2026 NCP-NS Question Bank Free PDF Download Recently Updated Questions [Q29-Q52]

Rate this post

2026 NCP-NS Question Bank: Free PDF Download Recently Updated Questions

NCP-NS Certification Exam Dumps with 108 Practice Test Questions

NEW QUESTION 29
An administrator is using Flow Network Security to secure a 3-tier application and has already created and assigned the categories. The administrator does not have the details of the rules that need to be allowed to secure the application.
How can the administrator use Flow Network Security to monitor the traffic and help with the policy creation without impacting the applications connectivity?

Use service insertion to redirect traffic through a monitoring service to capture the application traffic and create the Flow Network Security policy based on data captured in monitoring service.

Create the Policy in Save mode, review the discovered traffic, allow the required traffic flows, and move Policy to Enforce mode.

Create the Policy in Monitor mode, review the discovered traffic, allow the required traffic flows, and move Policy to Enforce mode.

Redirect the traffic to a Syslog server and monitor the traffic on the syslog server and then create the Flow Network Security policy based on monitored data in syslog server.

NEW QUESTION 30
Before creating a new Application Security Policy in Prism Central, what prerequisite must exist?

A category key/value pair must be defined for use in the policy.

Flow Network Security must be enabled on all registered clusters.

Targeted VMs must have category assignments.

The Network Controller must be deployed on each cluster in the policy’s scope.

NEW QUESTION 31
An administrator configures a VPN gateway with eBGP for dynamic route exchange. After setup, routes are not advertised to the remote peer.
Which configuration is most likely missing?

DHCP options for assigning IP addresses to remote endpoints.

ASN configuration for the local gateway to identify its autonomous system.

VLAN ID alignment between local and remote networks.

Peer IP address required for establishing the BGP session.

NEW QUESTION 32
What happens when a monitored policy is enforced?

Stops logging traffic

Blocks all traffic that is not allowed

Deletes the policy hitlogs

Removes all discovered flows

NEW QUESTION 33
An administrator has a requirement to capture application flow data for a policy in Monitor mode and export those events to an external SIEM for correlation with other logs.
Which two actions are required to achieve this? (Choose two.)

Enable IPFIX export on the monitored policy.

Enable Policy Hit Logging on the monitored policy.

Create a Flow Audit Policy on the monitored policy.

Configure a remote syslog destination in Prism Central.

NEW QUESTION 34
Which step is required before placing the Flow Network Security software bundle on a local web server?

Perform an inventory on the Nutanix cluster before transferring any bundle files to the web server.

Extract the downloaded bundle using 7zip and upload it directly to Prism Central.

Enable Direct Upload in Life Cycle Manager so the bundles can be transferred automatically to the Nutanix cluster.

Set up a local web server and download both the required software LCM bundle and compatibility bundle.

NEW QUESTION 35
A VM with IP address 172.20.10.5 on a Subnet with CIDR 172.20.10.0/24 is unable to be routed externally from the VPC.
The VPC is successfully peered via BGP… However, when checking the BGP Session, no routes are being advertised by the VPC.
What is the most likely configuration issue?

There is no default route within the VPC to send traffic to the NAT external network.

The VM does not have a Floating IP assigned to allow external connectivity.

The VPC does not have a NO-NAT network configured to advertise the routes.

A network Policy is blocking outbound access for the VM.

NEW QUESTION 36
An administrator is deploying a multi-tier application on a Nutanix AHV cluster. The Web tier needs to be accessible from the internet, the App tier must communicate only with the Web tier and the Database tier, and the Database tier should accept traffic only from the App tier.
The administrator must determine the correct configuration to ensure secure, reliable connectivity for the Web tier while maintaining isolation from the Internet for the App and Database tiers.
Which connectivity option should the administrator implement to meet the requirements?

Assign direct external IPs to all VMs in the VPC.

Use overlay networks for the Web tier to provide internet access.

Assign Floating IP assignments to Web tier only.

Connect all tiers directly to the external network with no NAT.

NEW QUESTION 37
During a security review, the administrator confirms that the existing security policy does not explicitly allow traffic from Environment: Development to Environment: Production. A VM in the Development category was still able to reach a Production VM over IPv6.
What is the most likely cause of this behavior?

An isolation policy was incorrectly applied instead of an application policy.

The Allow All IPv6 option in the policy was selected.

The policy was misconfigured and allowed all Layer 2 broadcast traffic.

The VM was using a static IPv6 address.

