NCP-MCA Questions and Answers

When troubleshooting or optimizing blueprints where complex operations (like Provisioning combined with detailed Network Configuration) frequently fail, the recommended best practice is to split the steps into smaller tasks.

In Nutanix Self-Service (Calm), theAudittab provides a sequential log of every task executed during an application's lifecycle. If provisioning and network configuration are bundled into a "single step" (e.g., a large script or a single package install), a failure makes it difficult to determine if the issue was with the VM creation, the OS boot, or the specific network parameter application.

By splitting the logic into distinct tasks (e.g., Task 1: Provision VM, Task 2: Configure Network), the administrator can:

Isolate the failure:The Audit log will clearly show "Provision VM: Success" and "Configure Network: Failed".

Validate inputs:It ensures the VM is fully available before attempting configuration.

Improve Auditing:Granular logs allow for faster root cause analysis of the "misconfigured parameters."

Retrying (Option B) or adding delays (Option D) are reactive measures that do not address the root cause of configuration errors, and disabling logging (Option C) hinders troubleshooting.

In Nutanix Self-Service (Calm), to protect sensitive data (such as passwords, keys, or personal tokens) from being displayed in plain text in the UI and Audit Logs, the developer must configure them asSecret Variables.

Secret Configuration:When defining a variable in a Blueprint or Runbook, there is a specific checkbox option to mark the variable as "Secret" (often indicated by a lock icon).

Behavior:Once a variable is marked as Secret, the Self-Service engine automaticallymasksthe value (replacing it with asterisks *****) in all Audit Log outputs, task details, and the user interface. It is passed securely to the script execution environment but is never echoed back to the console logs in readable form.

Macros like jsonEncode (Option D) affect formatting, not security masking.

When configuring a Playbook in Intelligent Operations (X-Play), the "User Execution" settings allow the administrator to define a specific user context (impersonation) under which the playbook actions run.

However, for alocal user accountcreated in Prism Central to be available and valid for this impersonation, that usermust have logged into the Prism Central interface at least once. This login event creates the necessary user profile and mapping within the Prism Central database that X-Play requires to authenticate and execute actions on their behalf. If the user has been created but never logged in, they cannot be successfully used for playbook execution.

Comprehensive and Detailed Explanation

Blueprint tasks in Calm run at specificlifecycle stages:

Pre-create→ Tasks executedbeforeVM creation

Post-create→ Tasks executedafterVM creation butbefore power-on

Pre-delete→ Tasks executed before VM deletion

Post-delete→ Tasks executed after removal

Nutanix documentation states:

Actions that must occurbetween VM provisioning and first power-onshould be added to thePre-createorPost-createstage depending on their dependency.

AD OU assignment requires the VM to exist in inventory butbefore power-on, which aligns with:

✔Pre-create– This is used to configure environment-specific metadata, directory placement, and provisioning adjustmentsprior to initial VM startup.

Correct answer:B

In Nutanix Self-Service,Projectsare the foundational organizational construct. Documentation states that Projects allow administrators to:

Groupusers and user groups

Assignroles(Consumer, Developer, Project Admin, etc.)

Defineresources(clusters, networks, images) allocated to that project

Attachblueprints, application profiles, and environments

Thus,Projects manage user grouping and role-based access, which matchesOption A.

Options B, C, and D do not represent Project functionality within Self-Service.

In Nutanix Cloud Manager (NCM) Intelligent Operations (formerly Prism Pro/X-Play), the primary method for troubleshooting and validating Playbook behavior is through the Plays view in Prism Central.

When a Playbook is reported as not executing as expected, the administrator must examine thePlaystab (Execution History). This view provides a detailed log of all playbook activity, including:

Status:Whether the playbook succeeded, failed, or is in progress.

Trigger Details:Information regarding what specific event or alert triggered the playbook. If the playbook is not running at all, the administrator needs to verify if the "Idle VM" trigger conditions (e.g., CPU usage threshold, duration) are actually being met by the VMs in question.

Step-by-Step Execution:If the playbook triggered but failed during execution, the history details exactly which step failed and provides error messages (e.g., permission issues or API failures).

Options such as rebooting Prism Central or increasing quotas do not address the need to diagnose why specific automation logic failed to fire or complete. Modifying the execution context is a potential fix onlyafterthe execution history reveals a permission error, but checking the history is the mandatory first step to validate the configuration.

Comprehensive and Detailed Explanation

When configuring aSelf-Service Account for AWS, Prism Central must be able to:

Resolve AWS service endpoint URLs

Validate API calls via name-based resolution

Nutanix documentation specifies thatDNS is requiredfor all cloud-provider integrations, including AWS, Azure, and GCP.

Therefore,DNSis the required network element.

Correct answer:B

Comprehensive and Detailed Explanation

Nutanix Playbooks can start based on anAlert Trigger, which is defined as:

A specificPrism Central alertthat, when generated, automatically starts the Playbook.

Alert Triggers map directly to an alert definition that Calm will monitor.

Thus, the Alert Trigger doesnotgenerate alerts or notify admins by itself—itwaits for a selected alertand launches the Playbook when that alert fires.

