Free Nutanix Certified Master - Multicloud Infrastructure v6.10 NCM-MCI Exam Questions

Here is the step-by-step solution to modify the security policy file as required.

Navigate to the desktop and open the file Security Policy.txt (which corresponds to the provided Security Policy.bak content) using a text editor like Notepad.

Modify the file content by replacing the xxxxx and xxxx placeholders according to the security requirements.

Modifications by Rule

Here are the specific changes to make within the file:

1. Quarantine Rule

Requirement 1 (No Logging): The quarantine rule should not be logged.

Change 'is_policy_hitlog_enabled': 'xxxxx' to 'is_policy_hitlog_enabled': 'false'

Requirement 2 (Enforce): This rule must be enforced.

Change 'action': 'xxxxx' (under quarantine_rule) to 'action': 'APPLY'

Requirement 3 (Environment): The rule must affect the 'SecOps' environment.

Change 'Environment': ['xxxxx'] to 'Environment': ['SecOps']

2. SMB-block Rule

Requirement 1 (Logging): This rule must be logged.

Change 'is_policy_hitlog_enabled': 'xxxxx' to 'is_policy_hitlog_enabled': 'True'

Requirement 2 (Monitor): This rule must not be enforced, only logged.

Change 'action': 'xxxxx' (under isolation_rule) to 'action': 'MONITOR'

Requirement 4 (Tags): The rule must affect the 'smbhost' and 'smbclient' tags.

Change 'SMBv1': ['xxxxx'] to 'SMBv1': ['smbhost']

Change 'SMRv1': ['xxxxx'] to 'SMRv1': ['smbclient']

3. DN test (dn-policy1) Rule

Requirement 2 (Monitor): This rule must not be enforced, only logged.

Change 'action': 'xxxx' (under app_rule) to 'action': 'MONITOR'

Requirement 5 (Allow IPv6): This policy must allow IPv6 traffic.

Change 'allow_ipv6_traffic': 'xxxx' to 'allow_ipv6_traffic': 'True'

Final Step

After making all the replacements, Save the file, overwriting the original Security Policy.txt on the desktop.

Example of completed rules (replace xxxxx accordingly):

Rule Name: Quarantine Rule

Logged: false

Action: APPLY

Environment: SecOps

Protocols: TCP

Ports: 8080

Rule Name: SMB Rule

Logged: True

Action: MONITOR

Tags: smbhost, smbclient

Protocols: TCP

Ports: 8080

Rule Name: DN Test Policy

Logged: True

Action: MONITOR

Environment: Non-Prod

Protocols: ALL

Ports: 8080

To identify the CVM with the issue, remove the file causing the storage bloat, and check the health again, you can follow these steps:

Log in to Prism Central and click on Entities on the left menu.

Select Virtual Machines from the drop-down menu and find the NCC health check output file from the list. You can use the date and time information to locate the file. The file name should be something like ncc-output-YYYY-MM-DD-HH-MM-SS.log.

Open the file and look for the line that says FAIL: CVM System Partition /home usage at 93% (greater than threshold, 90%). Note down the IP address of the CVM that has this issue. It should be something like X.X.X.X.

Log in to the CVM using SSH or console with the username and password provided.

Run the commanddu -sh /home/*to see the disk usage of each file and directory under /home. Identify the file that is taking up most of the space. It could be a log file, a backup file, or a temporary file. Make sure it is not a system file or a configuration file that is needed by the CVM.

Run the commandrm -f /home/<filename>to remove the file causing the storage bloat. Replace <filename> with the actual name of the file.

Run the commandncc health_checks hardware_checks disk_checks disk_usage_check --cvm_list=X.X.X.Xto check the health again by running the individual disk usage health check only on the problematic CVM. Replace X.X.X.X with the IP address of the CVM that you noted down earlier.

Verify that the output shows PASS: CVM System Partition /home usage at XX% (less than threshold, 90%). This means that the issue has been resolved.

#access to CVM IP by Putty

allssh df -h #look for the path /dev/sdb3 and select the IP of the CVM

ssh CVM_IP

ls

cd software_downloads

ls

cd nos

ls -l -h

rm files_name

df -h

ncc health_checks hardware_checks disk_checks disk_usage_check

Here is the step-by-step solution to create the high-performance SQL VM on Cluster 1.

This task requires two phases: first, creating a new all-flash storage container, and second, creating the VM with a specific vNUMA and disk controller configuration for maximum performance.

1. Access Cluster 1 Prism Element

From the main Prism Central dashboard, navigate to Hardware > Clusters.

Find Cluster 1 in the list and click its name. This will open the specific Prism Element login page for that cluster.

