Correct Answer:

See the Explanation below for detailed answer.
Explanation:
Here is the step-by-step solution to generate the Certificate Signing Request (CSR) on Cluster 1.
This entire process is performed from an SSH session connected to a CVM (Controller VM) on Cluster 1.
1. Access Cluster 1 CVM
* From Prism Central, navigate to Hardware > Clusters and click on Cluster 1 to open its Prism Element (PE) interface.
* In the Cluster 1 PE, navigate to Hardware > CVMs to find the IP address of any CVM in the cluster.
* Use an SSH client (like PuTTY) to connect to the CVM's IP address.
* Log in with the admin user and password.
2. Create the Configuration File (.cnf)
To include the Subject Alternative Names (SANs), you must first create a configuration file.
* In the CVM's command line, create the .cnf file using a text editor:
vi prism_element_acme.cnf
* Press i to enter "Insert" mode.
* Paste the following text exactly into the editor:
Ini, TOML
[ req ]
default_bits = 2048
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[ req_distinguished_name ]
C = US
ST = North Carolina
L = Durham
O = ACME
OU = Infrastructure
CN = prism_element.ACME.org
emailAddress = [email protected]
[ v3_req ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = cvm1.ACME.org
DNS.2 = cvm2.ACME.org
DNS.3 = cvm3.ACME.org
* Press Esc to exit "Insert" mode, then type :wq and press Enter to save and quit vi.
3. Generate the CSR and Key
* Run the following openssl command. This command uses the .cnf file to generate the new CSR (.csr) and a corresponding private key (.key), applying the sha256 encryption as requested.
Bash
openssl req -new -nodes -out prism_element_acme.csr -keyout prism_element_acme.key -config prism_element_acme.cnf -sha256
* The command will output the following, confirming the key generation:
* Generating a 2048 bit RSA private key
* ...................+++++
* ..................................+++++
* writing new private key to 'prism_element_acme.key'
* -----
4. Save Files to the Desktop
You will now copy the contents of the generated files from the CVM to your desktop.
* For Task 5.txt (Commands and Output):
* Open a new Notepad file on the desktop.
* Copy and paste all the commands you ran in the SSH session and their full output (as shown in steps 2 and 3) into this file.
* Save the file on the desktop as Task 5.txt.
* For prism_element_acme.cnf:
* In the CVM SSH session, display the file's content:
cat prism_element_acme.cnf
* Copy the entire text output (starting from [ req ]).
* Open a new Notepad file on the desktop.
* Paste the content and save the file as prism_element_acme.cnf.
* For prism_element_acme.csr:
* In the CVM SSH session, display the file's content:
cat prism_element_acme.csr
* Copy the entire text output, including the -----BEGIN CERTIFICATE REQUEST----- and ----- END CERTIFICATE REQUEST----- lines.
* Open a new C:\Users\admin\Desktop\Notepad file on the desktop.
* Paste the content and save the file as prism_element_acme.csr.

Correct Answer:

See the Explanation below for detailed answer.
Explanation:
Here is the step-by-step solution to modify the security policy file as required.
Navigate to the desktop and open the file Security Policy.txt (which corresponds to the provided Security Policy.bak content) using a text editor like Notepad.
Modify the file content by replacing the xxxxx and xxxx placeholders according to the security requirements.
Modifications by Rule
Here are the specific changes to make within the file:
1. Quarantine Rule
Requirement 1 (No Logging): The quarantine rule should not be logged.
Change "is_policy_hitlog_enabled": "xxxxx" to "is_policy_hitlog_enabled": "false" Requirement 2 (Enforce): This rule must be enforced.
Change "action": "xxxxx" (under quarantine_rule) to "action": "APPLY"
Requirement 3 (Environment): The rule must affect the "SecOps" environment.
Change "Environment": ["xxxxx"] to "Environment": ["SecOps"]
2. SMB-block Rule
Requirement 1 (Logging): This rule must be logged.
Change "is_policy_hitlog_enabled": "xxxxx" to "is_policy_hitlog_enabled": "True" Requirement 2 (Monitor): This rule must not be enforced, only logged.
Change "action": "xxxxx" (under isolation_rule) to "action": "MONITOR"
Requirement 4 (Tags): The rule must affect the "smbhost" and "smbclient" tags.
Change "SMBv1": ["xxxxx"] to "SMBv1": ["smbhost"]
Change "SMRv1": ["xxxxx"] to "SMRv1": ["smbclient"]
3. DN test (dn-policy1) Rule
Requirement 2 (Monitor): This rule must not be enforced, only logged.
Change "action": "xxxx" (under app_rule) to "action": "MONITOR"
Requirement 5 (Allow IPv6): This policy must allow IPv6 traffic.
Change "allow_ipv6_traffic": "xxxx" to "allow_ipv6_traffic": "True"
Final Step
After making all the replacements, Save the file, overwriting the original Security Policy.txt on the desktop.
Example of completed rules (replace xxxxx accordingly):
Rule Name: Quarantine Rule
Logged: false
Action: APPLY
Environment: SecOps
Protocols: TCP
Ports: 8080
Rule Name: SMB Rule
Logged: True
Action: MONITOR
Tags: smbhost, smbclient
Protocols: TCP
Ports: 8080
Rule Name: DN Test Policy
Logged: True
Action: MONITOR
Environment: Non-Prod
Protocols: ALL
Ports: 8080

