Nutanix NCP-US v6.10 Exam Prep
Nutanix Certified Professional - Unified Storage v6.10 (Page 6 )

• C — Create a form extension and implement validation

• D — Use Chain of Command (CoC) with a form extension class

• Physical: Protects facilities or equipment, such as locks and security cameras.
• Technical: Uses technology, such as firewalls, encryption, or access controls.
• Operational: Covers day-to-day actions and processes, such as training, backups, or incident response.
• Managerial: Includes policies, standards, risk assessments, and procedures.

• Least privilege: Limits users to only the access necessary for their job.
• Background checks: Help identify potentially risky individuals before employment.
• Separation of duties: Ensures that one person cannot complete a sensitive process alone, reducing fraud and abuse.

1. The specific table — for example, incident
2. The parent table — for example, task
3. The wildcard table — *, which applies broadly

apex 
Set<Id> accountIds = new Set<Id>{ accountId1, accountId2 }; 


List<Account> accounts = [ 
    SELECT Id, Name 
    FROM Account 
    WHERE Id IN :accountIds 
];

• A: LIMIT accepts a number, not a collection of IDs.
• B: Set.containsAll() checks set contents in Apex; it does not filter SOQL results.
• C: Database.query() accepts a dynamic SOQL string, not a Set<Id> directly.

• Amazon S3 as the origin for static content
• Application Load Balancer (ALB) as the origin for dynamic content
• Amazon Route 53 configured to point the company’s domain name to CloudFront

• /static/* ? S3 origin; cache content at edge locations
• Dynamic paths such as /api/* ? ALB origin; forward requests to the EC2 application

• Wireshark captures packets and allows you to examine their contents, potentially revealing usernames and passwords sent without encryption.
• Netcat creates network connections and can send or receive data, but it is not primarily a packet-analysis tool.
• Nessus scans for known vulnerabilities and configuration issues; it generally would not prove that credentials are visible in transit.
• Nmap performs network discovery and port/service scanning, not detailed packet-content inspection.

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

• Custom domains are supported.
• It provides dedicated compute instances.
• It offers enough storage for the applications.
• It supports multiple instances with load balancing between them.
• It is less expensive than higher tiers such as Premium.

• Free and Shared use shared compute and have limited storage, so they cannot meet the dedicated-instance requirement.
• Basic provides dedicated compute and custom domains, but the question’s requirement for the broader multi-instance/load-balancing capability is intended to point to Standard.

• Admin access to the deployment pipeline
• Contributor access to the Development and Test workspaces
• Viewer access to the Production workspace

Box 1: No

• configure_azure_monitor() configures Azure Monitor and the OpenTelemetry pipeline.
• LangChain requires its own instrumentation or callback tracer, such as AzureAIOpenTelemetryTracer.
• You must pass the tracer to the LangChain execution configuration so chains, tools, prompts, and model calls become spans in Application Insights.

Box 2: Yes

text 
OTEL_SERVICE_NAME=customer-agent 
OTEL_SERVICE_NAME=invoice-agent

• Default route: 0.0.0.0/0; used only when no more specific route exists.
• Network route: A route covering the destination, such as 10.10.13.0/24.
• Host route: An exact 10.10.13.10/32 entry in the routing table.
• Floating static route: A backup static route with a higher administrative distance.

• Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.
• Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.
• Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.
• Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

• CSIRT: A team that responds to and manages security incidents.
• CVSS: A scoring system for rating the severity of vulnerabilities.
• SOAR: A technology platform for automating and coordinating security operations and incident response.

• A is correct: It establishes the revised dates and identifies the effect on the critical path.
• B is premature: Stakeholders should be informed after the impact has been assessed and the updated schedule is understood.
• C is not automatically appropriate: Fast-tracking may introduce additional risk and should be considered only after analyzing schedule options.
• D is premature: Adding resources may not resolve a dependency and could increase costs without addressing the actual constraint.

• Menerjemahkan soal ke bahasa Indonesia.
• Menyebutkan jawaban yang benar.
• Menjelaskan alasan jawaban tersebut.
• Memberi tahu jika kunci jawaban yang tersedia tampaknya keliru.
• Menjelaskan istilah teknis penting dalam soal.

