Nutanix NCP-NS-7.5問題集で必ず試験合格させる [Q29-Q52]

Nutanix NCP-NS-7.5問題集で必ず試験合格させる

NCP-NS-7.5試験問題（更新されたのは2026年）100%リアル問題解答

質問 # 29
A customer wants to migrate VMs from a VLAN Basic Subnet to an Overlay Subnet with the same IP prefix.
Which migration approach ensures minimal disruption?

• A. Perform cold migration, acknowledging that ingress/egress connections will not be preserved.
• B. Create a Layer 2 connectivity between the subnets and perform live migration.
• C. Change IPAM mode to unmanaged to allow manual IP assignment.
• D. Enable trunk mode on VLAN to allow multiple subnets on the same interface.

正解：B

解説：
From a Nutanix exam perspective, this question is really testing whether the administrator understands the control point that actually governs the behavior shown in the scenario. The correct response is D, meaning
"Create a Layer 2 connectivity between the subnets and perform live migration.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario.
Operationally, Flow Virtual Networking should be checked from the control plane outward: gateway health, peering state, route advertisement, ERP coverage, external path, and MTU when encapsulation is involved.
Seen from a design perspective, the correct answer is the least ambiguous and most supportable implementation path inside Prism Central and AHV. Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. That is the underlying Nutanix principle being validated: solve the issue at the feature that owns the behavior, not by changing unrelated infrastructure settings that happen to sound network-oriented.

質問 # 30
An administrator needs to ensure all web traffic (HTTP/HTTPS) from a specific subnet (10.100.20.0/24) is redirected through a third-party virtual firewall inside the VPC for Layer 7 inspection before reaching the internet. The firewall VM has an IP of 10.100.30.5 and is connected to a different subnet. What should be done to enforce this specific traffic path?

• A. Create a Network Policy with a high priority with the source 10.100.20.0/24, destination of 10.100.30.5 on port 80 & 443.
• B. Move the Firewall VM into the same subnet and set the default GW of the web servers to 10.100.30.5.
• C. Configure a Policy-Based Route (PBR) on the VPC with a re-route IP 10.100.30.5.
• D. Create a FNS policy with an allow rule for the FW IP 10.100.30.5.

正解：C

解説：
This item is best solved by thinking like an operator in Prism Central: first identify whether the problem is design, control-plane state, or policy logic, then pick the option tied to that layer. The correct response is A, meaning "Configure a Policy-Based Route (PBR) on the VPC with a re-route IP 10.100.30.5.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. In practice, this falls into virtual network design: VPC structure, subnet type, external network behavior, routing intent, and address exposure are what determine the result.
Seen from a design perspective, the correct answer is the least ambiguous and most supportable implementation path inside Prism Central and AHV. Notice that B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. That is the underlying Nutanix principle being validated: solve the issue at the feature that owns the behavior, not by changing unrelated infrastructure settings that happen to sound network-oriented.

質問 # 31
An administrator finds that App tier VMs cannot connect to the Database tier on port 3306, and Flow logs show the traffic is being denied by a security policy. The Web tier communicates normally. What should the administrator do to allow the App tier to access the Database tier?

• A. Enable NAT for the Database tier to allow connections from the App tier.
• B. Change the Database tier subnet to match the App tier subnet.
• C. Update the microsegmentation policy in Nutanix Flow to allow App - > Database traffic on port 3306.
• D. Delete all existing Flow policies and recreate them from scratch.

正解：C

解説：
A reliable method here is to translate the scenario into Nutanix terms-VPC routing, external connectivity, policy scope, identity mapping, or upgrade readiness-and then choose the answer that directly addresses that domain. The correct response is A, meaning "Update the microsegmentation policy in Nutanix Flow to allow App - > Database traffic on port 3306.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. From a troubleshooting standpoint, the validation path is policy scope first, then categories or identity mapping, then hitlog evidence, service definition, and finally policy precedence.
In other words, this is less about broad infrastructure suspicion and more about finding the exact Nutanix decision point that explains the behavior. Notice that B is a disruptive action and does not address the actual control-plane or policy requirement being tested. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. For exam preparation, remember that Nutanix usually separates discovery from enforcement, routing from NAT, and access policy from identity mapping. Choosing the layer that truly owns the function is what leads to the right answer.

