Printable & Easy to Use NCP-NS Dumps 100% Same Q&A In Your Real Exam [Q22-Q40]

admin NCP-NS Nutanix October 16, 2026

Rate this post

Printable & Easy to Use NCP-NS Dumps 100% Same Q&A In Your Real Exam

NCP-NS Practice Test Give You First Time Success with 100% Money Back Guarantee!

Nutanix NCP-NS Exam Syllabus Topics:

Section	Weight	Objectives
Topic 1: Troubleshoot Flow Virtual Networking	15%	– Diagnose and resolve connectivity and routing issues – Interpret alerts, logs and IPFIX data – Troubleshoot BGP and gateway health problems
Topic 2: Configure Flow Network Security	25%	– Analyze application traffic flows – Integrate with Active Directory and external services – Create and manage security policies (isolation, application, identity-based) – Configure policy lifecycle and operating modes
Topic 3: Configure Flow Virtual Networking	30%	– Create and manage VPCs and overlay networks – Configure load balancing and policy-based routing – Implement BGP peering and routing policies – Configure and manage external networks and connectivity
Topic 4: Deploy and Upgrade a Flow Environment	20%	– Prepare cluster for Flow Virtual Networking and Flow Network Security – Manage user roles and RBAC permissions – Configure virtual switches and MTU settings – Manage upgrade paths and dependencies
Topic 5: Troubleshoot Flow Network Security	10%	– Analyze hit logs and audit logs – Troubleshoot identity-based policy failures – Resolve policy conflicts and traffic drops

QUESTION 22
Refer to the exhibit.

An organization uses an FNS-NG Service Chain to steer application traffic through a pair of third-party firewall Network Function VMs operating in Active/Standby mode. Users suddenly report that all application access is blocked. The administrator reviews Prism Central -> Network & Security -> Network Functions, where the summary shown in the exhibit is displayed. Additional information: Alert: “Network Function ‘PANW Service Insertion’ virtual NIC pair(s) are unhealthy.” Both firewall VMs are powered on and reachable. The security policy using the service chain has not been changed. Based on the exhibit and findings, what is the most likely cause of the traffic outage?

The service-chain health check failed to reroute sessions to the healthy firewall.

One of the Network Function vNIC pairs lost dataplane connectivity, interrupting traffic until health is stabilized.

Firewall policy synchronization was not configured when the standby firewall became active.

The inbound vNIC on SE-PA-VM Firewall-2 failed, preventing redirected packets from reaching the firewall.

QUESTION 23
A junior network operator is assigned two predefined roles in Prism Central…
Role A: Prism Viewer
Role B: VPC Admin
The operator reports being able to successfully create, update, and delete Virtual Private Clouds (VPCs). However, the operator is unable to create a VM into the VPC.
How does Prism Central determine the operator’s effective permissions?

The system applies the principle of “most privilege,” granting the highest level of access from any assigned role.

The permissions of the VPC Admin role override the more restrictive Prism Viewer role.

The Prism Viewer role’s permissions take precedence, preventing any write operations from the VPC Admin role.

The permissions are the union of both roles, granting VPC management rights and global read-only access.

QUESTION 24
Refer to th exhibit.

An administrator needs to setup a Syslog server to capture the Flow Network Security Hit logs. Which module name should be selected?

Flow Service Logs

API Audit

Security Policy Hit logs

Audit

QUESTION 25
An administrator plans to upgrade the Network Controller in a Flow Virtual Networking deployment. The environment includes multiple AHV clusters managed by Prism Central.
Which prerequisite must be verified before upgrading the Network Controller?

Flow Network Security must be upgraded to the target release before upgrading the Network Controller.

Each cluster must be running the Flow Network Security version specified as compatible with the target Network Controller release.

Each cluster must be running AHV versions compatible with the target Network Controller release.

Network Controller Prism Element upgrades must be applied before before Network Controller Prism Central upgrades can be applied.

QUESTION 26
An administrator is building a VPC…
VPC CIDR: 10.10.0.0/16
Subnet CIDR: 10.10.10.0/24
“Ext_Net_Ext” (NAT): 192.168.1.0/24
“Ext_Net_Internal” (Routed): 172.16.1.0/24
The on-premises application server has an IP address of 172.16.2.50/24. A VM (10.10.10.100) in the VPC Subnet can reach the internet but cannot reach the on-premises server.
Which static route needs to be added to the VPC route table to resolve this?

Destination prefix: 172.16.2.0/24, Next-Hop: Ext_Net_Ext

Destination Prefix: 10.10.0.0/16, Next-Hop: Ext_Net_Internal

Destination prefix: 192.168.1.0/24 Next-Hop: Ext_Net_Ext

Destination prefix: 172.16.2.0/24, Next-Hop: Ext_Net_Internal

QUESTION 27
In Nutanix Flow, which action transitions a security policy from observing traffic to actively enforcing the rules?

Disable Traffic Visualization for the policy.

Enforce policy by setting its scope.