• A. IDS attack signatures: Detects suspicious network activity, but is not primarily designed to scan uploaded files for malware.
• C. Load balancer: Distributes traffic among servers and improves availability; it does not inspect files for threats.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not malware scanning of uploaded documents.

• Ramen is a Linux worm associated with Red Hat Linux 6.2 and 7.0 systems.
• It spreads by scanning randomly generated IP addresses using tools such as synscan.
• It exploits vulnerable network services, including web-related services, and may leave malicious files or altered web content.
• The tar.gz file is also a clue because it is a common Linux archive/package format.

• Code Red: Primarily targeted Microsoft IIS servers running Windows.
• LoveLetter: Spread mainly through email attachments.
• Nimda: A Windows-based worm that spread through email, web servers, and network shares.

• Amazon SageMaker — charges apply for compute, storage, and other resources used.
• AWS Config — generally charges for configuration recording and rule evaluations.
• Amazon CloudWatch — has a limited free tier, but many metrics, logs, alarms, and API usage can incur charges.

• Who owns security risks and decisions
• Who is responsible for implementing controls
• Who reports security performance to management
• How security responsibilities align with business objectives

• B — Compliance with audit requirements: Governance may support compliance, but audit compliance is not its main objective.
• C — Monitoring security incidents: This is an operational security activity, not the central purpose of governance.
• D — Creation of tactical solutions: Governance establishes direction and oversight; tactical solutions belong to management and operational teams.

• Limiting the number of MAC addresses allowed on a switch port
• Restricting ports to specific known MAC addresses
• Taking an action—such as dropping frames or shutting down the port—when the limit is exceeded

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but is not the primary control for switch-port MAC limits.
• NGFW: Filters network traffic at the firewall, but does not directly control MAC addresses learned by a switch.

• Base table — the table containing common inherited fields
• Parent table — the table directly extended by the child
• Other tables in the hierarchy

• A: Describes an update-set conflict, not a Dictionary Override.
• B: Describes a configuration item or change concept.
• C: Describes an approval or workflow activity.

• IKE (Internet Key Exchange) negotiates the IPsec security association, including:

• ESP (Encapsulating Security Payload) protects the data after negotiation by providing encryption and optionally authentication.
• AH provides authentication and integrity but does not encrypt traffic.
• TLS is used for protocols such as HTTPS, not for negotiating IPsec parameters.

• Free: Doesn’t support the required custom domain and SSL configuration.
• Shared: Doesn’t provide the required SSL support or scalability.
• Basic: Supports multiple instances and SSL, but its storage limit is insufficient for the required 12 GB.
• Standard: Supports:

• 25 – Traditional SMTP server-to-server mail transfer; often blocked for client submission and not inherently secure.
• 110 – POP3 for receiving email; unencrypted by default.
• 143 – IMAP for accessing email; unencrypted by default.
• 587 – Authenticated email submission and commonly secured with TLS.

• Virtual introductions: Team members share their role, experience, location, and working preferences.
• Online icebreakers: Short, informal activities such as “two truths and a lie.”
• Virtual coffee chats: Pair team members for informal, non-project conversations.
• Collaborative problem-solving: The team works together on an online puzzle or scenario.
• Retrospectives: The team discusses what went well, what did not, and how to improve.
• Working-agreement sessions: The team agrees on response times, meeting etiquette, communication channels, and handoffs.
• Recognition sessions: Members acknowledge one another’s contributions.
• Remote workshops: Teams jointly create plans, diagrams, or schedules using collaboration tools.

• Report on the discount approval time for quotes

• Dashboard of opportunity stage duration

• Lead conversion trends measure lead-generation effectiveness, not opportunity closing time.
• Campaign ROI evaluates marketing performance, not delays in the sales process.

