Free NCP-NS Practice Test Questions and Answers (2026)

To troubleshoot a connectivity issue when a Nutanix Flow Network Security policy is in place, the most direct method is to verify the policy's status and configuration. The administrator must confirm that the specific rule allowing the required traffic (e.g., TCP port 3306 from the Web/App tier to the Database tier) is correctly defined and that the policy has been successfully applied. Crucially, the policy must be in "Enforce" mode. If the policy is in "Monitor" mode, it will only log potential traffic violations without actually blocking any traffic, which would not be the root cause of a connectivity failure. Therefore, checking the rule and the enforcement status is the primary step.

A. This is too general. While VM-level settings are important, the context implies a network virtualization security issue, making the Flow Network Security policy the most probable cause.

B. An isolation policy could cause this, but checking the specific application policy that is intended to allow the traffic is the more logical and immediate troubleshooting step.

D. External gateways and Source NAT (SNAT) are used for traffic entering or leaving the virtual private cloud (VPC), not for communication between VMs within the same internal network.

1. Nutanix Flow Network Security Guide v4.0 - Security Policy Actions and States:

Section: Monitoring a Security Policy: "When you enforce a security policy, the rules in the policy are applied to the traffic. The policy rules can allow, block, or redirect the traffic... When you monitor a security policy, you can visualize the traffic flows for an application without actually blocking any traffic." This directly supports checking the policy mode as a critical step.

Section: Applying a Security Policy: "After you create and save a security policy, you must apply the policy for the policy rules to take effect." This confirms the need to check if the policy is active and applied.

2. Nutanix University - Nutanix Certified Professional - Network Security (NCP-NS) 6.5 Study Guide:

Chapter 3: Securing Traffic with Flow Network Security: This chapter details the process of creating and applying security policies. It emphasizes the distinction between Monitor mode (for observation) and Enforce mode (for active blocking/allowing), which is a core concept tested for troubleshooting scenarios. A policy in Monitor mode cannot be the root cause of blocked traffic.

Placing a Nutanix Flow Network Security policy in Monitor mode allows administrators to observe and analyze network traffic without enforcing any rules. In this state, traffic that would otherwise be blocked by the policy's rules is allowed to pass, but the system logs these flows. This functionality is crucial for validating a policy's impact on application communication, ensuring that legitimate traffic is not inadvertently blocked before moving the policy to the "Enforce" state. It provides a non-disruptive way to test and refine security rules.

B. It blocks all traffic that is not defined in the policy. This describes the behavior of an isolation policy in "Enforce" mode, which actively blocks traffic, contrary to the purpose of Monitor mode.

C. It allows traffic that is defined in the policy and blocks all other traffic. This describes a standard firewall policy in "Enforce" mode. Monitor mode does not block any traffic; it only logs it.

D. It disables the policy and stops all logging. This describes a "Disabled" state. Monitor mode is an active state that specifically enables logging and visualization for policy validation.

1. Nutanix Flow Network Security Guide v6.8: In the "Security Policy States" section, it states: "Monitor: The policy rules are not enforced, but the traffic flow that matches the policy rules is logged and can be visualized." This confirms that traffic is allowed but logged for observation.

2. Nutanix University - Nutanix Hybrid Cloud Fundamentals Course: In the module covering Flow Network Security, it explains that Monitor mode is the initial, recommended state for a new policy. This allows an administrator to "monitor the traffic to ensure the policy is correct before enforcing it," highlighting its role in allowing and logging traffic for validation purposes.

3. Nutanix Bible - Flow Network Security Section: This resource describes the policy lifecycle, stating, "When a policy is in monitor mode, traffic is not blocked, but allowed flows are logged and can be visualized." This directly supports the function of allowing and logging traffic without enforcement.

The most effective first step is to check the Health dashboard in Prism. This dashboard provides a centralized, at-a-glance overview of the entire cluster's status, aggregating data from all nodes, services, and components. It runs a comprehensive set of checks continuously and will immediately display any critical alerts, warnings, or failures related to hardware, software, or configuration. This allows the administrator to quickly correlate the user-reported symptoms with any underlying infrastructure issues, making it the most efficient starting point for diagnosis.

B. Check the physical network switches: This action is too specific for a first step. The Prism Health dashboard would likely indicate a network-related problem first, guiding the administrator to investigate the physical switches if necessary.

C. Analyze the performance of individual VMs: Since multiple users are affected, the issue is likely at the infrastructure level, not with a single VM. Starting with individual VMs is inefficient and may miss the broader root cause.

D. Run a full Nutanix Cluster Check (NCC) health check: While NCC is a powerful diagnostic tool, the Prism Health dashboard already displays the results of many ongoing NCC checks. A manual NCC run is a deeper, more time-consuming diagnostic step, typically performed after an initial assessment in Prism.