Log in to Cluster 1's Prism Element interface.

2. Create the All-Flash Storage Container

To maximize performance for a 'write-intensive' workload on a hybrid cluster, the data and log disks must be placed on an all-flash container.

In the Cluster 1 PE interface, click the gear icon (Settings) in the top-right corner.

From the left-hand menu, select Storage.

Click the + Storage Container button.

Fill in the basic details:

Name: NEWSQL_Flash_Container

Click Advanced Settings.

Scroll down to the Storage Tier section.

Select the SSD radio button. This pins all data in this container to the SSD tier, ensuring all-flash performance.

Click Save.

3. Create and Configure the VM

Now, create the VM, applying vNUMA and multi-SCSI controller best practices.

From the main PE dashboard, navigate to the VM view.

Click the + Create VM button.

Enter the compute details. This configuration is critical for vNUMA performance, as it tells the VM's guest OS about the underlying physical NUMA topology (2 CPUs with 8 cores each).

Name: NEWSQL_VM

vCPUs: 12

Number of Sockets: 2

Cores per vCPU: 6 (This creates a 2-socket, 6-core VM, totaling 12 vCPUs)

Memory: 128 GB

Scroll down to the Disks section and add the OS disk:

Click + Add New Disk.

Storage Container: Select the default (hybrid) container.

Size: 100 GB

Bus: SCSI

Device Index: 0 (This will be scsi.0)

Click Add.

Add the Data disk (on its own controller for parallel processing):

Click + Add New Disk.

Storage Container: Select NEWSQL_Flash_Container.

Size: 750 GB

Bus: SCSI

Device Index: 1 (This creates a new controller, scsi.1)

Click Add.

Add a Log disk (on its own controller, a best practice for 'write-intensive' SQL):

Click + Add New Disk.

Storage Container: Select NEWSQL_Flash_Container.

Size: 100 GB (A common size for a log disk)

Bus: SCSI

Device Index: 2 (This creates a third controller, scsi.2)

Click Add.

Review the configuration: You should now have three disks attached, each on a separate controller (scsi.0, scsi.1, scsi.2). This provides the maximum I/O performance.

Ensure the Power on VM after creation box is unchecked.

Click Save.

Here is the step-by-step solution to create and export the capacity planning scenario. This task is performed within Prism Central.

1. Navigate to the Planning Dashboard

From the Prism Central main menu (hamburger icon), navigate to Operations > Planning.

2. Create and Define the Scenario

Click the + Create Scenario button.

In the dialog box:

Scenario Name: IaaS

Scenario Type: Select New Workload

Click Create. This will open the scenario editor.

3. Configure Cluster and Runway Settings

In the 'IaaS' scenario editor, find the Runway setting (top left) and set it to 12 Months.

Find the Cluster configuration tile and click Edit.

Set Number of Host Failures to Tolerate to 2.

Click Save.

4. Define the Workload Profile

In the Workloads section, click the + Add Workload button.

Select Create a new workload profile.

Fill in the VM specifications:

Workload Name: Customer-VM (or similar)

vCPU per VM: 4

Memory per VM: 16 GB

Storage per VM: 200 GB

Click Add.

5. Set the Workload Growth Plan (Waves)

You will be returned to the main scenario editor. In the timeline section ('Workload Plan'), add the VMs:

Wave One (Today):

Click + Add under the 'Today' column.

Select the Customer-VM profile.

Enter 100 VMs.

Click Add.

Wave Two (3 Months):

Click the + icon on the timeline itself.

Set the date to 3 Months from today.

Click + Add under this new '3 Months' column.

Select the Customer-VM profile.

Enter 50 VMs.

Click Add.

Wave Three (6 Months):

Click the + icon on the timeline.

Set the date to 6 Months from today.

Click + Add under this new '6 Months' column.

Select the Customer-VM profile.

Enter 20 VMs.

Click Add.

6. Select the Hardware

In the Hardware configuration tile, click Change Hardware.

In the 'Select Hardware' pane:

Model: Search for and select DX365-10-G11-NVMe.

Note: This model is full-flash by definition, satisfying the requirement.

Click Done. The planner will recalculate the required nodes.

7. Save and Export the Scenario

Click the Save icon (floppy disk) in the top-right corner to save the IaaS scenario.

Click the Export icon (arrow pointing down) in the top-right corner.

Select PDF from the dropdown menu.

A 'Save As' dialog will appear.

Navigate to the Desktop.

Set the file name to IaaS-requirement.pdf.

Click Save.

Here is the step-by-step solution to all three tasks, performed within the Nutanix Prism interface.