NEW QUESTION 38
What is the additional resource requirement for each Prism Central VM when enabling Flow Virtual Networking on a Small Prism Central deployment?

2 GB of memory and 1 vCPUs

3 GB of memory and 2 vCPUs

4 GB of memory and 3 vCPUs

5 GB of memory and 4 vCPUs

NEW QUESTION 39
An administrator has a VPC with a single active gateway node that successfully peers with an external router using a single BGP GW and session.
To eliminate a single point of failure, the administrator deploys a second BGP gateway to the VPC. After the second gateway is added and shows a healthy state, the external router still only sees a single BGP session.
What is the most likely reason for the second session not being established on the external router?

The BGP Hold-down timer on the external router is set too high.

Network Security Groups are blocking BGP traffic from the second gateway’s IP address.

The external router needs BGP peering configuration pointing to the IP address of the first gateway node.

The second BGP gateway requires a BGP session configured to peer with the external router.

NEW QUESTION 40
Refer to th exhibit.

An administrator needs to setup a Syslog server to capture the Flow Network Security Hit logs. Which module name should be selected?

Flow Service Logs

API Audit

Security Policy Hit logs

Audit

NEW QUESTION 41
What entity is automatically created on the cluster hosting Prism Central when Microsegmentation is enabled?

A storage container named flow_data is created.

A Bucket named flow_data is created.

A File Share named flow_data is created.

A virtual machine named flow_data is created.

NEW QUESTION 42
What type of policy would be used to block all traffic between VMs in the category Environment:Sandbox and VMs in the category Environment:Production?

Quarantine Policy

Application Policy

Isolation Policy

Shared Services Policy

NEW QUESTION 43
Which action allows an administrator to reuse a single existing policy in a different scope?

Place policy in Enforce mode

Clone

Place policy in Monitor mode

Export

NEW QUESTION 44
An administrator plans to upgrade a Nutanix cluster running AHV and Prism Central. The current cluster is on AOS 6.10, and the administrator wants to move to AOS 7.3 while ensuring all components remain compatible.
What is the correct upgrade order to minimize downtime and maintain cluster functionality?

Upgrade CVMs -> Upgrade cluster AOS -> Upgrade Prism Central -> Upgrade AHV hosts

Upgrade cluster AOS -> Upgrade AHV hosts -> Upgrade Prism Central -> Upgrade CVMs

Upgrade Prism Central -> Upgrade AHV hosts -> Upgrade CVMs -> Upgrade cluster AOS

Upgrade AHV hosts -> Upgrade cluster AOS -> Upgrade Prism Central -> Upgrade CVMs

NEW QUESTION 45
An administrator sets up a VPN between two Nutanix VPCs in different Availability Zones. After deployment, the VPN tunnel shows as Up, but traffic between the VPCs is not flowing.
Which configuration step is most likely missing?

NAT policy on each of the VPC routers

IPsec encryption settings on the VPN profile

MTU adjustment on the AHV hosts

Static routes for remote subnets on the VPC

NEW QUESTION 46
An administrator is responsible for managing user access to a Nutanix cluster… configure custom user roles…
What is the first step in configuring and managing user roles for a Nutanix cluster?

Create the requisite Authorization Polices from custom or built-in roles.

Modify the administrator role to restrict access to critical system functions.

Disable default roles and create new roles for each team.

Create the requisite Custom Roles from custom or built-in Authorization Polices.

NEW QUESTION 47
Which step is required to prepare an AHV cluster for Flow Network Security Next-Gen?

Enable microsegmentation and network controller on the cluster.

Assign static IP addresses to all VMs before enabling Flow.

Enable microsegmentation policies on all VM groups before enabling Flow.

Disable all existing VLANs in the cluster to allow Flow to control traffic.

NEW QUESTION 48
An administrator is deploying a new multi-tenant environment in Prism Central and has created a VPC named TenantVPC1.
The administrator needs to enable external connectivity for this VPC so that some services inside the VPC can be accessed from the corporate network without NAT translation, while other services require Internet access through SNAT translation. The administrator plans to use an External Network(s) to provision this connectivity.
Which configuration should the administrator apply to satisfy this requirement?

Create two External Networks for TenantVPC1: one NAT (for Internet access) and one Routed/No-NAT (for corporate network access). Attach both to the VPC.

Create two External Networks both of type Routed/No-NAT and attach both to TenantVPC1, one for corporate access and one for internet access.

