The wording "security drift" points to SCMA rather than AIDE. In Nutanix security hardening guidance, SCMA scheduling is the control that determines how often SCMA runs, with schedule options such as hourly, daily, weekly, and monthly. That makes the SCMA schedule the setting that changes the cadence of security drift checking without changing the underlying controls themselves. ( Nutanix Portal ) AIDE is a file-integrity mechanism and has its own role, but the question is specifically asking about how often the platform checks for drift in a broader security-configuration sense. Changing the list of entities inspected or baseline enforcement behavior would alter scope or enforcement semantics, not merely frequency. The most direct administrative answer is to change the schedule for SCMA. From an exam perspective, Nutanix often separates what runs, how it is enforced, and when it runs into different settings.
Here the requirement is only about "how often," so option B is the precise match. ( Nutanix Portal )

Nutanix LCM documentation for the pre-check test_ahv_entering_mm_pinned_vms explains that this check identifies VMs that block the host from entering maintenance mode. Nutanix also notes that during host updates, LCM automatically shuts down running non-migratable VMs before updating the host. In practice, VMs using certain pinned or non-migratable features-such as specific agent, passthrough, or unsupported migration cases-must be powered off if they cannot be moved safely. That makes D the best answer. ( portal.
nutanix.com , portal.nutanix.com )
The key is that not every special VM can live-migrate in every environment. Credential Guard migration has CPU-generation limitations, and pinned or specialized VMs can still block maintenance. The safest supported action for the listed blocked VMs is to power them off, let the host enter maintenance mode, and then proceed. So D is the right operational answer.

Nutanix supports storage policy-based encryption in Prism Central, which is exactly the right mechanism when only a subset of workloads needs encryption. Nutanix documentation explains that in addition to cluster- level encryption, administrators can configure storage policies to encrypt data at rest and apply those policies selectively. Since the PCI-DSS workloads are already logically groupable by category, the proper design is to create a storage policy with encryption enabled and then associate it with the category assigned to those VMs.
That makes C correct. ( portal.nutanix.com , portal.nutanix.com , portal.nutanix.com ) Cluster-level encryption would encrypt too much, which violates the requirement to leave general-purpose VMs unencrypted. Guest OS BitLocker is a separate operating-system control, not the Nutanix platform answer being tested here. Container-centric thinking is older and less flexible than policy-based encryption.
Nutanix's policy model is the authentic platform-aligned solution for category-scoped encryption using an external KMS.

Here the uploaded answer key says D, but official Nutanix documentation supports B. Nutanix documents that for enhanced security of ROBO environments (typically 1- or 2-node clusters), administrators should select Native KMS (remote) for software-based encryption. Nutanix also states in KMS considerations that software encryption using Native KMS is supported for ROBO deployments using the Native KMS (remote) KMS type. Because the question explicitly describes a 2-node ROBO cluster and requires the keys to be stored outside the cluster, the Nutanix-authentic answer is B. Native KMS (remote).
An external KMS is valid in many enterprise encryption designs, but this question is more specific: it asks for the KMS type Nutanix supports and recommends for software encryption on a ROBO cluster. On that narrow requirement, the official docs point to Native KMS (remote) rather than External KMS. So for an authentic study guide aligned to Nutanix documentation, B is the correct answer.

Nutanix documentation for Active Directory authentication in Prism Element states that the default LDAP port is 389, while port 636 is used for LDAPS, which provides encrypted LDAP traffic. Because the question explicitly says the administrator wants all traffic encrypted, the correct port is 636. That is the standard LDAPS answer and the one Nutanix documents directly.
The missing exhibit is not actually necessary to answer the question because the encryption requirement itself is enough. Ports 443 and 9440 are associated with web interfaces or management access, not LDAP directory authentication transport. Port 389 is unencrypted LDAP unless other mechanisms are layered on top. Nutanix' s own directory-authentication docs make the intended answer clear: use LDAPS on port 636. Therefore C is the authentic Nutanix answer.