Nutanix Updated NCP-CI-AWS Exam Questions and Answers by arham

To add an AWS account to the NC2 console, an AWS IAM user needs to be configured with the appropriate permissions to manage the EC2 resources. The required permission for the IAM user includes full access to manage EC2 instances, volumes, and related resources.

AmazonEC2FullAccess:

This permission grants full access to all EC2 resources, including the ability to create, modify, and delete instances, volumes, security groups, and more.

Essential for NC2 operations to manage the lifecycle of EC2 instances and associated components within the AWS environment.

Why Not Other Permissions:

IAMFullAccess: Grants full access to IAM resources but not specifically needed for EC2 operations.

IAMReadOnlyAccess: Only provides read access to IAM resources, insufficient for managing EC2 instances.

AmazonEC2ReadOnlyAccess: Provides read-only access to EC2 resources, insufficient for creating or modifying instances and other resources.

AWS IAM Policies Documentation

Nutanix Cloud Clusters on AWS Administration Guide

Nutanix Best Practices for IAM User Permissions

To resolve the IP conflict issue when an EC2 instance is powered on in a subnet also used by Nutanix NC2, the administrator should block or exclude the IP address used by the NC2 VM from being assigned to EC2 instances. This can be done by configuring the IP address management (IPAM) settings to ensure that the specific IP addresses allocated to the NC2 VMs are not used by EC2 instances, preventing IP conflicts and ensuring smooth operation of both environments.

Nutanix Cloud Clusters on AWS Deployment Guide

Nutanix Support and Insights

Monitoring the health and connectivity of stretched Layer 2 networks is vital for maintaining seamless hybrid cloud operations.

In a Nutanix environment managed via Prism Central, the specific location to verify the operational status of these extensions is underNetwork and Security, specifically within theNetwork Servicessection labeledSubnet Extensions. This dashboard provides visibility into the VTEP (VXLAN Tunnel Endpoint) gateways and the specific subnets that have been extended from the on-premises environment to NC2 on AWS. Administrators can check if the tunnel is " Up " or " Down " and view performance metrics associated with the stretched segment. Ensuring the status is monitored here allows for rapid troubleshooting of connectivity issues that might prevent virtual machines from communicating across the hybrid link.

AVTEP (VXLAN Tunnel Endpoint) Gatewayshowing a status of " Down " indicates a connectivity or configuration failure within the control plane. In an NC2 environment, the gateway relies on consistent communication withPrism Central (PC)for management and synchronization, as well asNTP and DNSfor time-sync and name resolution. If the route tables in the AWS VPC are missing the necessary entries to reach these management services, the VTEP gateway will fail to initialize or maintain its heartbeat, resulting in a " Down " status. While on-premises reachability is important for traffic flow, the failure to create the extension entirely usually points to these missing internal routes that prevent the Nutanix software components from coordinating correctly within the cloud environment.