質問 # 32
An administrator is configuring a Nutanix environment for Flow Network Security Next-Gen. Where should the MTU be set to ensure that Geneve encapsulation overhead is properly accounted for?

• A. On the virtual switch within Prism Central
• B. On the AHV host's physical network interfaces
• C. On the upstream virtual router
• D. On the CVM's virtual network interfaces

正解：B

解説：
From a Nutanix exam perspective, this question is really testing whether the administrator understands the control point that actually governs the behavior shown in the scenario. The correct response is B, meaning
"On the AHV host's physical network interfaces". MTU planning matters because encapsulation adds overhead. When overlay, Geneve, VXLAN, or IPSec is present, a path that looks healthy at 1500 bytes can still fragment or drop larger frames unless the underlay and endpoints are sized correctly. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. By contrast, A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. The key takeaway is that Flow is intentionally modular. Networking objects determine reachability, security objects determine permission, and lifecycle steps determine supportability. Mixing those layers usually produces the distractor answers. A strong exam habit is to ask which Nutanix construct would have to.

質問 # 33
What must an administrator do before disabling the Network Controller?

• A. Once enabled, the Network controller cannot be disabled.
• B. Delete VLAN Basic Subnets.
• C. Convert external subnets into VLAN Basic networks.
• D. Delete all external subnets and VPCs which are in-use.

正解：D

解説：
This item is best solved by thinking like an operator in Prism Central: first identify whether the problem is design, control-plane state, or policy logic, then pick the option tied to that layer. The correct response is D, meaning "Delete all external subnets and VPCs which are in-use.". The Network Controller supplies the control-plane services required for Flow Virtual Networking. Without it, Prism Central cannot build and manage overlays, gateways, and related virtual networking constructs consistently across the cluster. In lifecycle terms, Nutanix expects administrators to respect prerequisites, compatibility, and dependency order before enabling or upgrading Flow-related services.
Seen from a design perspective, the correct answer is the least ambiguous and most supportable implementation path inside Prism Central and AHV. Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. Seen operationally, the correct response is the least disruptive and most deterministic one. It changes the exact Nutanix setting that governs the outcome instead of introducing workarounds elsewhere in the stack.

質問 # 34
Which policy mode records traffic without enforcing rule actions?

• A. Monitor
• B. Isolate
• C. Enforce
• D. Save

正解：A

解説：
The clean way to read this scenario is to separate what is merely present in the environment from the single Nutanix construct that actually satisfies the requirement. The correct response is B, meaning "Monitor". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions.
Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. In practice, administrators who anchor their decisions to Prism Central constructs-such as VPCs, external networks, ERPs, categories, and policy modes-arrive at the correct answer faster and avoid unnecessary changes.

質問 # 35
An administrator needs to delegate the management of security policies to a dedicated SecOps team. To enforce the principle of least privilege, the administrator assigns the predefined Flow Policy Author role to a user on the team. The user confirms they can create, monitor, and enforce security policies. However, when attempting to build a new application security policy for a set of newly deployed VMs, the user reports they are unable to create a new category to group these VMs. The option is not available in the Prism Central UI.
Which statement explains this behavior?

• A. The Flow Policy Author role can only apply policies to existing categories by design.
• B. The user is missing the Flow Admin role, which is required for category management.
• C. The Flow Policy Author role must be cloned into a custom role before it can be used.
• D. The user's role must be assigned with a scope for the specific projects they manage.

