Quiz NCM-MCI: Nutanix Certified Master - Multicloud Infrastructure v6.5

Here is the step-by-step solution to all three tasks, performed within the Nutanix Prism interface.
Task 1: Create Monitoring Session & Save Metrics
From the Prism Central dashboard, navigate to Operations > Analysis.
Click the + New Session button.
Name the session Monitor SQL02.
In the "Entities" search box, type SQL01 and select VM: SQL01.
In the "Entities" search box, type SQL02 and select VM: SQL02.
Click Add Charts > New Chart.
Title: Storage IOPS
Metric: Storage Controller IOPS
Click Add.
Click Add Charts > New Chart.
Title: Storage Latency
Metric: Storage Controller Latency
Click Add.
Click Add Charts > New Chart.
Title: Storage Bandwidth
Metric: Storage Controller Bandwidth
Click Add.
Click Save Session.
With the "Monitor SQL02" session open, right-click anywhere on the page and click Select All.
Right-click again and select Copy.
Open Notepad, paste the content, and save the file to the desktop as Task 1.txt.
(The content pasted into Task 1.txt would be the session's chart configurations, showing metrics for
SQL01 and SQL02.)
Task 2: Create and Schedule the Report
While still in the "Monitor SQL02" analysis session, click the Save as Report button (it looks like a
bookmark icon).
Name the report MonitorSQL02 and click Save.
Navigate to Operations > Reports.
Find the MonitorSQL02 report in the list. Select its checkbox.
Click the Actions dropdown and select Schedule.
Configure the schedule with the following settings:
Schedule Name: monitovm2_daily_report
Recurrence: Daily
Start Time: (Set to a time, e.g., 8:00 AM)
Repeat every: 1 day(s)
Retention Policy: Uncheck the "Retain a copy of the report" box. (This ensures reports are not
retained).
Email Report: Check this box.
Format: PDF
Recipients: [email protected]
Click Save.
Task 3: Identify and Correct the Performance Issue
This task is performed without powering on the VMs, indicating a configuration error.
Investigation
Navigate to VMs > Table view.
Click on the SQL01 (the good VM) and select the Configuration tab.
Expand the Disks section. Observe that the primary disk is attached to a SCSI bus (e.g., scsi.0). This is
the high-performance standard.
Return to the VM list and click on SQL02 (the problem VM).
Expand the Disks section.
Root Cause
You discover that the primary disk for SQL02 is attached to an IDE bus. The IDE bus has significant
performance limitations and is not suitable for a database server, causing the poor storage
performance.
Correction
With the SQL02 VM selected, click the Update button.
In the "Update VM" dialog, scroll down to the Disks section.
Find the disk attached to the IDE bus. Click the Edit (pencil) icon for that disk.
Change the Bus Type dropdown from IDE to SCSI.
The Device Index will automatically populate (e.g., scsi.0).
Click Save in the "Update Disk" dialog.
(Note: A "VirtIO SCSI Controller" will be automatically added to the VM configuration if one was not
already present.)
Click Save in the "Update VM" dialog.
The VM SQL02 is now configured to use the high-performance VirtIO-SCSI controller, which will
resolve the storage performance discrepancy once the VM is powered on.

Here is the step-by-step solution to apply the security requirements to Cluster 2.
1. Access Cluster 2 Prism Element
First, we must access the Prism Element (PE) interface for Cluster 2, as most security settings are
cluster-specific.
From the Prism Central dashboard, navigate to Hardware > Clusters.
Find Cluster 2 in the list and click its name. This will open the Prism Element login page for that
specific cluster in a new tab.
Log in to Cluster 2's Prism Element using the admin credentials.
2. Requirement: Update Node Root Password
This task syncs the root password for all AHV hypervisor nodes with the cluster's admin user
password.
In the Cluster 2 PE interface, click the gear icon (Settings) in the top right corner.
Select Cluster Lockdown from the left-hand menu.
Click the Set Root Password on All Hosts button.
A dialog box will appear. Enter the current admin password (the one you just used to log in) into both
the New Password and Confirm New Password fields.
Click Save. This will propagate the admin password to the root user on all nodes in Cluster 2.
3. Requirement: Add CVM SSH Key
This task adds the security team's public key to the admin user, which is required before we can
disable password-based login.
On the desktop, navigate to the Files > SSH folder.
Open the id_rsa.pub file (or equivalent public key file) with Notepad.
Copy the entire string of text (e.g., ssh-rsa AAAA...).
In the Cluster 2 PE interface, go to Settings (gear icon) > User Management.
Select the admin user and click Modify User.
Paste the copied public key into the Public Keys text box.
Click Save.
4. Requirement: Apply SCMA Policies (All other requirements)
The remaining requirements are all applied via the command line on a CVM using Nutanix's Security
Configuration Management Automation (SCMA).
Access the CVM:
Find a CVM IP for Cluster 2 by going to Hardware > CVMs in the PE interface.
Open an SSH client (like PuTTY) and connect to that CVM's IP address.
Log in with the username admin and the corresponding password.
Output Current Policy (Req 2):
Before making changes, run the following command to see the current policy:
ncli scma status
Copy the entire output from your SSH terminal.
Open Notepad on the desktop, paste the copied text, and Save the file to the desktop as output.txt.
Apply New Policies (Req 3, 4, 5):
Run the following commands one by one. The cluster will apply them immediately without a reboot.
Enable AIDE (Req 3):
ncli scma update aide-status=enabled aide-schedule=weekly
Enable High-Strength Passwords (Req 4):
ncli scma update password-policy=high
Require SSH Keys for CVMs (Req 5):
ncli scma update ssh-login=keys-only
Verification
You can verify all changes by running the status command again. The output should now reflect the
new, hardened security posture.
ncli scma status
AIDE Status: should show Enabled
AIDE Schedule: should show Weekly
Password Policy: should show High
SSH Login: should show keys-only