Change policy mode from Monitor to Save.

Change policy mode from Monitor to Enforce.

QUESTION 28
Which step is required to prepare an AHV cluster for Flow Network Security Next-Gen?

Enable microsegmentation and network controller on the cluster.

Assign static IP addresses to all VMs before enabling Flow.

Enable microsegmentation policies on all VM groups before enabling Flow.

Disable all existing VLANs in the cluster to allow Flow to control traffic.

QUESTION 29
Which policy is used to isolate a compromised VM in the most efficient way possible?

Isolation Policy

Quarantine Policy

Shared Service Policy

Application Policy

QUESTION 30
Refer to the exhibit.

How should an Application Policy be created whose rules apply only to vNIC1 of VM1?

Create an Entity Group with Cat:SubnetA and Cat:VM1 and then add the Entity Group as Secured Entity to the Application Policy.

Add Cat:SubnetA as secured entity in the Application Policy.

Create an Entity Group with Cat:SubnetA, Cat:SubnetB and Cat:VM1 and then add the Entity Group as Secured Entity to the Application Policy.

Add Cat:SubnetA and Cat:VM1 as secured entity in the Application Policy.

QUESTION 31
An administrator has deployed a VPC for a multi-tier application on Nutanix AHV. The Web tier requires public internet access, while the App and Database tiers must remain private and isolated.
Which steps should the administrator take to configure the external network correctly?

Use overlay networks for external access instead of configuring a VPC external network.

Assign external IPs to all VMs in the VPC to simplify connectivity.

Configure an external network for the Web tier subnet and leave App and Database tiers private.

Attach a single external network to the VPC and allow all tiers unrestricted internet access.

QUESTION 32
An administrator creates an Isolation Policy in Prism Central to prevent communication between the Prod and Staging environments.
The policy is in Enforce mode… but VMs in the two environments can still communicate.
Which configuration issue most likely explains why the Isolation Policy is not blocking the traffic?

The Isolation Policy does not specify any services/ports, so no traffic is matched for enforcement.

Isolation Policies restrict north-south communication when associated with a VPC gateway, not east-west traffic between categories.

An Application Policy allows traffic between the same categories, overriding this policy.

The Prod and Staging categories have not been assigned to the VMs, so the policy does not apply.

QUESTION 33
While configuring a new security policy in a Nutanix microsegmentation environment, an administrator wants the policy to remain flexible even if virtual machines change subnets or obtain new IP addresses.
Which configuration approach should the administrator use when defining the policy scope?

Configure the policy only on specific VLAN IDs.

Use VM categories to define the secured and allowed entities.

Apply the policy after setting static routes for each VM.

Assign IP addresses manually to all VMs included in the policy.

QUESTION 34
An administrator creates a VPC named AppVPC1 in Nutanix Cloud Infrastructure (NCI) with separate subnets for the web, app, and database tiers. The database subnet must remain isolated from external networks; however, all tiers need to communicate with each other internally.
What should the administrator configure to limit external access to only the web and app subnets?

Enable NAT Gateway on the database subnet for outbound communication.

Configure a routing policy in the VPC to deny external traffic to and from the database subnet.

Attach the web and app subnets to the external network through an AHV managed bridge.

Create Static Routes on the physical network to interconnect the VPC subnets.

QUESTION 35
An administrator configures a VPN gateway with eBGP for dynamic route exchange. After setup, routes are not advertised to the remote peer.
Which configuration is most likely missing?

DHCP options for assigning IP addresses to remote endpoints.

ASN configuration for the local gateway to identify its autonomous system.

VLAN ID alignment between local and remote networks.

Peer IP address required for establishing the BGP session.

QUESTION 36
What is the first step in preparing a Nutanix cluster for Flow Virtual Networking?

Enable the Network Controller in Prism Central.

Install the latest version of Acropolis OS (AOS) on all nodes.

Install the Nutanix Flow Controller on all cluster nodes.

Configure the VLANs on the physical network switches.

QUESTION 37
What happens when a monitored policy is enforced?

Stops logging traffic

Blocks all traffic that is not allowed

Deletes the policy hitlogs

Removes all discovered flows

QUESTION 38
After creating a BGP session in Flow Virtual Networking, the session status remains down. Which log should an administrator use first in Prism Central to troubleshoot the issue?

BGP Gateway system logs from the CVM

Prism Central task execution logs

Routing Protocol Logs for the specific BGP session

Network and Security event logs related to connectivity changes

QUESTION 39
An administrator is building a new VPC in Prism Central to isolate a test environment. The administrator plans to connect it to an external network later, but they want to complete the initial creation first.
Which configuration items are the minimum required to successfully create the VPC?

VPC name and one External Access VLAN

VPC name and Transit VPC toggle switch

VPC name and one Overlay Subnet

VPC name and cluster selection

QUESTION 40
Which policy mode records traffic without enforcing rule actions?

Enforce

Monitor

Isolate

Save

Loading …