Correct answer:D

In Nutanix Self-Service (Calm), a Quota Policy limits the total infrastructure resources that can be consumed by a Project.5

When configuring a Project, the administrator sets limits for the following specific resources:

vCPUs:The total number of virtual CPUs allocated to VMs in the project.

Memory:The total amount of RAM (in GiB) allocated to VMs.

Disk:The total storage capacity (in GiB) allocated to VMs.

These quotas are enforced during the provisioning process. If a user attempts to launch a blueprint that would cause the project to exceed these defined limits (vCPU, Memory, or Disk), the deployment will fail. Quotas do not monitor IOPs, NIC counts, or the number of blueprints stored.

Playbooks are a feature of Intelligent Operations (formerly Prism Pro or X-Play), not Nutanix Self-Service (formerly Calm). Therefore, the first step is always to access the Intelligent Operations console in Prism Central.

The logical flow for defining an automation routine in a Playbook isTrigger first, then Action.

Select Trigger:The administrator must first definewhenthe playbook runs (e.g., on an Alert, an Event, or Manually).

Add Actions:Once the trigger is established, the administrator defineswhathappens (e.g., Power off VM, Send Email, Slack Notification).

The correct order found in the Nutanix Intelligent Operations Guide is: Access Intelligent Operations > Create Playbook > Select Trigger > Add Actions > Save.

When creating a Runbook that involves power cycling a VM (Restart), there is a gap in connectivity while the Guest OS reboots and network services initialize.

If the Runbook moves immediately from the "VM Restart" task to the "Add new credential" task (which likely uses SSH or PowerShell to connect to the VM), the connection will fail because the VM is not yet accessible.

To correct this, the administrator must insert a Delay task between the restart and the configuration step.

The sequence should be:

VM Restart:Initiates the reboot.

Delay:Pauses the runbook execution for a set duration (e.g., 60-120 seconds) to allow the OS to boot.

Add new credential:Executes the script once the VM is back online.

In Nutanix Self-Service Runbooks, tasks that execute scripts (such as Shell for Linux or PowerShell for Windows) require a target destination. This target is defined as an Endpoint.

AnEndpointconfigures the connection details (IP address, port, connection protocol, and credentials) required to communicate with the remote machine where the script will run. Without selecting a valid Endpoint, the Runbook engine does not know where to send the script for execution.

The "Environment" construct in Nutanix Self-Service is designed specifically to abstract infrastructure details from the end user while ensuring correct placement.

Within a single Project, an administrator can define multipleEnvironments(e.g., "Development" and "Production").

TheDevelopment Environmentis configured to map to theDevelopment Clusterand its associated networks.

TheProduction Environmentis configured to map to theProduction Clusterand its associated networks.

When a blueprint is launched, the user (or the application profile) simply selects the target Environment. The Self-Service engine then automatically directs the provisioning to the specific cluster defined in that Environment's settings, ensuring correct placement without requiring the user to know cluster details or manual intervention.

In Nutanix Self-Service (Calm), Macros are used to reference variables and properties dynamically using the syntax @@{Entity.Attribute}@@.

Servicesare a primary supported entity for macros. You can reference properties of other services within the same application blueprint. For example, a web server service might need the IP address of a database service. This can be achieved using a macro like @@{Database_Service.address}@@. This allows for dynamic orchestration where values are populated at runtime based on the actual deployment details of the Service entity.

Comprehensive and Detailed Explanation

Nutanix Calm naming macros:

@@{calm_random}@@→ Generates a random short string,not guaranteed uniqueacross deployments.

@@{calm_unique}@@→ Generates a unique, monotonically increasing integerguaranteed not to repeat.

Static values (e.g., WNSRV0001) will always collide.

Calm documentation specifies:

calm_uniqueshould be used when a deterministic, guaranteed unique VM name is required across multiple deployments.

Therefore, the correct VM naming pattern is:

✔WNSRV@@{calm_unique}@@

According to the Self-Service Blueprint and Task configuration settings, the specific parameter that enables and controls the number of retries for a failed task is theRetry Count.

Retry Count:This integer value determines how many times the system will attempt to re-execute the task if it returns a failure status. If this is set to 0 (default in some views), no retries occur. Setting it to a value of 1 or higher enables the retry logic.

Retry Interval (Option A):This setting defines thewait time(in seconds) between the attempts, but without a positiveRetry Count, the interval is irrelevant.

Timeout (Option B):This defines how long the system waits for a single attempt to complete before marking it as failed.

When configuringHTTP Endpointswithin Nutanix Self-Service (to be used by tasks for making API calls), the system provides security controls to ensure trust.

Verify TLS Certificate:This specific checkbox setting in the Endpoint configuration determines whether the Self-Service engine validates the SSL/TLS certificate of the target server.

Security:Checking this box ensures that the connection is secure and that the target identity is verified (preventing Man-in-the-Middle attacks). Unchecking it allows connections to servers with self-signed or invalid certificates (often used in dev/test), but forsecure access, verifying the certificate is the required configuration.