Here is the step-by-step solution to modify the security policy file as required.
Navigate to the desktop and open the file Security Policy.txt (which corresponds to the provided
Security Policy.bak content) using a text editor like Notepad.
Modify the file content by replacing the xxxxx and xxxx placeholders according to the security
requirements.
Modifications by Rule
Here are the specific changes to make within the file:
1. Quarantine Rule
Requirement 1 (No Logging): The quarantine rule should not be logged.
Change "is_policy_hitlog_enabled": "xxxxx" to "is_policy_hitlog_enabled": "false"
Requirement 2 (Enforce): This rule must be enforced.
Change "action": "xxxxx" (under quarantine_rule) to "action": "APPLY"
Requirement 3 (Environment): The rule must affect the "SecOps" environment.
Change "Environment": ["xxxxx"] to "Environment": ["SecOps"]
2. SMB-block Rule
Requirement 1 (Logging): This rule must be logged.
Change "is_policy_hitlog_enabled": "xxxxx" to "is_policy_hitlog_enabled": "True"
Requirement 2 (Monitor): This rule must not be enforced, only logged.
Change "action": "xxxxx" (under isolation_rule) to "action": "MONITOR"
Requirement 4 (Tags): The rule must affect the "smbhost" and "smbclient" tags.
Change "SMBv1": ["xxxxx"] to "SMBv1": ["smbhost"]
Change "SMRv1": ["xxxxx"] to "SMRv1": ["smbclient"]
3. DN test (dn-policy1) Rule
Requirement 2 (Monitor): This rule must not be enforced, only logged.
Change "action": "xxxx" (under app_rule) to "action": "MONITOR"
Requirement 5 (Allow IPv6): This policy must allow IPv6 traffic.
Change "allow_ipv6_traffic": "xxxx" to "allow_ipv6_traffic": "True"
Final Step
After making all the replacements, Save the file, overwriting the original Security Policy.txt on the
desktop.
Example of completed rules (replace xxxxx accordingly):
Rule Name: Quarantine Rule
Logged: false
Action: APPLY
Environment: SecOps
Protocols: TCP
Ports: 8080
Rule Name: SMB Rule
Logged: True
Action: MONITOR
Tags: smbhost, smbclient
Protocols: TCP
Ports: 8080
Rule Name: DN Test Policy
Logged: True
Action: MONITOR
Environment: Non-Prod
Protocols: ALL
Ports: 8080

Here is the step-by-step solution to configure syslog for Cluster 1.
1. Access Cluster 1 Prism Element
Since the requirement is to only configure Cluster 1 and not other clusters, this task must be
performed in the Prism Element (PE) interface for Cluster 1.
From the main Prism Central dashboard, navigate to Hardware > Clusters.
Find Cluster 1 in the list and click its name. This will open the specific Prism Element login page for
that cluster.
Log in to Cluster 1's Prism Element interface.
2. Add the Syslog Server
In the Cluster 1 PE interface, click the gear icon (Settings) in the top-right corner.
From the left-hand menu, select Syslog.
In the "Remote Syslog Server" section, click the + Add Syslog Server button.
Fill in the server details as required:
Name: Corp_Syslog
IP Address: 34.142.155.231
Port: 514
Protocol: TCP (This provides the highest reliability, as requested).
Click Save.
3. Configure Log Modules and Severities
Now, we must specify which logs to send to the new server.
On the same Syslog settings page, find the "Syslog Configuration" section and click the Configure
button (or Modify if a default is present).
A dialog box "Select Modules and Levels" will appear.
Uncheck all modules to ensure no extra logs are sent.
Check the box for the RSyslog Server Module (or rsyslog_forwarder).
For this module, check the boxes for the severities: Critical, Warning, and Info.
Check the box for the ApiServer module.
This module logs all operational tasks and audit trails, which includes all Virtual Machine changes.
For this module, check the boxes for the top severity levels: Critical, Warning, and Info.
Ensure no other modules (like Stargate, Cerebro, Zookeeper, etc.) are checked.
Click Save.
Cluster 1 is now configured to send its audit logs (including VM changes) and its own syslog
monitoring logs to the Corp_Syslog server via TCP, fulfilling all security requirements.