1. Nutanix Prism Web Console Guide (Version pc.2023.4): In the "Health Monitoring" section, the "Health Dashboard" is described as the primary interface for viewing the overall health of the cluster. It states, "The Health dashboard enables you to see a summary of the health of your cluster... It runs a series of checks on the cluster and displays the status." This establishes it as the intended first point of inspection.

2. Nutanix University - Nutanix Hybrid Cloud Fundamentals Course (NHCF 6.5): Module 6, "Cluster Monitoring," introduces the Prism dashboard as the main tool for day-to-day monitoring. The course emphasizes using the Health dashboard to get a quick summary of cluster status and to identify any alerts that require attention, reinforcing its role as the initial diagnostic step.

3. Nutanix Cluster Check (NCC) Guide (Version 4.6.5): The guide introduces NCC as a framework of scripts used to diagnose cluster health. While it can be run from Prism, its primary function is for on-demand, in-depth diagnostics, which is typically a secondary step after observing an issue on the main Health dashboard. The "Running NCC" section details the manual process, distinguishing it from the continuous monitoring presented in the Prism dashboard.

The VM (10.10.10.100) cannot reach the on-premises server (172.16.2.50) because the VPC's routing table lacks a specific path to the on-premises network (172.16.2.0/24). The existing default route (0.0.0.0/0) correctly sends internet-bound traffic through the NAT network ("ExtNetExt"), but this route does not apply to the private on-premises IP address. To enable communication, a static route must be created. This route must specify the destination network prefix (172.16.2.0/24) and direct the traffic to the next hop via the routed external network ("ExtNetInternal"), which provides the physical or logical connection to the on-premises environment.

A route for 0.0.0.0/0: This is a default route. A default route already exists for internet access via the NAT network. Modifying it or adding another would be incorrect for reaching a specific private network.

A route for 172.16.1.0/24: This network ("ExtNetInternal") is directly connected to the VPC. The VPC router is already aware of this network, so a static route is unnecessary.

A route via "ExtNetExt": This network is configured for NAT and is used for internet access. Routing internal, on-premises traffic through the NAT gateway is incorrect and would not reach the destination.

1. Nutanix Flow Virtual Networking Guide v4.0 | VPC Management | VPC Static Routes (Page 53): The documentation states, "You can add static routes to a VPC to direct traffic from the subnets within the VPC to a destination outside the VPC. For example, you can add a static route to direct traffic to your on-prem network." This directly validates the need for a static route to the on-premises network.

2. Nutanix Flow Virtual Networking Guide v4.0 | VPC Management | Add a Static Route to a VPC (Page 53): This section details the required parameters for creating a static route: "Destination IP Prefix" and "Next Hop". The next hop is configured by selecting the appropriate "External Network" (in this case, "ExtNetInternal") and specifying the gateway IP on that network. This confirms the components of the correct answer.

Nutanix Flow Network Security service insertion redirects traffic using Geneve encapsulation, which adds 58 bytes of overhead to the original packet. When a user VM with a standard 1500-byte MTU sends a maximum-sized packet, the encapsulated packet becomes 1558 bytes (1500 + 58).

If this traffic must cross a physical network path with a default MTU of 1500, the oversized packets will be dropped. This often results in symptoms where small packets (like pings) succeed, but larger data transfers (like loading complex websites) fail.

To resolve this, you can either:

1. Increase the MTU on the entire network path to accommodate the larger, encapsulated packets (>=1558).

2. Decrease the MTU on the source user VM to ensure the encapsulated packet does not exceed the network's 1500-byte limit (1442 + 58 = 1500).

B. Lowering the MTU on the network path would worsen the issue, as it would restrict packet sizes even further and potentially drop standard, non-encapsulated traffic.

D. Increasing the MTU on the user VM's vNIC would create even larger packets, which would still be dropped by the 1500 MTU network path after encapsulation.

1. Nutanix Flow Network Security Guide v4.0: In the "MTU Considerations for Service Chains" section, the documentation states: "Flow Network Security uses GENEVE encapsulation for traffic redirection. GENEVE encapsulation adds 58 bytes of overhead to the original packet... To avoid packet fragmentation, you can either increase the MTU of the physical network devices to at least 1558 bytes or decrease the MTU of the guest VMs to 1442 bytes." (Section: Planning for Flow Network Security > MTU Considerations for Service Chains).

2. Nutanix University - Nutanix Hybrid Cloud Fundamentals Course: The networking module explains that technologies like Geneve, used by Flow, add encapsulation headers. It emphasizes the need to configure jumbo frames (an MTU greater than 1500) on the physical network to support this overhead without performance degradation or connectivity issues. (Module: Nutanix Networking Concepts).