Options A (SSH) and C (Static IP) are unrelated to the security of an outbound HTTP API call. Option B (Proxy) relates to routing, not the security handshake itself.

According to the Nutanix Prism Central Admin Guide, a category is a grouping of entities into key-value pairs. Categories are used to group entities (such as VMs, hosts, or subnets) based on specific criteria (e.g., Department: Marketing or Environment: Production).

Once entities are assigned to a category, administrators can link policies (such as security, protection, or automation playbooks) to the category rather than to individual entities. This allows for scalable and dynamic management, as any new entity tagged with that category will automatically inherit the associated policies.

In the Nutanix Self-Service (Calm) Blueprint lifecycle, tasks are executed in a specific order relative to the provisioning of the infrastructure (Substrate).

Pre-Create Task:This is the specific phase designed to run scripts or set variablesbeforethe VM provision call is sent to the provider (AHV).

Workflow:

The developer creates a pre-create task (e.g., a Python script) to generate the custom hostname string based on logic (e.g., date, user input, or sequence).

The script outputs this string to a variable (e.g., @@{vm_hostname}@@).

The VM Service configuration (Substrate) references this variable in the "VM Name" or "Hostname" field.

Execution:When the blueprint launches, the pre-create task runs first, populates the variable, and then the VM creation occurs using that calculated name.

Tasks in post-create or package-install (Options B and C) runafterthe VM has already been provisioned and named, making them too late for this requirement.

The placement of applications in Nutanix Self-Service is dictated by the intersection of theProjectconfiguration and theBlueprintdefinition.

Project Construct:The Project defines which infrastructure accounts (Providers) are available for use (e.g., AHV, AWS, Azure). If the Project is configured to allow access tobothAWS and another provider (like on-prem AHV or Azure), the potential exists for deployment to those targets.

Blueprints:The Blueprint (or the specific Environment selected at launch) dictates where the workload actually goes. If the administrator intended "Only AWS," but the Project allows multiple providers and the Blueprints (or the users launching them) are configured to use a non-AWS environment, the application will be deployed there.

Therefore, the cause is that theProject construct(allowing multiple clouds) and theBlueprints(utilizing those available clouds) are configured to allow this distribution. To restrict it, the administrator should remove the unintended providers from the Project's "Infrastructure" or "Environment" settings.

Self-Service Domain-Specific Language (DSL)is the specific capability within Nutanix Self-Service (formerly Calm) that enablesInfrastructure-as-Code (IaC).

Definition:The Self-Service DSL is a Python-based domain-specific language that allows administrators and developers to define Blueprints, Runbooks, and Projects as code.

Functionality:Instead of using the Graphical User Interface (GUI), users can write Python code to describe the application structure, services, and logic. This code can then be version-controlled (e.g., in Git), reviewed, and deployed via the CLI, fulfilling the principles of Infrastructure-as-Code.

Contrast:While "Application Development" and "Orchestration" are broad concepts, theDSLis the specific tool/feature that delivers the IaC mechanism.

In the Nutanix Cloud Platform,Categoriesare the fundamental metadata structure used to group and tag resources (such as VMs, Hosts, and Blueprints) for management purposes.

Functionality:Categories are key-value pairs (e.g., CostCenter:Marketing or Environment:Production) that provide a logical abstraction layer above the physical infrastructure.

Usage:

Cost Allocation:Nutanix Cost Governance (formerly Beam) uses categories to map resource consumption to specific business units or budgets.

Reporting:Prism Central uses categories to filter and group entities in reports.

Compliance/Security:Flow Network Security policies rely on categories to define traffic rules (e.g., "Allow traffic from App:Web to App:DB").

Protection:Disaster Recovery policies assign replication schedules based on categories.

Differentiation:"Labels" is a term often used in Kubernetes or public cloud (AWS/Azure tags), but "Categories" is the specific terminology and feature implementation within Nutanix Prism Central.

Comprehensive and Detailed Explanation

Nutanix Calm documentation states:

TheBlueprint Editoris the graphical interface used to design, visualize, and modify a blueprint’s components, such as services, packages, substrates, dependencies, and tasks.

The editor provides avisual topologyof the multi-tier application.

Thus, the correct answer isC. Blueprint Editor.

Nutanix Self-Service governance supportsApproval Policiesthat enforce control over resource consumption and automation actions. Nutanix documentation states that approval policies:

Apply toblueprint deployments,runbook executions,day-2 actions, orresource scale-up requests.

Requireexplicit authorizationfrom a designated approver before the action proceeds.

Provide governance to ensure resource usage aligns with organizational policies.

Thus, Approval Policies existspecifically to require authorization before a user-triggered task is executed, makingOption C correct.

Options A, B, and D are unrelated to approval workflows.

Comprehensive and Detailed Explanation

Nutanix Calm supports OS customization throughGuest Customization, which:

AppliesSysprepfor Windows

Injects configuration files

Sets hostnames, time zones, networking, and more

Runs scripts post-deployment

Sysprep is specifically executed duringWindows Guest Customization.

Therefore,Option C: Guest Customizationis correct.