NCP-NS-7.5 Real Exam Questions
134 questions available · Page 1 of 14
Updated Exam DumpsVerified AnswersPass Guarantee
An administrator needs to use Prism Central to identify a subnet belonging to a VPC.
How can the administrator identify networks associated with a VPC within Prism Central?
Correct answer: D
VPC subnets in Prism Central are overlay networks. Identifying the subnet as type Overlay distinguishes it from VLAN-backed networks, while an IP prefix alone does not prove the subnet belongs to a VPC.
An administrator is deploying a new multi-tenant environment in Prism Central and has created a VPC named TenantVPC1. The administrator needs to enable external connectivity for this VPC so that some services inside the VPC can be accessed from the corporate network without NAT translation, while other services require Internet access through SNAT translation. The administrator plans to use an External Network(s) to provision this connectivity.
Which configuration should the administrator apply to satisfy this requirement?
Correct answer: A
The VPC needs two different external behaviors. A NAT External Network provides SNAT for internet-bound services, while a Routed/No-NAT External Network preserves addresses for corporate network access. Attaching both meets both paths.
An administrator is designing a Transit VPC to provide shared corporate services (e.g., DNS) for two tenant VPCs: VPC-A requires WAN access using NAT. VPC-B requires WAN access without NAT. Both VPCs connect to the Transit VPC for shared services hosted on the corporate network. Shared services residing in the Transit VPC use routed IP addressing for WAN connectivity.
Which two configuration elements should the administrator implement on the Transit VPC? (Choose two.)
Correct answers: C, D
The Transit VPC needs one overlay external subnet as the shared connection point for both tenant VPCs. Its own WAN path uses routed underlay connectivity, so a No-NAT external VLAN is associated to the Transit VPC router. Separate NAT and No-NAT VLANs are for tenant egress choices, not this shared-services VPC.
An administrator has configured a VPC with multiple overlay subnets and attached a VPN gateway using IPSec. After enabling Jumbo Frames on the physical network, VMs are still experiencing packet drops.
What is the most likely reason?
Correct answer: A
IPSec adds encapsulation overhead, reducing the usable packet size across the tunnel. If guest VMs use an MTU that exceeds the recommended size for IPSec, packets can be dropped even when jumbo frames are enabled on the physical network.
What two preparations allow VDI rules to follow logged-on users through Active Directory group identity? Choose two.
Correct answers: C, D
VDI rules can follow users only when directory identity can be translated into policy categories. Define category values that correspond to directory groups, and ensure Prism Central identity services collect login information so the active user group can be applied to the desktop session.
Which two options are supported as a Secured Entity in Flow Network Security Application Policies? (Choose two.)
Correct answers: A, C
Flow Network Security application policies can use Subnet Category and VPC Category as secured entities because they represent network scopes that the policy can protect. vNIC and VG categories are not the supported secured-entity choices in this policy type.
To activate protection after an administrator has reviewed discovered application flows, which action should be taken on the policy?
Correct answer: C
After the discovered application flows have been reviewed, the policy needs explicit allow rules for required communication. Moving the policy to Enforce mode then activates protection by blocking traffic outside those allowed rules.
To protect only the backup-facing vNIC of a dual-homed reporting VM, which Flow Network Security scope should be used?
Correct answer: A
A dual-homed VM needs policy scope narrow enough to select only the backup-facing interface. An entity group combining the VM category with the subnet category for that vNIC identifies that specific attachment, while a VM-only or VPC-wide scope would cover more interfaces than intended.
During a night-shift contractor rollout, a help desk VDI policy grants access based on an AD group. Two users receive the dynamic ADGroup category after login, but one contractor is blocked and the category is absent from that desktop. What should the administrator verify first?
Correct answer: B
The missing dynamic ADGroup category points first to identity matching, not subnet or routing configuration. Verifying that the affected contractor matches the mapped AD group and identity data checks whether Prism Central can assign the category that the VDI policy uses for access.
Which two settings provide a compliance log collector with copies of Flow Network Security rule hits during overnight monitoring? Choose two.
Correct answers: B, D
Rule hit logging must be enabled on the relevant security policy so matching traffic events are recorded. Registering the compliance collector as a syslog target gives the platform a destination to send those rule hit copies during monitoring.