Here is the step-by-step solution to generate the Certificate Signing Request (CSR) on Cluster 1.
This entire process is performed from an SSH session connected to a CVM (Controller VM) on Cluster
1.
1. Access Cluster 1 CVM
From Prism Central, navigate to Hardware > Clusters and click on Cluster 1 to open its Prism Element
(PE) interface.
In the Cluster 1 PE, navigate to Hardware > CVMs to find the IP address of any CVM in the cluster.
Use an SSH client (like PuTTY) to connect to the CVM's IP address.
Log in with the admin user and password.
2. Create the Configuration File (.cnf)
To include the Subject Alternative Names (SANs), you must first create a configuration file.
In the CVM's command line, create the .cnf file using a text editor:
vi prism_element_acme.cnf
Press i to enter "Insert" mode.
Paste the following text exactly into the editor:
Ini, TOML
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[ req_distinguished_name ]
C = US
ST = North Carolina
L = Durham
O = ACME
OU = Infrastructure
CN = prism_element.ACME.org
emailAddress = [email protected]
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = cvm1.ACME.org
DNS.2 = cvm2.ACME.org
DNS.3 = cvm3.ACME.org
Press Esc to exit "Insert" mode, then type :wq and press Enter to save and quit vi.
3. Generate the CSR and Key
Run the following openssl command. This command uses the .cnf file to generate the new CSR (.csr)
and a corresponding private key (.key), applying the sha256 encryption as requested.
Bash
openssl req -new -nodes -out prism_element_acme.csr -keyout prism_element_acme.key -config
prism_element_acme.cnf -sha256
The command will output the following, confirming the key generation:
Generating a 2048 bit RSA private key
. ................ +++++
. .............................. +++++
writing new private key to 'prism_element_acme.key'
4. Save Files to the Desktop
You will now copy the contents of the generated files from the CVM to your desktop.
For Task 5.txt (Commands and Output):
Open a new Notepad file on the desktop.
Copy and paste all the commands you ran in the SSH session and their full output (as shown in steps
2 and 3) into this file.
Save the file on the desktop as Task 5.txt.
For prism_element_acme.cnf:
In the CVM SSH session, display the file's content:
cat prism_element_acme.cnf
Copy the entire text output (starting from [ req ]).
Open a new Notepad file on the desktop.
Paste the content and save the file as prism_element_acme.cnf.
For prism_element_acme.csr:
In the CVM SSH session, display the file's content:
cat prism_element_acme.csr
Copy the entire text output, including the -----BEGIN CERTIFICATE REQUEST----- and -----END
CERTIFICATE REQUEST --- lines.
Open a new C:\Users\admin\Desktop\Notepad file on the desktop.
Paste the content and save the file as prism_element_acme.csr.

Here is the step-by-step solution to create the category and the corresponding storage encryption
policy within Prism Central.
1. Create the Category
First, you must create the category and the two values requested.
In Prism Central, navigate to Administration > Categories.
Click New Category.
In the Name field, enter VM-Storage.
In the Add a Value field, type softwareencrypted and click the Add (plus) button.
In the Add a Value field again, type SEDencrypted and click the Add (plus) button.
Click Save.
2. Create the Encryption Policy
Next, you will create the security policy that uses the new category.
In Prism Central, navigate to Security > Data-at-Rest Encryption.
Click the + Create Security Policy button.
In the Policy Name field, enter Encrypted-Storage.
Ensure the Encryption Type is set to Software-based.
For Target VMs, select the radio button for VMs matching a category.
In the Select Category dropdown, choose the VM-Storage category you just created.
In the Select Value dropdown, choose softwareencrypted.
Click Save.
This policy will now automatically apply software-based encryption to any new or existing VMs that
are assigned the VM-Storage: softwareencrypted category.

Here is the step-by-step solution to configure the Volume Group for optimized performance in the
production environment.
This task is performed in Prism Central.
From the main dashboard, navigate to Compute & Storage > Volume Groups.
Find the Volume Group named Database_VM in the list.
Select the checkbox next to Database_VM.
Click the Actions dropdown menu and select Update.
In the "Update Volume Group" dialog, scroll to the bottom of the "Basic Configuration" section.
Find the checkbox labeled Enable Client Side Load Balancing and check it.
Note: This setting allows the iSCSI initiator within the guest VM to connect to all CVMs in the cluster,
distributing the storage load from the three vDisks across all three nodes in the production
environment instead of focusing all I/O on just one.
Click Save.