Correct Answer:

See the Explanation for step by step solution.
Explanation:
To configure the cluster to meet the requirements of the infosec team, you need to do the following steps:
Log in to Prism Central and go to Network > Syslog Servers > Configure Syslog Server. Enter Corp_syslog as the Server Name, 34.69.43.123 as the IP Address, and 514 as the Port. Select TCP as the Transport Protocol and enable RELP (Reliable Logging Protocol). This will create a syslog server with the highest reliability possible.
Click Edit against Data Sources and select Cluster B as the cluster. Select API Requests and Replication as the data sources and set the log level to CRITICAL for both of them. This will enable audit logs for API requests and replication capabilities for the top 4 severity levels (EMERGENCY, ALERT, CRITICAL, and ERROR) and push them to the syslog server. Click Save.
Repeat step 2 for any other clusters that you want to configure with the same requirements.



To configure the Nutanix clusters to enable audit logs for API Requests and replication capabilities, and push them to the syslog system with the highest reliability possible, you can follow these steps:
Log in to the Nutanix Prism web console using your administrator credentials.
Navigate to the "Settings" section or the configuration settings interface within Prism.
Locate the "Syslog Configuration" or "Logging" option and click on it.
Configure the syslog settings as follows:
Syslog Name: Enter "Corp_syslog" as the name for the syslog configuration.
Syslog IP: Set the IP address to "34.69.43.123", which is the IP address of the syslog system.
Port: Set the port to "514", which is the default port for syslog.
Enable the option for highest reliability or persistent logging, if available. This ensures that logs are sent reliably and not lost in case of network interruptions.
Save the syslog configuration.
Enable Audit Logs for API Requests:
In the Nutanix Prism web console, navigate to the "Cluster" section or the cluster management interface.
Select the desired cluster where you want to enable audit logs.
Locate the "Audit Configuration" or "Security Configuration" option and click on it.
Look for the settings related to audit logs and API requests. Enable the audit logging feature and select the top
4 severity levels to be logged.
Save the audit configuration.
Enable Audit Logs for Replication Capabilities:
In the Nutanix Prism web console, navigate to the "Cluster" section or the cluster management interface.
Select the desired cluster where you want to enable audit logs.
Locate the "Audit Configuration" or "Security Configuration" option and click on it.
Look for the settings related to audit logs and replication capabilities. Enable the audit logging feature and select the top 4 severity levels to be logged.
Save the audit configuration.
After completing these steps, the Nutanix clusters will be configured to enable audit logs for API Requests and replication capabilities. The logs will be sent to the specified syslog system with the highest reliability possible.
ncli
<ncli> rsyslog-config set-status enable=false
<ncli> rsyslog-config add-server name=Corp_Syslog ip-address=34.69.43.123 port=514 network- protocol=tdp relp-enabled=false
<ncli> rsyslog-config add-module server-name= Corp_Syslog module-name=APLOS level=INFO
<ncli> rsyslog-config add-module server-name= Corp_Syslog module-name=CEREBRO level=INFO
<ncli> rsyslog-config set-status enable=true
https://portal.nutanix.com/page/documents/kbs/details?targetId=kA00e0000009CEECA2

Correct Answer:

See the Explanation below for detailed answer.
Explanation:
Here is the step-by-step solution to modify the alert policy from the Prism Element (PE) interface for Cluster 1.
1. Access Cluster 1 Prism Element
* From the main Prism Central dashboard, navigate to Hardware > Clusters.
* Find Cluster 1 in the list and click its name. This will open the specific Prism Element login page for that cluster.
* Log in to Cluster 1's Prism Element interface.
2. Modify the Alert Policy
* In the Cluster 1 PE interface, click the gear icon (Settings) in the top-right corner.
* From the left-hand menu, select Alert Policies.
* In the search bar, type inode to find the correct policy.
* Select the checkbox for the policy named cvm_inode_usage_high.
* Click the Update button.
* In the "Update Alert Policy" dialog, configure the following settings:
* Warning Threshold (%): Change the value to 45.
* Critical Threshold (%): Change the value to 60.
* Check Interval (Secs): Change the value to 60 (to run the check every minute).
* Auto Resolve: Uncheck this box (to ensure the alert is not resolved without administrator action).
* Click Save.