Task 13
An administrator found a CentOS VM, Cent_Down, on the cluster with a corrupted network stack. To correct the issue, the VM will need to be restored from a previous snapshot to become reachable on the network again.
VM credentials:
Username: root
Password: nutanix/4u
Restore the VM and ensure it is reachable on the network by pinging 172.31.0.1 from the VM.
Power off the VM before proceeding.

See the Explanation for step by step solution.
Explanation:
To restore the VM and ensure it is reachable on the network, you can follow these steps:
Log in to the Web Console of the cluster where the VM is running.
Click on Virtual Machines on the left menu and find Cent_Down from the list. Click on the power icon to power off the VM.
Click on the snapshot icon next to the power icon to open the Snapshot Management window.
Select a snapshot from the list that was taken before the network stack was corrupted. You can use the date and time information to choose a suitable snapshot.
Click on Restore VM and confirm the action in the dialog box. Wait for the restore process to complete.
Click on the power icon again to power on the VM.
Log in to the VM using SSH or console with the username and password provided.
Run the command ping 172.31.0.1 to verify that the VM is reachable on the network. You should see a reply from the destination IP address.
Go to VMS from the prism central gui
Select the VMand go to More -> Guest Shutdown
Go to Snapshots tab and revert to latest snapshot available
power on vm and verify if ping is working

Task 9
The application team has requested several mission-critical VMs to be configured for disaster recovery. The remote site (when added) will not be managed by Prism Central. As such, this solution should be built using the Web Console.
Disaster Recovery requirements per VM:
Mkt01
RPO: 2 hours
Retention: 5 snapshots
Fin01
RPO: 15 minutes
Retention: 7 days
Dev01
RPO: 1 day
Retention: 2 snapshots
Configure a DR solution that meets the stated requirements.
Any objects created in this item must start with the name of the VM being protected.
Note: the remote site will be added later

See the Explanation for step by step solution.
Explanation:
To configure a DR solution that meets the stated requirements, you can follow these steps:
Log in to the Web Console of the source cluster where the VMs are running.
Click on Protection Domains on the left menu and click on Create Protection Domain.
Enter a name for the protection domain, such as PD_Mkt01, and a description if required. Click Next.
Select Mkt01 from the list of VMs and click Next.
Select Schedule Based from the drop-down menu and enter 2 hours as the interval. Click Next.
Select Remote Site from the drop-down menu and choose the remote site where you want to replicate the VM.
Click Next.
Enter 5 as the number of snapshots to retain on both local and remote sites. Click Next.
Review the protection domain details and click Finish.
Repeat the same steps for Fin01 and Dev01, using PD_Fin01 and PD_Dev01 as the protection domain names, and adjusting the interval and retention values according to the requirements.

A company who offers Infrastructure as a Service needs to onboard a new customer. The new customer requires a dedicated cloud plan which tolerates two host failures.
The customer is planning to move current workloads in three waves, with three months between waves starting today:
* Wave One: 100 VMs
* Wave Two: 50 VMs
* Wave Three: 20 VMs
Workload profile is:
* vCPU: 4
* vRAM: 16 GB
* Storage: 200 GB
The service provider company needs to estimate required resources upfront, to accommodate customer requirements, considering also that:
* limit the number of total nodes
* selected system vendor HPE
* selected model DX365-10-G11-NVMe
* full-flash node (including NVMe + SSD)
* 12 months runway
Create and save the scenario as IaaS and export to the desktop, name the file IaaS-requirement.pdf Note: You must export the PDF to the desktop as IaaS-requirement.pdf to receive any credit.

See the Explanation below for detailed answer.
Explanation:
Here is the step-by-step solution to create and export the capacity planning scenario. This task is performed within Prism Central.
1. Navigate to the Planning Dashboard
* From the Prism Central main menu (hamburger icon), navigate to Operations > Planning.
2. Create and Define the Scenario
* Click the + Create Scenario button.
* In the dialog box:
* Scenario Name: IaaS
* Scenario Type: Select New Workload
* Click Create. This will open the scenario editor.
3. Configure Cluster and Runway Settings
* In the "IaaS" scenario editor, find the Runway setting (top left) and set it to 12 Months.
* Find the Cluster configuration tile and click Edit.
* Set Number of Host Failures to Tolerate to 2.
* Click Save.
4. Define the Workload Profile
* In the Workloads section, click the + Add Workload button.
* Select Create a new workload profile.
* Fill in the VM specifications:
* Workload Name: Customer-VM (or similar)
* vCPU per VM: 4
* Memory per VM: 16 GB
* Storage per VM: 200 GB
* Click Add.
5. Set the Workload Growth Plan (Waves)
* You will be returned to the main scenario editor. In the timeline section ("Workload Plan"), add the VMs:
* Wave One (Today):
* Click + Add under the "Today" column.
* Select the Customer-VM profile.
* Enter 100 VMs.
* Click Add.
* Wave Two (3 Months):
* Click the + icon on the timeline itself.
* Set the date to 3 Months from today.
* Click + Add under this new "3 Months" column.
* Select the Customer-VM profile.
* Enter 50 VMs.
* Click Add.
* Wave Three (6 Months):
* Click the + icon on the timeline.
* Set the date to 6 Months from today.
* Click + Add under this new "6 Months" column.
* Select the Customer-VM profile.
* Enter 20 VMs.
* Click Add.
6. Select the Hardware
* In the Hardware configuration tile, click Change Hardware.
* In the "Select Hardware" pane:
* Vendor: Select HPE.
* Model: Search for and select DX365-10-G11-NVMe.
* Note: This model is full-flash by definition, satisfying the requirement.
* Click Done. The planner will recalculate the required nodes.
7. Save and Export the Scenario
* Click the Save icon (floppy disk) in the top-right corner to save the IaaS scenario.
* Click the Export icon (arrow pointing down) in the top-right corner.
* Select PDF from the dropdown menu.
* A "Save As" dialog will appear.
* Navigate to the Desktop.
* Set the file name to IaaS-requirement.pdf.
* Click Save.