When Nutanix Flow Microsegmentation is enabled, the system automatically creates a special category named PrismCentral. The Prism Central VM (or VMs, in a scale-out deployment) is then automatically assigned to this category. This action is a protective measure to ensure that the Prism Central instance, which manages the security policies, does not become isolated or inaccessible due to user-created security policies. A default, non-editable "Prism Central Protection" policy is applied to this category to allow necessary management traffic.

B. A security policy named "PrismCentralPolicy": While a security policy is created to protect Prism Central, its creation is dependent on the PrismCentral category. The category is the foundational entity for identification. Also, the default policy is typically named "Prism Central Protection," not "PrismCentralPolicy".

C. A virtual private network (VPN) connection: Microsegmentation provides stateful firewalling for east-west traffic within the cluster. It does not involve the creation of VPN connections, which are used for secure remote access or site-to-site connectivity.

D. A dedicated storage container: Storage containers are logical constructs for organizing VM disks and files. Enabling a network security feature like Microsegmentation does not require or trigger the creation of a new storage container.

1. Nutanix Flow Microsegmentation Guide (pc-2022.9): In the "Enabling Microsegmentation" section, the documentation states, "When you enable microsegmentation, Prism Central is automatically protected by a security policy. To apply this policy, a category called PrismCentral is created and the Prism Central VMs are added to it." (Reference: Section: "Enabling Microsegmentation")

2. Nutanix University - Nutanix Security and Governance Operations (NSGO) Courseware: The module on Flow Microsegmentation implementation details the initial setup process. It explicitly covers the automatic creation of the PrismCentral category and the associated default security policy as the first step after enabling the feature to safeguard the management plane. (Reference: Module: "Implementing Flow Microsegmentation")

3. Nutanix Security Guide (v6.5): Under the "Flow Microsegmentation" chapter, the section on "Securing Prism Central" explains this automatic protection mechanism. It details that "Prism Central automatically creates a PrismCentral category and adds the Prism Central VM to that category" to ensure its connectivity is maintained. (Reference: Chapter: "Flow Microsegmentation", Section: "Securing Prism Central")

An Application Security Policy in Nutanix Flow Network Security is designed to protect a logical application, which consists of a group of virtual machines.

The policy is applied to a primary secured entity, which is a group of VMs identified by a Category. This category (e.g., AppType:MyWebApp) defines the boundary of the application being secured.

Within the policy, the application is further segmented into logical tiers (e.g., Web, App, DB). These are configured as Application Tiers, which are also defined by categories. The policy rules govern traffic between these tiers, making each tier a secured entity within the overall policy.

Subnet: A subnet or IP address group can be specified as a source or destination for traffic but is not the primary application entity being secured by the policy itself.

VM Name: Policies are applied to scalable, logical groups defined by categories, not to individual VMs identified by their names, to ensure manageability and dynamic policy application.

1. Nutanix Flow Network Security Guide (pc.2023.3), Section: Application Security Policy:

"An application security policy secures a group of VMs that are identified by using categories. The policy allows you to define application tiers, also by using categories, and then define traffic rules between these tiers." This statement directly supports that both the overall application (identified by a Category) and the Application Tiers within it are the secured entities.

2. Nutanix Flow Network Security Guide (pc.2023.3), Section: Creating an Application Security Policy:

Step 5: "In the Applies To field, select a category to identify the VMs that form the application you want to secure." This confirms that the top-level secured entity is a Category.

Step 7 & 8: "To define the tiers of the application, in the App Tiers section, click Add Tier... In the Tier field, select a category to identify the VMs that form this tier of the application." This confirms that an Application Tier is a distinct, configurable entity within the policy that represents a secured group of VMs.

In a "No NAT" VPC configuration, the IP addresses of the virtual machines are not translated when they communicate with the external network. This means the external network must have explicit routes to send return traffic back to the VPC subnets. Without these routes, the external firewall or router does not know how to reach the VMs inside the Nutanix VPC. The administrator must add static routes on the physical network device, pointing the VPC subnet prefixes to the Nutanix cluster's external connectivity IP address as the next hop.

(Assuming plausible but incorrect options)

Configure a NAT Gateway on the VPC: This would change the VPC's fundamental behavior from routed to NAT, which contradicts the administrator's initial design choice of "No NAT mode."

Enable IPAM on the VPC subnets: IPAM (IP Address Management) is responsible for assigning IP addresses to VMs. While necessary, it does not solve the external routing problem.

Create a security policy to allow outbound traffic: While a restrictive policy could block traffic, the described symptom is a classic routing failure inherent to a new No NAT VPC deployment before external routes are configured.

