The Realest Study Materials NCP-NS Dumps Updated Aug 04, 2026 [Q18-Q39]

Rate this post

The Realest Study Materials NCP-NS Dumps Updated Aug 04, 2026

LATEST NCP-NS Exam Practice Material

Nutanix NCP-NS Exam Syllabus Topics:

Topic	Details
Topic 1	Configure Flow Network Security: Covers analyzing application traffic flows, creating and configuring isolation, application, and identity based security policies, and managing policy lifecycle modes in Flow Network Security.
Topic 2	Troubleshoot Flow Network Security: Covers identifying policy-related traffic issues, analyzing security hit logs and audit logs, and troubleshooting identity based policy failures tied to Active Directory group mapping.
Topic 3	Troubleshoot Flow Virtual Networking: Covers diagnosing and resolving connectivity failures, BGP issues, gateway health problems, and interpreting alerts and logs related to virtual networking components.
Topic 4	Deploy and Upgrade a Flow Environment: Covers preparing clusters for Flow Network Security and Virtual Networking, managing upgrade paths and dependencies, configuring virtual switches and MTU, and administering user roles and RBAC permissions.
Topic 5	Configure Flow Virtual Networking: Covers creating and managing VPCs, overlay networks, external connectivity options, BGP peering, load balancing, and policy based routing within Nutanix Flow Virtual Networking.

NO.18 Which step is required to prepare an AHV cluster for Flow Virtual Networking?

Assign all VMs to a single VLAN before enabling Flow.

Configure static routes for all overlay networks before enabling Flow.

Disable all existing microsegmentation policies to allow virtual networking.

Ensure all CVMs have network connectivity to Prism Central.

NO.19 An administrator is building a VPC…
VPC CIDR: 10.10.0.0/16
Subnet CIDR: 10.10.10.0/24
“Ext_Net_Ext” (NAT): 192.168.1.0/24
“Ext_Net_Internal” (Routed): 172.16.1.0/24
The on-premises application server has an IP address of 172.16.2.50/24. A VM (10.10.10.100) in the VPC Subnet can reach the internet but cannot reach the on-premises server.
Which static route needs to be added to the VPC route table to resolve this?

Destination prefix: 172.16.2.0/24, Next-Hop: Ext_Net_Ext

Destination Prefix: 10.10.0.0/16, Next-Hop: Ext_Net_Internal

Destination prefix: 192.168.1.0/24 Next-Hop: Ext_Net_Ext

Destination prefix: 172.16.2.0/24, Next-Hop: Ext_Net_Internal

NO.20 Refer to the exhibit.

In the AD-VDI Departmental SecPol policy shown in the exhibit, ADGroup: Engineering is configured as a secured entity in a VDI Security Policy. Prism Central shows 2 / 2 active sessions under this group, but the administrator confirms that three Engineering users are currently logged in to persistent VDI desktops. The third user’s VM shows no ADGroup assignment in its VM details in Prism Central, even after the user has successfully logged in. All three users are members of the same AD group, and the Domain Controller event logs confirm a successful interactive login for the third user. Which condition explains why the third user’s VM is not being assigned the ADGroup: Engineering category?

The Active Directory Service account used by Prism Central is locked.

The third user’s VM has been assigned an AppType category, preventing ID-Based categorization.

The Flow Identity Service has been disabled in Prism Central for the VM the third user is logging in to.

The Flow Network Security policy scope does not include the VLAN where the third user’s VM resides.

NO.21 What does placing a policy in Monitor mode accomplish?

Visualizes discovered traffic that matches the policy.

Blocks traffic that does not match the policy.

Enables hitlogs for traffic that matches the policy.

Redirects discovered traffic to a monitoring device.

NO.22 An administrator plans to upgrade the Network Controller in a Flow Virtual Networking deployment. The environment includes multiple AHV clusters managed by Prism Central.
Which prerequisite must be verified before upgrading the Network Controller?

Flow Network Security must be upgraded to the target release before upgrading the Network Controller.

Each cluster must be running the Flow Network Security version specified as compatible with the target Network Controller release.

Each cluster must be running AHV versions compatible with the target Network Controller release.

Network Controller Prism Element upgrades must be applied before before Network Controller Prism Central upgrades can be applied.

NO.23 What must an administrator do before disabling the Network Controller?

Convert external subnets into VLAN Basic networks.

Delete VLAN Basic Subnets.

Once enabled, the Network controller cannot be disabled.

Delete all external subnets and VPCs which are in-use.

NO.24 An administrator has been tasked with configuring virtual switches and setting the appropriate MTU size for a Nutanix cluster to optimize network performance.
The cluster needs to support high-throughput traffic between VMs and ensure compatibility with external networks. The administrator needs to configure the virtual switches and MTU size to enable jumbo frames while ensuring that all nodes and network components are properly aligned to prevent packet loss or fragmentation.
What is the first step to configure the virtual switches and MTU size in a Nutanix cluster for optimal network performance?

Enable multicast filtering on the virtual switches to optimize MTU configuration.

Set the MTU size to 1500 on the Nutanix virtual switches and configure a separate VLAN for MTU traffic.

Set the MTU size to 1500 on all nodes and virtual switches for compatibility with external networks.

Configure the MTU size to 9000 on all nodes and virtual switches, and verify that all physical network switches support jumbo frames.

NO.25 In a Nutanix deployment, when is the Network Controller automatically enabled?