• Identifies which user or department owns the device
• Supports inventory and compliance requirements
• Enables tracking of lost, stolen, retired, or unauthorized devices
• Helps enforce security controls such as mobile-device management and secure configuration

• User2 is in Group1, so CA2 applies.
• CA2 targets Office 365.
• CA2 requires MFA OR an app protection policy.
• User2 has no app protection policy, but if User2 successfully completes MFA, the OR condition is satisfied.
• The device being noncompliant does not matter because CA2 does not require device compliance.
• CA1 applies only to Global Administrators. Unless User2 is also a Global Administrator, CA1 does not apply.

• Confirming the data has the required columns and data types
• Handling missing or duplicate records
• Converting data into a suitable format
• Selecting or engineering useful features
• Splitting it into training, validation, and test sets

1. Prepare the training data
2. Select an algorithm or configure AutoML
3. Train the model
4. Evaluate its performance
5. Tune hyperparameters if needed
6. Deploy the model

• Due diligence: Investigating and evaluating a third party before entering a business relationship.
• Attestation: An independent auditor’s examination and formal report—such as the SOC 2 report itself. The analyst is reviewing the attestation, not performing it.
• Internal audit: Examines the organization’s own processes and controls.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.

• Honeypots: Decoy systems or services designed to attract attackers. Legitimate users should not access them, so activity there is a strong indicator of compromise.
• DNS sinkholes: Redirect malicious or suspicious DNS requests to a controlled destination. This can identify infected systems attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it is not an attacker-detection method.
• CI/CD: Automates software development, testing, and deployment.
• Threat modeling: Identifies potential threats and weaknesses before or during system design; it does not directly detect an active infiltrator.
• Data obfuscation: Makes information harder to understand, but does not identify attackers.

• up ? down ? up
• Often happens rapidly or intermittently

• Faulty or loose cable or connector
• Failing transceiver, NIC, or switch port
• Speed/duplex or auto-negotiation problems
• Power or hardware instability
• Layer 1 interference

• Nothing plugged in: the port is simply down
• Latency: does not directly trigger err-disable
• shutdown: administratively disables the port, but that is not the same as an automatically detected err-disabled condition

sql 
ALTER TABLE dbo.DimCustomer 
ADD CONSTRAINT PK_DimCustomer 
PRIMARY KEY NONCLUSTERED (CustomerKey) 
NOT ENFORCED;

1. ALTER TABLE dbo.DimCustomer
2. ADD CONSTRAINT PK_DimCustomer PRIMARY KEY NONCLUSTERED (CustomerKey)
3. NOT ENFORCED

• The Intune device limit restriction does not apply in the normal way; DEM enrollment supports up to 1,000 devices.
• However, the Microsoft Entra maximum number of devices per user setting can still impose a limit when the enrollment creates an Entra device object.
• Therefore, a DEM account is not automatically unlimited. The effective limit depends on the Entra device setting and the enrollment/join type.

• The load balancer provides the listener’s frontend IP address.
• The active SQL Server node must also respond to that same listener IP.
• Enabling Floating IP allows the listener IP to be preserved and handled correctly by the active replica.
• Without it, SQL connections may be sent to a node that cannot correctly claim the listener address.

• A health probe for the SQL Server port
• A load-balancing rule using the listener port
• Floating IP enabled on that rule

• Initial Intrusion: The compromised VPN account and stolen phishing credentials describe how the attacker first gained access, but that happened months earlier.
• Persistence: The scheduled tasks and recurring C2 connections show how the attacker maintained and automated continued access.
• Search and Exfiltration: This would involve locating and transferring data. The scenario does not primarily describe data discovery or theft.
• Cleanup: Cleanup involves removing evidence or covering tracks. Obfuscated scripts may make detection harder, but the main behavior here is maintaining access.

• Authentication: Verifies who the user is.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records login activity and resource usage.

• CIA: Confidentiality, integrity, and availability—the core security objectives.
• ACL: Access Control List; rules that permit or deny traffic or access.
• PEM: A format and standard commonly associated with encoded certificates and keys.

• Driver node: Coordinates Spark jobs and runs in the compute environment.
• Worker node: Executes tasks and processes data.
• Databricks Filesystem (DBFS): Provides storage access for data used by compute resources.