Task 1: Create Monitoring Session & Save Metrics

From the Prism Central dashboard, navigate to Operations > Analysis.

Click the + New Session button.

Name the session Monitor SQL02.

In the 'Entities' search box, type SQL01 and select VM: SQL01.

In the 'Entities' search box, type SQL02 and select VM: SQL02.

Click Add Charts > New Chart.

Title: Storage IOPS

Metric: Storage Controller IOPS

Click Add.

Click Add Charts > New Chart.

Title: Storage Latency

Metric: Storage Controller Latency

Click Add.

Click Add Charts > New Chart.

Title: Storage Bandwidth

Metric: Storage Controller Bandwidth

Click Add.

Click Save Session.

With the 'Monitor SQL02' session open, right-click anywhere on the page and click Select All.

Right-click again and select Copy.

Open Notepad, paste the content, and save the file to the desktop as Task 1.txt.

(The content pasted into Task 1.txt would be the session's chart configurations, showing metrics for SQL01 and SQL02.)

Task 2: Create and Schedule the Report

While still in the 'Monitor SQL02' analysis session, click the Save as Report button (it looks like a bookmark icon).

Name the report MonitorSQL02 and click Save.

Navigate to Operations > Reports.

Find the MonitorSQL02 report in the list. Select its checkbox.

Click the Actions dropdown and select Schedule.

Configure the schedule with the following settings:

Schedule Name: monitovm2_daily_report

Recurrence: Daily

Start Time: (Set to a time, e.g., 8:00 AM)

Repeat every: 1 day(s)

Retention Policy: Uncheck the 'Retain a copy of the report' box. (This ensures reports are not retained).

Email Report: Check this box.

Format: PDF

Recipients: perf_group@ACME.org

Click Save.

Task 3: Identify and Correct the Performance Issue

This task is performed without powering on the VMs, indicating a configuration error.

Investigation

Navigate to VMs > Table view.

Click on the SQL01 (the good VM) and select the Configuration tab.

Expand the Disks section. Observe that the primary disk is attached to a SCSI bus (e.g., scsi.0). This is the high-performance standard.

Return to the VM list and click on SQL02 (the problem VM).

Expand the Disks section.

Root Cause

You discover that the primary disk for SQL02 is attached to an IDE bus. The IDE bus has significant performance limitations and is not suitable for a database server, causing the poor storage performance.

Correction

With the SQL02 VM selected, click the Update button.

In the 'Update VM' dialog, scroll down to the Disks section.

Find the disk attached to the IDE bus. Click the Edit (pencil) icon for that disk.

Change the Bus Type dropdown from IDE to SCSI.

The Device Index will automatically populate (e.g., scsi.0).

Click Save in the 'Update Disk' dialog.

(Note: A 'VirtIO SCSI Controller' will be automatically added to the VM configuration if one was not already present.)

Click Save in the 'Update VM' dialog.

The VM SQL02 is now configured to use the high-performance VirtIO-SCSI controller, which will resolve the storage performance discrepancy once the VM is powered on.

To correct the issue of cluster services down on Controller VM (35.197.75.196) in the least disruptive manner, you need to do the following steps:

Log in to Prism Element using the admin user credentials.

Go to the Alerts page and click on the alert to see more details.

You will see which cluster services are down on the Controller VM. For example, it could be cassandra, curator, stargate, etc.

To start the cluster services, you need to SSH to the Controller VM using the nutanix user credentials. You can use any SSH client such as PuTTY or Windows PowerShell to connect to the Controller VM. You will need the IP address and the password of the nutanix user, which you can find in Desktop\Files\SSH\nutanix.txt.

Once you are logged in to the Controller VM, run the command:

cluster status | grep -v UP

This will show you which services are down on the Controller VM.

To start the cluster services, run the command:

cluster start

This will start all the cluster services on the Controller VM.

To verify that the cluster services are running, run the command:

cluster status | grep -v UP

This should show no output, indicating that all services are up.

To clear the alert, go back to Prism Element and click on Resolve in the Alerts page.

To meet the security requirements for cluster level security, you need to do the following steps:

To update the default password for the root user on the node to match the admin user password, you need to SSH to the node using the root user credentials. You can use any SSH client such as PuTTY or Windows PowerShell to connect to the node. You will need the IP address and the password of the root user, which you can find in Desktop\Files\SSH\root.txt.

Once you are logged in to the node, run the command:

passwd

This will prompt you to enter a new password for the root user. Enter the same password as the admin user, which you can find in Desktop\Files\SSH\admin.txt.