When the Small Prism Central deployment is scaled out to three PCVM’s

When the Network Controller is manually configured from the Prism Central settings page

When the Network Controller is enabled on a Hyper-V cluster

When the X-Large Prism Central deployment is installed or upgraded

NO.26 An administrator receives a ticket reporting unwanted traffic between production and development servers. The administrator reviews the Flow Network Security logs and finds the following:

How can the administrator resolve the issue?

Update the policy to disallow the unwanted traffic.

Move the servers to separate IP subnets.

Enable the Network Controller for the policy

Change the enforcement mode for the policy

NO.27 During a security review, the administrator confirms that the existing security policy does not explicitly allow traffic from Environment: Development to Environment: Production. A VM in the Development category was still able to reach a Production VM over IPv6.
What is the most likely cause of this behavior?

An isolation policy was incorrectly applied instead of an application policy.

The Allow All IPv6 option in the policy was selected.

The policy was misconfigured and allowed all Layer 2 broadcast traffic.

The VM was using a static IPv6 address.

NO.28 Refer to the exhibit.

How should an Application Policy be created whose rules apply only to vNIC1 of VM1?

Create an Entity Group with Cat:SubnetA and Cat:VM1 and then add the Entity Group as Secured Entity to the Application Policy.

Add Cat:SubnetA as secured entity in the Application Policy.

Create an Entity Group with Cat:SubnetA, Cat:SubnetB and Cat:VM1 and then add the Entity Group as Secured Entity to the Application Policy.

Add Cat:SubnetA and Cat:VM1 as secured entity in the Application Policy.

NO.29 An administrator is configuring a Nutanix environment for Flow Network Security Next-Gen.
Where should the MTU be set to ensure that Geneve encapsulation overhead is properly accounted for?

On the CVM’s virtual network interfaces

On the AHV host’s physical network interfaces

On the virtual switch within Prism Central

On the upstream virtual router

NO.30 An administrator needs to use Prism Central to identify a subnet belonging to a VPC.
How can the administrator identify networks associated with a VPC within Prism Central?

There will be a valid IP Prefix for the subnet.

The subnet will reference multiple clusters.

The subnet will have a non-zero VLAN ID.

The subnet will be identified as type Overlay.

NO.31 A VM with IP address 172.20.10.5 on a Subnet with CIDR 172.20.10.0/24 is unable to be routed externally from the VPC.
The VPC is successfully peered via BGP… However, when checking the BGP Session, no routes are being advertised by the VPC.
What is the most likely configuration issue?

There is no default route within the VPC to send traffic to the NAT external network.

The VM does not have a Floating IP assigned to allow external connectivity.

The VPC does not have a NO-NAT network configured to advertise the routes.

A network Policy is blocking outbound access for the VM.

NO.32 What is the first step in preparing a Nutanix cluster for Flow Virtual Networking?

Enable the Network Controller in Prism Central.

Install the latest version of Acropolis OS (AOS) on all nodes.

Install the Nutanix Flow Controller on all cluster nodes.

Configure the VLANs on the physical network switches.

NO.33 When creating a VPC, enabling the Transit VPC toggle changes the role of the VPC.
What does the Transit VPC toggle do?

Forces NAT for all external subnets

Creates a hub-and-spoke VPC for routing

Converts all Overlay subnets into VLAN subnets

Enables DHCP relay for routed subnets

NO.34 When setting up a Network Function VM for Service Insertion, an administrator needs to configure the vNICs that will be used for redirecting traffic.
What is the correct configuration for the vNICs on the Network Function VM?

Two specific Network Function vNICs must be created, one for inbound traffic and the other for outbound traffic.

A single vNIC of type Network Function is required, which handles both ingress and egress traffic.

Two Network Function vNICs are required that must be assigned static IP addresses from a managed IPAM network.

Two standard vNICs are required, one for ingress and one for egress and must be on a trunked VLAN.

NO.35 Which policy type takes highest precedence in Enforce mode?

Application

Isolation

Quarantine

Shared Service

NO.36 An administrator finds that App tier VMs cannot connect to the Database tier on port 3306, and Flow logs show the traffic is being denied by a security policy. The Web tier communicates normally.
What should the administrator do to allow the App tier to access the Database tier?

Update the microsegmentation policy in Nutanix Flow to allow App -> Database traffic on port 3306.

Delete all existing Flow policies and recreate them from scratch.

Enable NAT for the Database tier to allow connections from the App tier.

Change the Database tier subnet to match the App tier subnet.

NO.37 Which two options are supported as a Secured Entity in Flow Network Security Application Policies? (Choose two.)

Subnet Category

vNIC Category

VPC Category

VG Category

NO.38 An administrator has been tasked with upgrading the Nutanix cluster to a newer version of AOS.
The cluster is running a mix of different versions across nodes…
What is the recommended first step when upgrading a Nutanix cluster with different AOS versions across nodes?

Begin by upgrading the storage and network components to the latest version before upgrading the controller VMs.

Upgrade all nodes to the same version of AOS before proceeding with any other components.

Upgrade the Nutanix Controller VMs first to ensure compatibility with the new AOS version.

Upgrade the entire cluster at once to minimize downtime and ensure consistency.

NO.39 An administrator creates a new VPC in No NAT mode to allow VMs in a web tier to reach an external firewall.
After deployment… none of the VMs can reach external IP addresses…
Which action should the administrator take to restore routed north-south connectivity from the VPC?

Configure a Flow Security Policy to allow egress traffic from the VPC subnet.

Create an Externally Routable Prefix (ERP) entry for the overlay subnet in the VPC.

Change the VPC mode to NAT so that outbound traffic is automatically translated.

Add a default static route in each VM pointing to the external firewall’s IP address.