To achieve the goal of " minimal downtime " and " no user intervention, " a zero-RPO solution with automated failover capabilities is required. In the Nutanix ecosystem, this is accomplished through Synchronous Replication. Unlike Asynchronous or NearSync replication, which rely on snapshot intervals and manual failover triggers, Synchronous replication ensures that data is written to both the local and remote clusters simultaneously. This architecture provides the foundation for zero data loss during a site failure.
However, the " automatic " part of the requirement is fulfilled by the addition of a Witness VM. Without a Witness, a secondary cluster cannot independently determine if the primary cluster has actually failed or if there is merely a network partition. In a " no witness " scenario (Option C), the secondary cluster stays in a passive state to prevent " split-brain " data corruption, requiring an administrator to manually promote the storage. By deploying a Witness VM at a third, independent site, the secondary cluster can communicate with the Witness to " acquire the lock " on the protection domain. Once the Witness confirms the primary site is unreachable, the orchestrator automatically promotes the secondary container and powers on the VMs. This combined solution of a Synchronous Protection Policy and a Witness VM provides the highest level of availability and the fastest possible recovery without requiring human action during the disaster event.

The Nutanix architecture relies on specialized services running on each Controller VM (CVM) to handle specific cluster operations. The " Cerebro " service is the primary engine responsible for data protection and replication tasks across the Nutanix cluster. It manages recovery points, snapshot schedules, and the actual transfer of data between the local cluster and remote sites. Consequently, the cerebro.INFO log file is the most vital resource for an administrator troubleshooting replication health or site-to-site connectivity. This log records critical events such as the start and completion of replication jobs, handshake failures between clusters, and timeout errors during snapshot transfers. If an administrator notices that replication is " hung " or failing consistently, cerebro.INFO provides the granular detail needed to see if the issue is a network timeout, a remote service unavailability, or a metadata synchronization error. Reviewing this log helps ensure that the connection stability is maintained and that any deviations in replication performance are identified before they impact the Recovery Point Objective (RPO). Other logs like genesis.out (Option B) are more focused on service startup and configuration rather than the ongoing health of the BCDR replication stream.

Failback is a critical phase of the disaster recovery lifecycle where workloads are returned to their original primary site. When an " Unplanned Failover " is executed, the system assumes the primary site is gone or unmanaged. Once the primary site (AZ1) is restored, the administrator cannot simply " re-run " the failover in reverse without preparing the source site. The " Clean up of Entities " (Option C) is a mandatory step that must be performed on the original primary cluster after it returns to a healthy state. This process clears the stale VM registrations and metadata that existed prior to the outage, signaling to the Nutanix orchestrator that AZ1 is now ready to re-receive the workloads. Until this cleanup is completed, the Recovery Plan will not list the VMs as eligible for failback because it still detects the " ghost " of the VM at the destination. While reverse replication (Option B) is also necessary to prevent data loss during failback, the reason the VMs are entirely missing from the Recovery Plan interface during the initial failback attempt is the lack of entity cleanup. Performing this cleanup ensures a smooth transition back to primary production without metadata conflicts or registration errors.

Nutanix Disaster Recovery provides multisite replication capabilities, allowing a single cluster to protect workloads across multiple locations. However, there are specific architectural constraints regarding the type of replication schedules that can coexist within a single Protection Policy.
The primary limitation in this architect ' s design is that a single Nutanix Protection Policy supports only one synchronous replication schedule. While you can configure a policy to replicate to multiple sites using Asynchronous or NearSync schedules, you cannot natively instruct the system to perform a synchronous " 3- way " write where a single VM mirrors every I/O to two different physical destination clusters simultaneously. This is due to the extreme latency and metadata synchronization overhead that would be required to maintain zero-RPO consistency across three sites for every single write operation. Prism Central does allow pairing with more than one AZ (negating Option B), and synchronous replication is fully supported in Protection Policies (negating Option D). Therefore, to achieve the desired level of protection, the architect would need to use a combination of one synchronous schedule and additional asynchronous schedules to the second AZ, rather than attempting two simultaneous synchronous links within one policy.

Nutanix allows for the encryption of replication traffic " on the wire " using IPSec tunnels between clusters.
When an administrator enables network segmentation for Disaster Recovery, the replication traffic is moved from the default management network to a new, dedicated subnet and set of virtual interfaces.
Because the native replication encryption relies on IPSec gateways to secure the communication, the underlying VPN configuration must be aware of the network paths it is protecting. If the traffic is now originating from a new segmented subnet, the IPSec VPN gateway configuration at both the primary and recovery sites must be updated to include these new subnet ranges. If this step is missed, the encrypted tunnel will not recognize the segmented traffic as valid for the VPN, causing replication to fail even if the physical network is reachable. Regenerating KMS tokens (Option C) relates to data-at-rest encryption on physical drives, not traffic-in-transit. Restarting services (Option D) might be part of the general segmentation workflow, but the specific requirement for " encrypted replication " stability in this context is the alignment of the IPSec VPN policy with the new segmented network topology.