正解：B

解説：
A reliable method here is to translate the scenario into Nutanix terms-VPC routing, external connectivity, policy scope, identity mapping, or upgrade readiness-and then choose the answer that directly addresses that domain. The correct response is C, meaning "The user is missing the Flow Admin role, which is required for category management.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions.
Notice that A sounds plausible, but it does not align with the specific Flow policy object or precedence rule that controls this case. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. In practice, administrators who anchor their decisions to Prism Central constructs-such as VPCs, external networks, ERPs, categories, and policy modes-arrive at the correct answer faster and avoid unnecessary changes.

質問 # 36
While configuring a new security policy in a Nutanix microsegmentation environment, an administrator wants the policy to remain flexible even if virtual machines change subnets or obtain new IP addresses. Which configuration approach should the administrator use when defining the policy scope?

• A. Use VM categories to define the secured and allowed entities.
• B. Configure the policy only on specific VLAN IDs.
• C. Apply the policy after setting static routes for each VM.
• D. Assign IP addresses manually to all VMs included in the policy.

正解：A

解説：
This item is best solved by thinking like an operator in Prism Central: first identify whether the problem is design, control-plane state, or policy logic, then pick the option tied to that layer. The correct response is B, meaning "Use VM categories to define the secured and allowed entities.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. A strong exam habit is to ask which Nutanix construct would have to change for the symptom or requirement to change. That mental shortcut usually separates the real answer from distractors that mention generic networking steps, disruptive resets, or unrelated configuration objects. Notice that A sounds plausible, but it does not align with the specific Flow policy object or precedence rule that controls this case. C sounds plausible, but it does not align with the specific Flow policy object or precedence rule that controls this case. In practice, administrators who anchor their decisions to Prism Central constructs-such as VPCs,.

質問 # 37
An administrator is building a new VPC in Prism Central to isolate a test environment. The administrator plans to connect it to an external network later, but they want to complete the initial creation first. Which configuration items are the minimum required to successfully create the VPC?

• A. VPC name and one Overlay Subnet
• B. VPC name and Transit VPC toggle switch
• C. VPC name and one External Access VLAN
• D. VPC name and cluster selection

正解：C

解説：
The clean way to read this scenario is to separate what is merely present in the environment from the single Nutanix construct that actually satisfies the requirement. The correct response is A, meaning "VPC name and one External Access VLAN". A Transit VPC acts as the routing hub for spoke VPCs and is commonly used when administrators want shared services or inter-VPC communication without pushing route complexity into the physical network. In practice, this falls into virtual network design: VPC structure, subnet type, external network behavior, routing intent, and address exposure are what determine the result. A strong exam habit is to ask which Nutanix construct would have to change for the symptom or requirement to change. That mental shortcut usually separates the real answer from distractors that mention generic networking steps, disruptive resets, or unrelated configuration objects. Notice that B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. The key takeaway is that Flow is.

質問 # 38
An administrator notices that several VMs in a Nutanix AHV cluster are intermittently losing network connectivity. In Prism Central, a critical alert appears: "Network Function VM (NFVM) packet processing delays" What is the next step that the administrator should take for this issue?

• A. Disable all Flow policies on the cluster to eliminate microsegmentation as the cause.
• B. Reboot the affected VMs to re-establish virtual NIC connections.
• C. Increase the MTU size on all virtual switches to improve packet throughput.
• D. Review the Alerts and Events in Prism Central to confirm if the affected host shows NIC or uplink errors.

正解：D

解説：
A reliable method here is to translate the scenario into Nutanix terms-VPC routing, external connectivity, policy scope, identity mapping, or upgrade readiness-and then choose the answer that directly addresses that domain. The correct response is A, meaning "Review the Alerts and Events in Prism Central to confirm if the affected host shows NIC or uplink errors.". MTU planning matters because encapsulation adds overhead.
When overlay, Geneve, VXLAN, or IPSec is present, a path that looks healthy at 1500 bytes can still fragment or drop larger frames unless the underlay and endpoints are sized correctly. Operationally, Flow Virtual Networking should be checked from the control plane outward: gateway health, peering state, route advertisement, ERP coverage, external path, and MTU when encapsulation is involved.
Notice that B is a disruptive action and does not address the actual control-plane or policy requirement being tested. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. The key takeaway is that Flow is intentionally modular. Networking objects determine reachability, security objects determine permission, and lifecycle steps determine supportability.
Mixing those layers usually produces the distractor answers.