To update the default password for the nutanix user on the CVM to match the admin user password, you need to SSH to the CVM using the nutanix user credentials. You can use any SSH client such as PuTTY or Windows PowerShell to connect to the CVM. You will need the IP address and the password of the nutanix user, which you can find in Desktop\Files\SSH\nutanix.txt.

Once you are logged in to the CVM, run the command:

passwd

This will prompt you to enter a new password for the nutanix user. Enter the same password as the admin user, which you can find in Desktop\Files\SSH\admin.txt.

To resolve the alert that is being reported, go back to Prism Element and click on Resolve in the Alerts page.

To output the cluster-wide configuration of SCMA policy to Desktop\Files\output.txt before changes are made, you need to log in to Prism Element using the admin user credentials.

Go to Security > SCMA Policy and click on View Policy Details. This will show you the current settings of SCMA policy for each entity type.

Copy and paste these settings into a new text file named Desktop\Files\output.txt.

To enable AIDE (Advanced Intrusion Detection Environment) to run on a weekly basis for the cluster, you need to log in to Prism Element using the admin user credentials.

Go to Security > AIDE Configuration and click on Enable AIDE. This will enable AIDE to monitor file system changes on all CVMs and nodes in the cluster.

Select Weekly as the frequency of AIDE scans and click Save.

To enable high-strength password policies for the cluster, you need to log in to Prism Element using the admin user credentials.

Go to Security > Password Policy and click on Edit Policy. This will allow you to modify the password policy settings for each entity type.

For each entity type (Admin User, Console User, CVM User, and Host User), select High Strength as the password policy level and click Save.

To ensure CVMs require SSH keys for login instead of passwords, you need to log in to Prism Element using the admin user credentials.

Go to Security > Cluster Lockdown and click on Configure Lockdown. This will allow you to manage SSH access settings for the cluster.

Uncheck Enable Remote Login with Password. This will disable password-based SSH access to the cluster.

Click New Public Key and enter a name for the key and paste the public key value from Desktop\Files\SSH\id_rsa.pub. This will add a public key for key-based SSH access to the cluster.

Click Save and Apply Lockdown. This will apply the changes and ensure CVMs require SSH keys for login instead of passwords.

Part1

Enter CVM ssh and execute:

cluster status | grep -v UP

cluster start

If there are issues starting some services, check the following:

Check if the node is in maintenance mode by running the ncli host ls command on the CVM. Verify if the parameter Under Maintenance Mode is set to False for the node where the services are down. If the parameter Under Maintenance Mode is set to True, remove the node from maintenance mode by running the following command:

nutanix@cvm$ ncli host edit id=<host id> enable-maintenance-mode=false

You can determine the host ID by using ncli host ls.

See the troubleshooting topics related to failed cluster services in the Advanced Administration Guide available from the Nutanix Portal's Software Documentation page. (Use the filters to search for the guide for your AOS version). These topics have information about common and AOS-specific logs, such as Stargate, Cassandra, and other modules.

Check for any latest FATALs for the service that is down. The following command prints all the FATALs for a CVM. Run this command on all CVMs.

nutanix@cvm$ for i in `svmips`; do echo 'CVM: $i'; ssh $i 'ls -ltr /home/nutanix/data/logs/*.FATAL'; done

NCC Health Check: cluster_services_down_check (nutanix.com)

Part2

Update the default password for the root user on the node to match the admin user password

echo -e 'CHANGING ALL AHV HOST ROOT PASSWORDS.\nPlease input new password: '; read -rs password1; echo 'Confirm new password: '; read -rs password2; if [ '$password1' == '$password2' ]; then for host in $(hostips); do echo Host $host; echo $password1 | ssh root@$host 'passwd --stdin root'; done; else echo 'The passwords do not match'; fi

Update the default password for the nutanix user on the CVM

sudo passwd nutanix

Output the cluster-wide configuration of the SCMA policy

ncli cluster get-hypervisor-security-config

Output Example:

nutanix@NTNX-372a19a3-A-CVM:10.35.150.184:~$ ncli cluster get-hypervisor-security-config

Enable Aide : false

Enable Core : false

Enable High Strength P... : false

Enable Banner : false

Schedule : DAILY

Enable iTLB Multihit M... : false

Enable the Advance intrusion Detection Environment (AIDE) to run on a weekly basis for the cluster.

ncli cluster edit-hypervisor-security-params enable-aide=true

ncli cluster edit-hypervisor-security-params schedule=weekly

Enable high-strength password policies for the cluster.

ncli cluster edit-hypervisor-security-params enable-high-strength-password=true

Ensure CVMs require SSH keys for login instead of passwords

https://portal.nutanix.com/page/documents/kbs/details?targetId=kA0600000008gb3CAA