Here is the step-by-step solution to complete both tasks on Cluster 1.
This solution requires you to first find the IP of Cluster 2 (for the SMTP server) and then perform all
configurations within the Prism Element interface for Cluster 1.
Prerequisite: Find Cluster 2 IP
In Prism Central, navigate to Hardware > Clusters.
Find Cluster 2 in the list and note its IP Address. You will use this in the steps below.
Task 1: Create the VM Template
Log in to the Prism Element (PE) interface for Cluster 1. (From PC, go to Hardware > Clusters > click
the name "Cluster 1").
Navigate to the VM view from the main dashboard.
Click the + Create VM button.
Fill in the VM details based on the NVD-2031 "Small VM" configuration (e.g., 2 vCPUs, 1 Core per
vCPU, 4 GB RAM).
Name: Small Template
Compute Details:
vCPUs: 2
Number of Cores per vCPU: 1
Memory: 4 GB
Scroll down to Storage and click + Add New Disk.
Operation: Select Clone from Image Service.
Image: Select any available guest OS image (e.g., a Windows or CentOS image).
Storage Container: Ensure the default container is selected (as required by the task).
Click Add.
Scroll down to Network Adapters (NIC) and click + Add NIC.
Select any available VLAN/Subnet (e.g., Primary).
Click Add.
Click Save. The VM will be created (and remain powered off).
Find the new Small Template VM in the list. Select its checkbox.
Click the Actions dropdown and select Convert to Template.
Confirm the action by clicking OK.
Task 2: Configure SMTP and NCC Reports
While still in the Cluster 1 Prism Element interface, click the gear icon (Settings) in the top-right
corner.
Select SMTP Server from the left-hand menu.
Click the Configure button.
In the "Server Settings" tab, fill in the following:
Server Address: Enter the Cluster 2 IP Address (which you found in the prerequisite step).
Port: 25 (leave as default).
From Email Address: [email protected]
Click Next.
In the "Email Recipients" tab, click + Add Email Recipient.
Address: [email protected]
Ensure all severities (Critical, Warning, Info) are checked.
Click Save.
Click + Add Email Recipient again.
Address: [email protected]
Ensure all severities are checked.
Click Save.
Click Done. A test email will be sent.
In the main Settings menu, select Alerts and Notifications.
Scroll to the NCC Health Checks section.
Check the box labeled Email Nutanix Cluster Check reports to recipients. (This will use the SMTP
settings and recipients you just configured).
Click Save.

Here is the step-by-step solution to configure Disaster Recovery from the Cluster 1 Prism Element
interface.
1. Add Cluster 2 as a Remote Site
First, you must register Cluster 2 as a DR target for Cluster 1.
From the Cluster 1 Prism Element dashboard, navigate to Data Protection from the main dropdown
menu.
Click the Remote Site tab.
Click the + Remote Site button and select Physical Cluster.
In the "Name" field, enter Cluster2_DR_Task3.
In the "Address" field, enter the 172.30.0.x Virtual IP address of Cluster 2.
Click Save. The clusters will exchange credentials and connect.
2. Throttle Replication Bandwidth
Next, apply the 10 Mbps bandwidth limit for traffic going to Cluster 2.
On the same Remote Site tab, select the newly created Cluster2_DR_Task3.
Click the Update button.
In the dialog, set the Bandwidth Limit to 10 Mbps.
Click Save.
3. Create the Protection Domain
A Protection Domain (PD) is the top-level object that will manage the VMs and replication schedules.
In the Data Protection dashboard, click the Table tab.
Click the + Protection Domain button and select Async DR.
For the Name, enter App_PD_Task3.
Click Create.
4. Protect VMs in a Consistency Group
Now you will add the three application VMs to the new Protection Domain as a single Consistency
Group (CG).
You will be taken to the dashboard for the new App_PD_Task3. In the Entities panel, click the Protect
Entities button.
In the "Protect Entities" dialog, search for and select the three VMs:
Web-Prod
App-Prod
DB-Prod
Click Next.
Select Create new consistency group and name it App_CG_Task3.
Click Protect.
5. Create the Replication Schedule
Finally, configure the schedule to meet the RPO and retention requirements.
In the App_PD_Task3 dashboard, click the Schedules tab.
Click the + New Schedule button.
Remote Site: Select Cluster2_DR_Task3.
RPO (Repeat every): Select NearSync. Set the RPO to 1 minute.
Note: This is the lowest possible RPO for an Async (>5ms latency) connection, fulfilling the "as close
to 0" requirement.
Local Retention: Set to 2 Days.
Remote Retention: Set to 2 Days.
Ensure the "Store snapshots for 2-way replication" checkbox is enabled to allow failback from Cluster
2.
Click Create Schedule.