質問 # 39
An administrator has been tasked with configuring virtual switches and setting the appropriate MTU size for a Nutanix cluster to optimize network performance. The cluster needs to support high-throughput traffic between VMs and ensure compatibility with external networks. The administrator needs to configure the virtual switches and MTU size to enable jumbo frames while ensuring that all nodes and network components are properly aligned to prevent packet loss or fragmentation. What is the first step to configure the virtual switches and MTU size in a Nutanix cluster for optimal network performance?

• A. Set the MTU size to 1500 on all nodes and virtual switches for compatibility with external networks.
• B. Set the MTU size to 1500 on the Nutanix virtual switches and configure a separate VLAN for MTU traffic.
• C. Enable multicast filtering on the virtual switches to optimize MTU configuration.
• D. Configure the MTU size to 9000 on all nodes and virtual switches, and verify that all physical network switches support jumbo frames.

正解：D

解説：
What makes this a strong certification question is that several answers look technically related, but only one aligns with the exact behavior of Flow networking or Flow security. The correct response is D, meaning
"Configure the MTU size to 9000 on all nodes and virtual switches, and verify that all physical network switches support jumbo frames.". MTU planning matters because encapsulation adds overhead. When overlay, Geneve, VXLAN, or IPSec is present, a path that looks healthy at 1500 bytes can still fragment or drop larger frames unless the underlay and endpoints are sized correctly. In practice, this falls into virtual network design: VPC structure, subnet type, external network behavior, routing intent, and address exposure are what determine the result. A strong exam habit is to ask which Nutanix construct would have to change for the symptom or requirement to change. That mental shortcut usually separates the real answer from distractors that mention generic networking steps, disruptive resets, or unrelated configuration objects. Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a.

質問 # 40
A new multi-tier application is being deployed across several subnets in a Nutanix environment. The security team wants to create a Flow Network Security Policy to restrict traffic between the tiers, but the complete matrix of required network ports and protocols is not fully documented. Which strategy should the team employ first to accurately capture the necessary communication patterns without risking application outage?

• A. Create broad Security Policy to permit all TCP traffic between the tiers to ensure connectivity.
• B. Apply a Security Policy in Enforce mode adding the required flows as they appear in the flow logs.
• C. Apply a Security policy in Monitor mode to discover all traffic between the application tiers.
• D. Create an IPFIX export of all the application traffic and monitor all traffic for 48 hours.

正解：C

質問 # 41
Which two options are supported as a Secured Entity in Flow Network Security Application Policies?
(Choose two.)

• A. VPC Category
• B. VG Category
• C. vNIC Category
• D. Subnet Category

正解：A、D

解説：
A reliable method here is to translate the scenario into Nutanix terms-VPC routing, external connectivity, policy scope, identity mapping, or upgrade readiness-and then choose the answer that directly addresses that domain. The correct response is AC, which corresponds to Subnet Category and VPC Category. The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions.
Seen from a design perspective, the correct answer is the least ambiguous and most supportable implementation path inside Prism Central and AHV. Notice that B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. D does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. That is the underlying Nutanix principle being validated: solve the issue at the feature that owns the behavior, not by changing unrelated infrastructure settings that happen to sound network-oriented.

質問 # 42
An administrator is designing a new Transit VPC to service multiple Tenant VPCs. While adding subnets, the administrator must choose the correct network type supported by Flow Virtual Networking for this VPC.
Which network type is supported for subnets inside a Transit VPC in Flow Virtual Networking?

