NCP-CN Exam Dumps - Nutanix Certified Professional - Cloud Native (NCP-CN-6.10)

A bastion host in a dark site environment serves as a secure entry point for managing the NKP deployment, providing access to the cluster infrastructure without direct Internet connectivity. The NKPA course outlines the prerequisites for preparing a Linux VM as a bastion host, focusing on secure access and time synchronization, which are critical for air-gapped Kubernetes deployments.

Get or create SSH Keys (Option B):The bastion host requires SSH keys to enable secure, passwordless access to the NKP cluster nodes and other infrastructure components (e.g., Nutanix AHV hosts). The NKPA course specifies that SSH keys must be generated or obtained and configured on the bastion host to facilitate secure communication during deployment and management tasks. The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “For a bastion host in an NKP dark site deployment, ensure SSH keys are created or obtained to enable secure access to cluster nodes and infrastructure.” The engineer can generate SSH keys using ssh-keygen and distribute the public key to the target systems.

Enable NTP Service (Option D):Time synchronization is essential in Kubernetes clusters to ensure consistent logging, certificate management, and scheduling. In a dark site with no Internet access, the bastion host must be configured to synchronize time with an internal NTP (Network Time Protocol) server or act as an NTP server itself. The NKPA course emphasizes enabling the NTP service on the bastion host to maintain accurate time across the air-gapped environment. The NCP-CN 6.10 Study Guide notes: “Enable the NTP service on the bastion host to ensure time synchronization in a dark site NKP deployment, as Kubernetes requires accurate time for proper operation.” The engineer can enable NTP using commands like systemctl enable ntpd and configure it to use an internal time source.

Incorrect Options:

A. Install LDAP Server: LDAP is used for centralized authentication, but it is not a requirement for a bastion host in an NKP dark site deployment. The course focuses on SSH access instead.

C. Install Docker: While Docker is needed on Kubernetes nodes for container runtimes, the bastion host’s role is to provide secure access and management, not to run containers.

The NKPA 6.10 documentation specifies that when attaching external clusters like AKS (Azure Kubernetes Service) to an NKP management cluster using Kommander, the default kubeconfig provided by AKS is typically not directly usable because it lacks the necessary service account details and permissions for NKP to properly manage the cluster. Therefore, the recommended and required approach is to create a separate service account in AKS with the necessary permissions and generate a kubeconfig file for this service account.

Key reference:

“When importing external clusters, such as AKS, the default kubeconfig might not contain the correct permissions for NKP Kommander. A custom kubeconfig for a service account with cluster-admin privileges should be created and used to attach the cluster to NKP.”

According to the NKPA 6.10 documentation, licensing in an NKP cluster is constrained by the total number of vCPUs assigned to all nodes (workers and control planes). In this scenario, the cluster has a maximum of 150 vCPUs available.

The existing output shows 10 worker nodes, each with 8 vCPUs (10×8=80 vCPUs) and 3 control plane nodes, each with 4 vCPUs (3×4=12 vCPUs).

Current vCPU usage: 80 + 12 = 92 vCPUs.

Remaining vCPUs: 150 - 92 = 58 vCPUs.

Option A:

Adding 6 control plane nodes (6×4=24 vCPUs).

This would increase control planes to 9 total (3 existing + 6 new). Control plane nodes would consume 9×4=36 vCPUs.

Worker nodes remain at 80 vCPUs.

Total vCPU usage: 36 + 80 = 116 vCPUs (still under 150 vCPUs).

However, it’s unusual and unnecessary to have 9 control planes in a typical NKP setup. NKPA and NCP-CN best practices indicate typically no more than 3 or 5 control planes for HA. Therefore, this is technically possible but not recommended or standard practice. So not selected.

Option B:

Expanding the existing worker nodepool by 8 nodes (8×8=64 vCPUs).

This would add 64 vCPUs to the current 92 vCPUs:

92 + 64 = 156 vCPUs → exceeds licensing limit.

Correction: The question specifies “expand up to 8 nodes,” so it’s possible to expand by only 7 nodes (7×8=56 vCPUs).

92 + 56 = 148 vCPUs → within licensing limits.

Thus, expanding by up to 7 nodes is valid.

Option C:

Creating a new worker nodepool with 10 nodes (10×8=80 vCPUs).

This would add 80 vCPUs to the existing 92 vCPUs:

92 + 80 = 172 vCPUs → exceeds 150 vCPU licensing limit.

Not valid.

Option D:

Expanding the original worker nodepool by up to 4 nodes (4×8=32 vCPUs) = +32 vCPUs.

Adding a new nodepool of 6 nodes with 4 vCPUs/node (6×4=24 vCPUs) = +24 vCPUs.

Total increase: 32 + 24 = 56 vCPUs.

Total vCPU usage: 92 + 56 = 148 vCPUs → within the 150 vCPU limit.

Thus, valid.

Extract Reference:

NKPA 6.10 – “Cluster Sizing and Licensing”

Nutanix Kubernetes Platform Administration (NKPA) – Licensing Considerations

"The total number of vCPUs for all nodes (control planes and workers) must not exceed the licensed vCPU capacity of the NKP deployment."

This confirms that Options B and D are the two valid approaches to expand the cluster while remaining compliant with licensing constraints.

The Nutanix Kubernetes Platform (NKP) integrates Velero, an open-source tool, for backup and restore operations as part of its Day 2 operations. The NKPA course explains that after configuring a Backup Storage Location (e.g., an AWS S3 bucket) and creating a backup, administrators can view details of the backup using the Velero CLI. The correct command to view the details of a backup named testbackup is velero backup describe testbackup. This command provides a detailed description of the backup, including its status, resources included, and storage location.

The Nutanix Cloud Native (NCP-CN) 6.10 Study Guide states: “To inspect a Velero backup in NKP, use the velero backup describe command to display detailed information about the backup, such as its creation time, expiration, and included resources.” The backup name (testbackup) is specified as created by the team, and no prefix like aws-velero- is indicated in the question, making option C the correct choice.

Incorrect Options:

A. kubectl get backupstoragelocations -n ${testbackup} -o yaml: This command retrieves Backup Storage Location objects, not backup details. The namespace ${testbackup} is also incorrect, as Velero resources are typically in a specific namespace (e.g., velero).

B. velero backup describe aws-velero-testbackup: The backup name is testbackup, not aws-velero-testbackup. The NKPA course does not indicate any prefix for the backup name.

D. kubectl get backupstoragelocations -n ${WORKSPACE_NAMESPACE} -o yaml: This retrieves Backup Storage Locations, not the backup itself, and does not provide backup details.

According to the NKPA 6.10 documentation, the Pre-provisioned infrastructure provider (CAPPP) requires the user to provide an inventory file of the servers that will become the cluster nodes. This inventory file contains connection information (IP addresses, credentials, etc.) for each pre-provisioned node, enabling the Cluster API to connect and configure these servers directly during cluster creation.