A VM with IP address 172.20.10.5 on a Subnet with CIDR 172.20.10.0/24 is unable to be routed externally from the VPC. The VPC is successfully peered via BGP... However, when checking the BGP Session, no routes are being advertised by the VPC. What is the most likely configuration issue?
Correct Answer: C
From a Nutanix exam perspective, this question is really testing whether the administrator understands the control point that actually governs the behavior shown in the scenario. The correct response is C, meaning "The VPC does not have a NO-NAT network configured to advertise the routes.". A Floating IP is the normal mechanism for exposing a workload in an overlay-backed VPC to external clients. It preserves internal VM addressing while publishing a reachable external address through the VPC's north-south path. With BGP in Flow Virtual Networking, route exchange depends on both gateway objects and a correctly defined peering session. A healthy gateway alone is not enough; the session, peer parameters, and advertised prefixes must all align. Operationally, Flow Virtual Networking should be checked from the control plane outward: gateway health, peering state, route advertisement, ERP coverage, external path, and MTU when encapsulation is involved. A strong exam habit is to ask which Nutanix construct would have to change for the symptom or requirement to change. That mental shortcut usually separates the real answer from distractors that mention generic networking steps, disruptive resets, or unrelated configuration objects. Notice that A is not appropriate because NAT changes addressing.
Question 22
Users have recently reported intermittent connectivity issues and slower-than-usual application performance for a Nutanix cluster to an administrator. The administrator needs to identify the root cause of these issues by analyzing the health of the infrastructure components. What action should the administrator take first to diagnose the root cause of the problem?
Correct Answer: A
The clean way to read this scenario is to separate what is merely present in the environment from the single Nutanix construct that actually satisfies the requirement. The correct response is A, meaning "Review cluster health status, checking for any warnings or alerts relevant to the performance issues.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. A strong exam habit is to ask which Nutanix construct would have to change for the symptom or requirement to change. That mental shortcut usually separates the real answer from distractors that mention generic networking steps, disruptive resets, or unrelated configuration objects. Notice that B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. C does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. Seen operationally, the correct response is the least.
Question 23
An administrator needs to delegate the management of security policies to a dedicated SecOps team. To enforce the principle of least privilege, the administrator assigns the predefined Flow Policy Author role to a user on the team. The user confirms they can create, monitor, and enforce security policies. However, when attempting to build a new application security policy for a set of newly deployed VMs, the user reports they are unable to create a new category to group these VMs. The option is not available in the Prism Central UI. Which statement explains this behavior?
Correct Answer: C
A reliable method here is to translate the scenario into Nutanix terms-VPC routing, external connectivity, policy scope, identity mapping, or upgrade readiness-and then choose the answer that directly addresses that domain. The correct response is C, meaning "The user is missing the Flow Admin role, which is required for category management.". The winning option is the one tied to the native Nutanix object or control that governs the outcome described in the scenario. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. Notice that A sounds plausible, but it does not align with the specific Flow policy object or precedence rule that controls this case. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. In practice, administrators who anchor their decisions to Prism Central constructs-such as VPCs, external networks, ERPs, categories, and policy modes-arrive at the correct answer faster and avoid unnecessary changes.
Question 24
Which policy type takes highest precedence in Enforce mode?
Correct Answer: C
The most professional way to evaluate this question is to map the symptom to the Nutanix feature responsible for that function rather than reacting to secondary details in the prompt. The correct response is C, meaning "Quarantine". Enforce mode is the stage where Flow stops acting like a discovery tool and starts behaving like a stateful control point. Traffic allowed by the policy continues normally, while traffic that does not match an allowed rule is denied according to policy logic. This is a Flow policy design question, so categories, secured entities, rule direction, policy mode, and policy precedence matter more than simple IP connectivity assumptions. Seen from a design perspective, the correct answer is the least ambiguous and most supportable implementation path inside Prism Central and AHV. Notice that A does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. B does not fit because it targets a different layer of the Nutanix networking and security stack than the one causing the outcome here. For exam preparation, remember that Nutanix usually separates discovery from enforcement, routing from NAT, and access policy from.
Question 25
An administrator needs to make a web server VM, which is inside a private VPC overlay subnet, accessible from the external network. The administrator assigns a Floating IP to the VM, but the service is still unreachable from the outside. What is a likely reason for this failure?
Correct Answer: B
What makes this a strong certification question is that several answers look technically related, but only one aligns with the exact behavior of Flow networking or Flow security. The correct response is B, meaning "The VPC has no default route configured to use the external subnet.". A Floating IP is the normal mechanism for exposing a workload in an overlay-backed VPC to external clients. It preserves internal VM addressing while publishing a reachable external address through the VPC's north-south path. Operationally, Flow Virtual Networking should be checked from the control plane outward: gateway health, peering state, route advertisement, ERP coverage, external path, and MTU when encapsulation is involved. Notice that A addresses exposure of a single VM, not the broader routing or security behavior under discussion. C is a disruptive action and does not address the actual control-plane or policy requirement being tested. That is the underlying Nutanix principle being validated: solve the issue at the feature that owns the behavior, not by changing unrelated infrastructure settings that happen to sound network-oriented.