• A. VLAN subnets
• B. Overlay subnets
• C. VLAN Basic subnets
• D. VXLAN subnets

正解：B

解説：
The most professional way to evaluate this question is to map the symptom to the Nutanix feature responsible for that function rather than reacting to secondary details in the prompt. The correct response is A, meaning
"Overlay subnets". A Transit VPC acts as the routing hub for spoke VPCs and is commonly used when administrators want shared services or inter-VPC communication without pushing route complexity into the physical network. In practice, this falls into virtual network design: VPC structure, subnet type, external network behavior, routing intent, and address exposure are what determine the result.
In other words, this is less about broad infrastructure suspicion and more about finding the exact Nutanix decision point that explains the behavior. Notice that B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. That is the underlying Nutanix principle being validated: solve the issue at the feature that owns the behavior, not by changing unrelated infrastructure settings that happen to sound network-oriented.

質問 # 43
In a Nutanix deployment, when is the Network Controller automatically enabled?

• A. When the Network Controller is enabled on a Hyper-V cluster
• B. When the Network Controller is manually configured from the Prism Central settings page
• C. When the X-Large Prism Central deployment is installed or upgraded
• D. When the Small Prism Central deployment is scaled out to three PCVM's

正解：D

解説：
A reliable method here is to translate the scenario into Nutanix terms-VPC routing, external connectivity, policy scope, identity mapping, or upgrade readiness-and then choose the answer that directly addresses that domain. The correct response is A, meaning "When the Small Prism Central deployment is scaled out to three PCVM's". The Network Controller supplies the control-plane services required for Flow Virtual Networking.
Without it, Prism Central cannot build and manage overlays, gateways, and related virtual networking constructs consistently across the cluster. In lifecycle terms, Nutanix expects administrators to respect prerequisites, compatibility, and dependency order before enabling or upgrading Flow-related services.
Seen from a design perspective, the correct answer is the least ambiguous and most supportable implementation path inside Prism Central and AHV. Notice that B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. The key takeaway is that Flow is intentionally modular. Networking objects determine reachability, security objects determine permission, and lifecycle steps determine supportability. Mixing those layers usually produces the distractor answers.

質問 # 44
After creating a BGP session in Flow Virtual Networking, the session status remains down. Which log should an administrator use first in Prism Central to troubleshoot the issue?

• A. BGP Gateway system logs from the CVM
• B. Routing Protocol Logs for the specific BGP session
• C. Network and Security event logs related to connectivity changes
• D. Prism Central task execution logs

正解：B

解説：
From a Nutanix exam perspective, this question is really testing whether the administrator understands the control point that actually governs the behavior shown in the scenario. The correct response is C, meaning
"Routing Protocol Logs for the specific BGP session". With BGP in Flow Virtual Networking, route exchange depends on both gateway objects and a correctly defined peering session. A healthy gateway alone is not enough; the session, peer parameters, and advertised prefixes must all align. Operationally, Flow Virtual Networking should be checked from the control plane outward: gateway health, peering state, route advertisement, ERP coverage, external path, and MTU when encapsulation is involved.
Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. In practice, administrators who anchor their decisions to Prism Central constructs-such as VPCs, external networks, ERPs, categories, and policy modes-arrive at the correct answer faster and avoid unnecessary changes.

質問 # 45
Exhibit:

An administrator needs to setup a Syslog server to capture the Flow Network Security Hit logs. Which module name should be selected?

• A. Flow Service Logs
• B. Audit
• C. Security Policy Hit logs
• D. API Audit

正解：C

解説：
The clean way to read this scenario is to separate what is merely present in the environment from the single Nutanix construct that actually satisfies the requirement. The correct response is C, meaning "Security Policy Hit logs". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. A strong exam habit is to ask which Nutanix construct would have to change for the symptom or requirement to change. That mental shortcut usually separates the real answer from distractors that mention generic networking steps, disruptive resets, or unrelated configuration objects.
Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. That is the underlying Nutanix principle being validated: solve the issue at the feature that owns the behavior, not by changing unrelated infrastructure settings that happen to sound network-oriented.