The security team has provided some new security requirements for cluster level security on Cluster 2.
Security requirements:
* Update the password for the root user on the Cluster 2 node to match the admin user password.
Note: The 192.168.x.x network is not available. To access a node use the host IP (172.30.0.x) from the CVM.
* Output the cluster-wide configuration of the SCMA policy to desktop\output.txt before changes are made.
* Enable the Advanced Intrusion Detection Environment (AIDE) to run on a weekly basis for the hypervisor and cvms for Cluster 2.
* Enable high-strength password policies for the hypervisor and cluster.
* Ensure CVMs require SSH keys for login instead of passwords. (SSH keys are located in the desktop\Files\SSH folder.) Ensure the cluster meets these requirements. Do not reboot any cluster components.
Note: Please ensure you are modifying the correct components.

See the Explanation below for detailed answer.
Explanation:
Here is the step-by-step solution to apply the security requirements to Cluster 2.
1. Access Cluster 2 Prism Element
First, we must access the Prism Element (PE) interface for Cluster 2, as most security settings are cluster- specific.
* From the Prism Central dashboard, navigate to Hardware > Clusters.
* Find Cluster 2 in the list and click its name. This will open the Prism Element login page for that specific cluster in a new tab.
* Log in to Cluster 2's Prism Element using the admin credentials.
2. Requirement: Update Node Root Password
This task syncs the root password for all AHV hypervisor nodes with the cluster's admin user password.
* In the Cluster 2 PE interface, click the gear icon (Settings) in the top right corner.
* Select Cluster Lockdown from the left-hand menu.
* Click the Set Root Password on All Hosts button.
* A dialog box will appear. Enter the current admin password (the one you just used to log in) into both the New Password and Confirm New Password fields.
* Click Save. This will propagate the admin password to the root user on all nodes in Cluster 2.
3. Requirement: Add CVM SSH Key
This task adds the security team's public key to the admin user, which is required before we can disable password-based login.
* On the desktop, navigate to the Files > SSH folder.
* Open the id_rsa.pub file (or equivalent public key file) with Notepad.
* Copy the entire string of text (e.g., ssh-rsa AAAA...).
* In the Cluster 2 PE interface, go to Settings (gear icon) > User Management.
* Select the admin user and click Modify User.
* Paste the copied public key into the Public Keys text box.
* Click Save.
4. Requirement: Apply SCMA Policies (All other requirements)
The remaining requirements are all applied via the command line on a CVM using Nutanix's Security Configuration Management Automation (SCMA).
* Access the CVM:
* Find a CVM IP for Cluster 2 by going to Hardware > CVMs in the PE interface.
* Open an SSH client (like PuTTY) and connect to that CVM's IP address.
* Log in with the username admin and the corresponding password.
* Output Current Policy (Req 2):
* Before making changes, run the following command to see the current policy:
ncli scma status
* Copy the entire output from your SSH terminal.
* Open Notepad on the desktop, paste the copied text, and Save the file to the desktop as output.
txt.
* Apply New Policies (Req 3, 4, 5):
* Run the following commands one by one. The cluster will apply them immediately without a reboot.
* Enable AIDE (Req 3):
ncli scma update aide-status=enabled aide-schedule=weekly
* Enable High-Strength Passwords (Req 4):
ncli scma update password-policy=high
* Require SSH Keys for CVMs (Req 5):
ncli scma update ssh-login=keys-only
Verification
You can verify all changes by running the status command again. The output should now reflect the new, hardened security posture.
ncli scma status
* AIDE Status: should show Enabled
* AIDE Schedule: should show Weekly
* Password Policy: should show High
* SSH Login: should show keys-only