Free Nutanix Certified Professional - Network & Security (NCP-NS) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the Nutanix Certified Professional - Network & Security (NCP-NS) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1Two overlay subnets belong to the same Flow Virtual Networking VPC. What addressing constraint applies to their VMs?

   1. A.Each VM must use a unique IP address within the VPC.Correct answer: A
   2. B.Each VM must use a unique IP address across all VPCs.
   3. C.VMs in different subnets must use the same IP address.
   4. D.Only VMs with external connectivity need unique IP addresses.

   Explanation: The guide states, "The IP addresses within a VPC must be unique." This applies to both subnets in the VPC; different VPCs can have overlapping addresses.

   Reference: Flow Virtual Networking 6.0: Essential Concepts — Essential Concepts, VPC

2. 2An FNS service-insertion policy must collect hit logs while leaving the default IPv6 block in place. Which Advanced Configuration settings meet both requirements?

   1. A.Policy Hit Logs enabled; Allow IPv6 traffic blockedCorrect answer: A
   2. B.Policy Hit Logs disabled; Allow IPv6 traffic blocked
   3. C.Policy Hit Logs disabled; Allow IPv6 traffic enabled
   4. D.Policy Hit Logs enabled; Allow IPv6 traffic enabled

   Explanation: The guide states, "by default Allow IPv6 traffic is blocked and Policy Hit Logs is disabled." It then says, "Click the Enabled option (in the Policy Hit Logs field ) to collect flow policy hit logs on a syslog server." The syslog server also needs the hit log module.

   Reference: Flow Network Security 5.2: Creating an Application Policy with Service Insertion — Creating an Application Policy with Service Insertion, Define Policy

3. 3A BGP session is being created for a VPC. Which address configuration satisfies the documented VPC prerequisite, assuming all other requirements are met?

   1. A.An externally routable IP address or prefix is configured.Correct answer: A
   2. B.A floating IP only, with no externally routable IP address or prefix.
   3. C.A shared SNAT IP only, with no externally routable IP address or prefix.
   4. D.A private overlay VM IP only, with no externally routable IP address or prefix.

   Explanation: The BGP guide states, "Without an externally routable IP address/prefix, BGP session creation fails." A floating IP, shared SNAT IP, or private overlay address alone does not supply that required VPC configuration.

   Reference: Flow Virtual Networking 6.0: Border Gateway Protocol Sessions — Border Gateway Protocol Sessions, Other conditions applicable to BGP sessions

4. 4An enforced isolation policy and an enforced application policy apply to the same application. The application policy allows both TCP and UDP traffic. Assuming no higher-priority policy applies, what is the outcome?

   1. A.Both TCP and UDP traffic are blocked.Correct answer: A
   2. B.Both TCP and UDP traffic are allowed.
   3. C.TCP traffic is allowed and UDP traffic is blocked.
   4. D.TCP traffic is blocked and UDP traffic is allowed.

   Explanation: The policy model states, "If the Isolation environment policy is in the enforce mode, it blocks all traffic to the application, including the traffic that is allowed by the application security policy." Thus both traffic types are blocked.

   Reference: Flow Network Security 5.2: Security Policy Model — Security Policy Model, Priorities Between Policies

5. 5In the Prism Central Enable Microsegmentation dialog, which action completes the documented FNS enablement procedure?

   1. A.Select Enable Microsegmentation and click Save.Correct answer: A
   2. B.Clear Enable Microsegmentation and click Save.
   3. C.Select Enable Microsegmentation and leave without saving.
   4. D.Clear Enable Microsegmentation and leave without saving.

   Explanation: The guide says, "Select the Enable Microsegmentation check box." It then says, "Click Save." Both steps are required by the documented procedure.

   Reference: Flow Network Security 5.2: Enabling Microsegmentation — Enabling Microsegmentation

6. 6In a hub-and-spoke design with several user VPCs, what routing role can a transit VPC perform?

   1. A.Route private IPv4 traffic between user VPCs.Correct answer: A
   2. B.Route only between VMs inside one user VPC.
   3. C.Prevent all routing across tenant boundaries.
   4. D.Translate every VPC packet to a floating IP.

   Explanation: The guide states, "Transit VPCs enable you to route traffic between user VPCs using private IPv4" addresses. It describes transit VPCs as a hub-and-spoke architecture.

   Reference: Flow Virtual Networking 6.0: Essential Concepts — Essential Concepts, Transit VPC

7. 7A service-insertion policy records hit logs locally, but they must also be sent to an external syslog server. What additional Prism Central configuration is required?

   1. A.A syslog server configured with the hit log moduleCorrect answer: A
   2. B.A syslog server configured only with the API Audit module
   3. C.A syslog server configured only with the Audit module
   4. D.A syslog server configured only with the Flow Service Logs module

   Explanation: The procedure says, "Policy hit logs are redirected to syslog server only when you configure the syslog server with hit log module in the Prism Central." Local recording alone is insufficient to forward them.

   Reference: Flow Network Security 5.2: Creating an Application Policy with Service Insertion — Creating an Application Policy with Service Insertion, Define Policy

8. 8A BGP session receives routes, but none are installed in the VPC routing table. The VPC has no no-NAT external network. What explains this behavior?

   1. A.The received routes are ignored and not installed in the VPC table.Correct answer: A
   2. B.The received routes are installed as BGP-learned routes.
   3. C.The received routes are installed as static routes.
   4. D.The received routes are installed as policy-based routes.

   Explanation: The guide states, "If the VPC is not associated with a no-NAT network, the BG session ignores the received routes and does not add them to the routing table."

   Reference: Flow Virtual Networking 6.0: Border Gateway Protocol Sessions — Border Gateway Protocol Sessions, Received route conditions

9. 9VMs inside the same secured entity can communicate even though no customized intra-tier rule was configured. Which default behavior explains this?

   1. A.The default intra-tier rule allows all VM-to-VM traffic.Correct answer: A
   2. B.The default intra-tier rule denies all VM-to-VM traffic.
   3. C.The default intra-tier rule permits only explicitly configured ports.
   4. D.The default behavior delegates intra-tier traffic to inbound rules.

   Explanation: The intra-tier guide states, "The default behaviour is allow-all configuration." It permits VMs within a secured entity to communicate with one another.

   Reference: Flow Network Security 5.2: Intra-Tier Traffic Rule Customization — Intra-Tier Traffic Rule Customization

10. 10What is the minimum AOS version listed for FNS Next-Gen 5.2.0 on supported AHV clusters?

    1. A.AOS 6.8
    2. B.AOS 7.0
    3. C.AOS 7.3Correct answer: C
    4. D.AOS 7.5

    Explanation: The requirements list "AOS 7.3 or later version" for FNS Next-Gen 5.2.0. Version 7.3 is the minimum of the stated range.

    Reference: Flow Network Security 5.2: Microsegmentation Requirements — Microsegmentation Requirements for FNS Next-Gen 5.2.0