質問 # 46
An administrator has observed the following message: Which two statements most accurately describe the security hitlog captured above? (Choose two.)

• A. 86.108.190.23 is sending a packet on UDP 123.
• B. The source ip address is 10.38.174.5 and source port is TCP/123.
• C. 10.38.174.57 is sending a packet destined to UDP 123.
• D. This is a security hit log on the rule name "Production-External-WebTier".

正解：B、C

解説：
What makes this a strong certification question is that several answers look technically related, but only one aligns with the exact behavior of Flow networking or Flow security. The correct response is BD, which corresponds to The source ip address is 10.38.174.5 and source port is TCP/123. and 10.38.174.57 is sending a packet destined to UDP 123.. Policy hitlogs provide precise evidence of what Flow evaluated, including source, destination, protocol, and rule outcome. In troubleshooting, that makes hitlogs one of the best places to confirm whether traffic matched an allow or deny decision. From a troubleshooting standpoint, the validation path is policy scope first, then categories or identity mapping, then hitlog evidence, service definition, and finally policy precedence. Seen from a design perspective, the correct answer is the least ambiguous and most supportable implementation path inside Prism Central and AHV. Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. The key takeaway is that.

質問 # 47
An administrator creates an Isolation Policy in Prism Central to prevent communication between the Prod and Staging environments. The policy is in Enforce mode... but VMs in the two environments can still communicate. Which configuration issue most likely explains why the Isolation Policy is not blocking the traffic?

• A. Isolation Policies restrict north-south communication when associated with a VPC gateway, not east- west traffic between categories.
• B. The Isolation Policy does not specify any services/ports, so no traffic is matched for enforcement.
• C. The Prod and Staging categories have not been assigned to the VMs, so the policy does not apply.
• D. An Application Policy allows traffic between the same categories, overriding this policy.

正解：D

解説：
A reliable method here is to translate the scenario into Nutanix terms-VPC routing, external connectivity, policy scope, identity mapping, or upgrade readiness-and then choose the answer that directly addresses that domain. The correct response is C, meaning "An Application Policy allows traffic between the same categories, overriding this policy.". Enforce mode is the stage where Flow stops acting like a discovery tool and starts behaving like a stateful control point. Traffic allowed by the policy continues normally, while traffic that does not match an allowed rule is denied according to policy logic. An Isolation Policy is built to stop communication between defined groups. Unlike an application policy, it is intended to create a hard boundary, making it the correct choice when the requirement is "no traffic between these entities." From a troubleshooting standpoint, the validation path is policy scope first, then categories or identity mapping, then hitlog evidence, service definition, and finally policy precedence. By contrast, A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and.

質問 # 48
An administrator needs to use Prism Central to identify a subnet belonging to a VPC. How can the administrator identify networks associated with a VPC within Prism Central?

• A. There will be a valid IP Prefix for the subnet.
• B. The subnet will reference multiple clusters.
• C. The subnet will have a non-zero VLAN ID.
• D. The subnet will be identified as type Overlay.

正解：D

解説：
The most professional way to evaluate this question is to map the symptom to the Nutanix feature responsible for that function rather than reacting to secondary details in the prompt. The correct response is D, meaning
"The subnet will be identified as type Overlay.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. In practice, this falls into virtual network design: VPC structure, subnet type, external network behavior, routing intent, and address exposure are what determine the result. By contrast, A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. The key takeaway is that Flow is intentionally modular. Networking objects determine reachability, security objects determine permission, and lifecycle steps determine supportability. Mixing those layers usually produces the distractor answers. A strong exam habit is to ask which Nutanix construct would have to change for the symptom or requirement to change. That mental shortcut.

質問 # 49
A VPC admin creates a policy to allow traffic between two IP subnets but forgets to enable reverse direction.
What happens in this scenario?

