/is-default-class annotation.” The engineer should run kubectl get storageclass to list available StorageClasses, verify their configurations, and set one as default by patching it with kubectl patch storageclass -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"true"}}}'. In EKS, the default StorageClass is typically backed by Amazon EBS (e.g., gp2 or gp3).

Incorrect Options:

A. The storage appliance is having issues: This assumes a hardware issue, which is not indicated by PV errors. The NKPA course suggests checking Kubernetes configurations first.

B. There is no compatible storage: EKS supports EBS and EFS, which are compatible with NKP. The issue is likely configuration, not compatibility.

D. There could be a misconfiguration in the ConfigMap: ConfigMaps are not directly related to PV provisioning. The NKPA course points to StorageClass issues for PV errors.

The NKPA course emphasizes that NKP supports multi-tenancy through workspaces, each of which can be configured with its own Identity Provider (IdP) for authentication. In this scenario, each group (Fin VD, Fin Insurance, Fin Travel) has its own IdP, and the engineer has created separate workspaces for them. To assign the Tenant Administrators role, the engineer must configure a dedicated IdP for each group’s workspace, enabling users to authenticate via their group-specific IdP and assume the Tenant Administrator role.

The course details that NKP uses Dex as the OIDC provider to integrate with external IdPs. For each workspace, the engineer configures a Dex connector to the group’s IdP, maps the IdP groups to NKP roles (e.g., Tenant Administrator), and assigns permissions via role bindings. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To assign Tenant Administrator roles in NKP, configure a dedicated IdP for each workspace using Dex connectors, mapping IdP groups to the appropriate roles for workspace management.” This ensures that each group’s administrators can access only their designated workspace.

Incorrect Options:

B. Create a role named admin-tenant-X: NKP uses predefined roles like Tenant Administrator, not custom roles with specific naming conventions.

C. Create a role binding and assign it: Role bindings are part of the process, but the primary step is configuring the IdP for authentication, as per the NKPA course.

D. Configure the global Active Directory: The scenario specifies separate IdPs per group, not a global Active Directory for all groups.

According to theNKPA 6.10 documentation, theFIPS Compliant Build featureis exclusively available forEnterprise tierlicensing. This ensures compliance with NIST security standards and provides hardened cryptographic capabilities throughout the Kubernetes cluster stack.

Exact extract from documentation:

“The FIPS-compliant build feature is included in the NKP Enterprise tier, enabling deployments in environments that require strict security compliance.”