Create a single External Network of type NAT only and attach it to TenantVPC1. Define SNAT and Floating IPs for both the corporate-network services and internet-facing services.

Create one External Network of type Routed/No-NAT only, attach to TenantVPC1, and configure routing policy to translate IP addresses for internet-facing services.

NEW QUESTION 49
The alert details mention a specific external network. Attempts to assign new Floating IPs to VMs fail, but existing Floating IPs continue to work.
What is the cause of this alert?

A firewall is blocking communication between Prism Central and the VPC’s virtual router.

The VPC’s connection to the external network is down.

A firewall is blocking communication between Prism Central and the VPC’s virtual router.

There are no more available IP addresses in the address pool configured for Floating IPs in that external network.

NEW QUESTION 50
An administrator needs to delegate the management of security policies to a dedicated SecOps team. To enforce the principle of least privilege, the administrator assigns the predefined Flow Policy Author role to a user on the team.
The user confirms they can create, monitor, and enforce security policies. However, when attempting to build a new application security policy for a set of newly deployed VMs, the user reports they are unable to create a new category to group these VMs. The option is not available in the Prism Central UI.
Which statement explains this behavior?

The Flow Policy Author role must be cloned into a custom role before it can be used.

The user’s role must be assigned with a scope for the specific projects they manage.

The user is missing the Flow Admin role, which is required for category management.

The Flow Policy Author role can only apply policies to existing categories by design.

NEW QUESTION 51
A junior network operator is assigned two predefined roles in Prism Central…
Role A: Prism Viewer
Role B: VPC Admin
The operator reports being able to successfully create, update, and delete Virtual Private Clouds (VPCs). However, the operator is unable to create a VM into the VPC.
How does Prism Central determine the operator’s effective permissions?

The system applies the principle of “most privilege,” granting the highest level of access from any assigned role.

The permissions of the VPC Admin role override the more restrictive Prism Viewer role.

The Prism Viewer role’s permissions take precedence, preventing any write operations from the VPC Admin role.

The permissions are the union of both roles, granting VPC management rights and global read-only access.

NEW QUESTION 52
An enterprise has deployed a VPC called FinanceVPC using Nutanix Flow Virtual Networking. The Finance team needs the following connectivity:
Internal servers in the VPC must reach an on-premises corporate data-center via a point-to-point encrypted link.
Some servers in the VPC must also access the public internet with source NAT and receive inbound access via floating IPs.
The corporate network uses overlapping IP space with other VPCs in the environment, so address translation is necessary for those workloads.
The networking design must support routing via BGP for future site expansions and provide low-latency north-south connectivity.
Which actions should the administrator take to satisfy this requirement?

Use two No-NAT External Networks-one for the on-prem link and one for Internet access; configure static routes for both without NAT.

Use a single No-NAT External Network for both on-prem and Internet access; configure BGP and direct routing out to the internet without NAT.

Use a No-NAT External Network for the on-premises link and a NAT External Network for Internet access. Configure a VPN tunnel to the on-premises location and enable BGP on the VPC router for the on-premises link.

Use a single NAT External Network for both the on-prem link and Internet access; configure a default route to the external network and enable SNAT and floating IPs for all traffic.

Nutanix NCP-NS Exam Syllabus Topics:

Topic	Details
Topic 1	Troubleshoot Flow Virtual Networking: Covers diagnosing and resolving connectivity failures, BGP issues, gateway health problems, and interpreting alerts and logs related to virtual networking components.
Topic 2	Configure Flow Virtual Networking: Covers creating and managing VPCs, overlay networks, external connectivity options, BGP peering, load balancing, and policy based routing within Nutanix Flow Virtual Networking.
Topic 3	Troubleshoot Flow Network Security: Covers identifying policy-related traffic issues, analyzing security hit logs and audit logs, and troubleshooting identity based policy failures tied to Active Directory group mapping.
Topic 4	Configure Flow Network Security: Covers analyzing application traffic flows, creating and configuring isolation, application, and identity based security policies, and managing policy lifecycle modes in Flow Network Security.
Topic 5	Deploy and Upgrade a Flow Environment: Covers preparing clusters for Flow Network Security and Virtual Networking, managing upgrade paths and dependencies, configuring virtual switches and MTU, and administering user roles and RBAC permissions.

New NCP-NS Exam Dumps with High Passing Rate: https://www.prepawaytest.com/Nutanix/NCP-NS-practice-exam-dumps.html

Nutanix NCP-NS Exam Syllabus Topics:

Leave a Reply Cancel reply