Vce NCP-CI-Azure Questions Latest

Azure AD App Registration: When setting up an application registration in Azure AD, specific permissions are required to delegate access.

User Access Administrator Role: This role has the necessary permissions to manage user access to Azure resources, including delegating permissions for app registrations.

Comparison of Roles:

Azure Reader Role: Grants read-only access, insufficient for managing app registrations.

Azure Contributor Role: Allows creation and management of resources but does not include permissions to manage access.

Azure Custom Role: While it can be defined to meet specific needs, the User Access Administrator role is predefined to handle access delegation.

Conclusion: The Azure User Access Administrator role is required to delegate minimum permissions for Azure AD App registration.

References:

Azure Role-Based Access Control Documentation

Azure AD App Registration Guide

When the administrator notices that the VMs cannot reach resources outside the network, even by IP address, it is likely that a default route was not configured for the external subnet. The default route is essential for directing traffic from the VMs to external networks. Without it, the VMs will not know how to route traffic to external destinations, which leads to connectivity issues.

References

Azure Virtual Network Documentation

Nutanix Flow Networking Best Practices

Scenario Analysis:

A. Connectivity between sites already provides encryption: Using VTEP in this scenario is advantageous because VTEP does not inherently provide encryption. If encryption is already provided, VTEP can be effectively used without additional security concerns.

D. Multiple remote Availability Zones exist to add to the same VTEP-based extended Layer 2 subnet: VTEP is well-suited for scenarios where multiple remote Availability Zones need to be connected to the same extended Layer 2 subnet. This allows for efficient management and seamless connectivity across different zones.

Scenarios B and C:

B. Only one remote Availability Zone exists that needs the subnet extended: This scenario does not leverage the strengths of VTEP, as it is better suited for multiple zones.

C. Connectivity between sites already does not provide encryption: Using VTEP without existing encryption is not ideal as VTEP itself does not encrypt the traffic.

Conclusion: VTEP is advantageous when encryption is already in place and when multiple remote zones need to be connected to the same extended subnet.

References:

Nutanix NC2 Networking Guide

Azure Networking Documentation

In the NC2 on Azure cluster scenario, the existing workloads were using floating IPs for inbound traffic before the addition of new Flow Gateways (FGW3 and FGW4). The NAT traffic path established initially will continue to direct traffic through the originally assigned Flow Gateways (FGW1 and FGW2). The existing workloads will not automatically utilize the new Flow Gateways (FGW3 and FGW4) without a reconfiguration or reboot, which reassigns the NAT paths.

References

Nutanix Flow Networking and Configuration Guide