1. Nutanix Flow Networking Guide v4.0: In the section VPC External Connectivity, it states, "For a no-NAT VPC, you must configure static routes on the external router for the subnets in the VPC. The next hop for these static routes is the Nutanix cluster external IP address." (Page 21)

2. Prism Central Infrastructure Guide (pc-2023.4): In the section Creating a VPC, the description for the "No NAT" option implies this requirement by stating it allows direct, non-translated communication, which necessitates external routing configuration for reachability.

3. Nutanix University: Nutanix Hybrid Cloud Fundamentals (NHCF) Courseware: The module on Flow Networking explains that when using a routed (No NAT) model, the physical network must be made aware of the virtual subnets. This is accomplished by adding static or dynamic routes on the upstream physical routers.

Nutanix Flow Network Security policies, including Isolation policies, function by applying rules to groups of VMs identified by categories. A category is a label (key-value pair) assigned to a VM. The Isolation Policy is configured to block traffic between VMs in the "Prod" category and VMs in the "Staging" category. If the individual VMs within these environments have not been explicitly assigned the correct categories (e.g., Environment:Prod, Environment:Staging), the policy has no entities to act upon. Therefore, even though the policy is active and in "Enforce" mode, it fails to block traffic because it cannot identify the intended target VMs.

A. An Application Security Policy is allowing the traffic: While an "Allow" rule in an Application policy can override an Isolation policy, the most common and fundamental reason for policy failure is a misconfiguration of the policy's targets.

B. Microsegmentation is not enabled on the cluster: If Microsegmentation were disabled, no Flow policies would function. While possible, forgetting to categorize specific VMs for a new policy is a more frequent operational error.

D. The policy is in Monitor mode instead of Enforce: This is explicitly contradicted by the question, which states, "The policy is in Enforce mode."

References:

1. Nutanix Flow Network Security Guide v6.8, Chapter: Security Policy Application, Section: How Security Policies are Applied.

"A security policy rule applies to a VM only when the VM is a member of a category that you specify in the rule. If a VM is not in a category specified in a security policy, the policy does not apply to that VM." This directly confirms that without category assignment to the VMs, the policy is ineffective.

2. Nutanix Flow Network Security Guide v6.8, Chapter: Creating an Isolation Policy.

This section details the procedure for creating the policy, which involves selecting the two categories of entities to isolate from each other. This highlights the foundational role of categories in defining the policy's scope. If no VMs belong to these selected categories, the policy has no effect.

3. Nutanix University, Nutanix Hybrid Cloud Fundamentals Course, Module: Securing the Platform with Flow Network Security.

The courseware explains that the logical grouping of VMs for policy enforcement is achieved through categories. It emphasizes that a critical step after policy creation is ensuring all relevant VMs are correctly categorized for the policies to be enforced as intended.

1. Nutanix Prism Central Guide 5.20, “Working with Security Policies”, p. 426–427: “Policies apply only to entities that possess the category values named in the rule.”

2. Nutanix Flow Security Tech Note v3.2, §3.1 Policy Matching Logic: “Category assignment is mandatory; un-tagged VMs are not affected by Isolation policies.”

3. Nutanix KB-1067 “Troubleshooting Flow Isolation Policies”, Step 1: “Verify that the correct categories are attached to the VM; missing tags are the most common cause of non-enforcement.”

4. Nutanix Flow Best-Practices Guide 2022, §4.2: “Always tag VMs before enabling Enforce mode; otherwise rules will not be instantiated.”

To create a Virtual Private Cloud (VPC) in Prism Central, the absolute minimum required configuration items are a unique Name for identification and the selection of one or more AHV Cluster(s) on which the VPC will be hosted. The cluster association is mandatory because it determines the physical infrastructure where the VPC's virtual networking components and associated VMs will reside. All other configurations, such as internal subnets, external connectivity, and DNS servers, can be added after the VPC object has been created, and are not required for the initial step.

Name and External Subnet: An external subnet is only required for connecting the VPC to a physical network. The scenario explicitly states this will be done later.

Name and DNS Servers: Configuring DNS servers is an optional step for a VPC and is not required for its initial creation.

Name and Static Routes: Static routes are used to direct traffic to external networks and are not a minimum requirement for creating the isolated VPC itself.

1. Nutanix Flow Virtual Networking Guide (pc.2023.4), Section: Creating a Virtual Private Cloud (VPC). The guide details the VPC creation wizard, which begins with the mandatory fields "Name" and "Clusters". It states, "Enter a name for the VPC and select the clusters on which you want the VPC to be available." This confirms these are the initial, required steps.

2. Prism Central Admin Center Guide (pc.2023.4), Section: VPC Management. This section describes the procedure for creating a VPC, reinforcing that the first and mandatory step in the "Create VPC" dialog box is to provide a name and select the host clusters.