• A. Policy is rejected by Prism Central during validation.
• B. Traffic flows bidirectionally because policies are stateful by default.
• C. Traffic is blocked completely because the policy is invalid.
• D. Traffic flows only in one direction, blocking return traffic.

正解：D

解説：
The most professional way to evaluate this question is to map the symptom to the Nutanix feature responsible for that function rather than reacting to secondary details in the prompt. The correct response is D, meaning
"Traffic flows only in one direction, blocking return traffic.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. Operationally, Flow Virtual Networking should be checked from the control plane outward: gateway health, peering state, route advertisement, ERP coverage, external path, and MTU when encapsulation is involved.
Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. The key takeaway is that Flow is intentionally modular. Networking objects determine reachability, security objects determine permission, and lifecycle steps determine supportability. Mixing those layers usually produces the distractor answers.

質問 # 50
An administrator is building a VPC... VPC CIDR: 10.10.0.0/16 Subnet CIDR: 10.10.10.0/24 "Ext_Net_Ext" (NAT): 192.168.1.0/24 "Ext_Net_Internal" (Routed): 172.16.1.0/24 The on-premises application server has an IP address of 172.16.2.50/24. A VM (10.10.10.100) in the VPC Subnet can reach the internet but cannot reach the on-premises server. Which static route needs to be added to the VPC route table to resolve this?

• A. Destination prefix: 172.16.2.0/24, Next-Hop: Ext_Net_Internal
• B. Destination Prefix: 10.10.0.0/16, Next-Hop: Ext_Net_Internal
• C. Destination prefix: 172.16.2.0/24, Next-Hop: Ext_Net_Ext
• D. Destination prefix: 192.168.1.0/24 Next-Hop: Ext_Net_Ext

正解：A

解説：
The most professional way to evaluate this question is to map the symptom to the Nutanix feature responsible for that function rather than reacting to secondary details in the prompt. The correct response is D, meaning
"Destination prefix: 172.16.2.0/24, Next-Hop: Ext_Net_Internal". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. Operationally, Flow Virtual Networking should be checked from the control plane outward: gateway health, peering state, route advertisement, ERP coverage, external path, and MTU when encapsulation is involved.
Seen from a design perspective, the correct answer is the least ambiguous and most supportable implementation path inside Prism Central and AHV. Notice that A is not appropriate because NAT changes addressing behavior and does not solve the routing or policy condition described in the scenario. B is not appropriate because NAT changes addressing behavior and does not solve the routing or policy condition described in the scenario. Seen operationally, the correct response is the least disruptive and most deterministic one. It changes the exact Nutanix setting that governs the outcome instead of introducing workarounds elsewhere in the stack.

質問 # 51
Refer to Exhibit:

How should an Application Policy be created whose rules apply only to vNIC1 of VM1?

• A. Add Cat:SubnetA and Cat:VM1 as secured entity in the Application Policy.
• B. Create an Entity Group with Cat:SubnetA, Cat:SubnetB and Cat:VM1 and then add the Entity Group as Secured Entity to the Application Policy.
• C. Add Cat:SubnetA as secured entity in the Application Policy.
• D. Create an Entity Group with Cat:SubnetA and Cat:VM1 and then add the Entity Group as Secured Entity to the Application Policy.

正解：D

解説：
This item is best solved by thinking like an operator in Prism Central: first identify whether the problem is design, control-plane state, or policy logic, then pick the option tied to that layer. The correct response is A, meaning "Create an Entity Group with Cat:SubnetA and Cat:VM1 and then add the Entity Group as Secured Entity to the Application Policy.". Application Policies are the most appropriate way to model legitimate workload communication in a tiered application. They allow administrators to express which sources, destinations, and services are required instead of relying on broad network access. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. In other words, this is less about broad infrastructure suspicion and more about finding the exact Nutanix decision point that explains the behavior. Notice that B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. That is.

質問 # 52
......

合格させるNutanix NCP-NS-7.5試験最速合格にはPassTest：https://www.passtest.jp/Nutanix/NCP-NS-7.5-shiken.html