Which feature should be enabled to prevent password access to the CVM for both the nutanix and admin user accounts?

Cluster Lockdown is a security feature within Nutanix AOS designed to harden the cluster by restricting access. When enabled, it disables password-based SSH login to all Controller VMs (CVMs) for every user, which explicitly includes the default nutanix and admin accounts. Access is then only permitted through SSH public key authentication, significantly enhancing security by preventing brute-force password attacks and ensuring that only authorized individuals with pre-configured keys can access the CVM command line.

B. STIG: A Security Technical Implementation Guide (STIG) is a security standard or hardening methodology, not a specific Nutanix feature that you enable to block password access.
C. RBAC Policy on PC: Role-Based Access Control (RBAC) in Prism Central defines user permissions for actions within the Prism interface, not the underlying SSH authentication method to a CVM.
D. Data-at-Rest Encryption: This feature encrypts data on the physical disks to protect against data theft but does not affect user authentication or login procedures for the CVMs. ---

1. Nutanix AOS 6.5 Security Guide: In the "Securing a Cluster" section, under the sub-section "Cluster Lockdown," the documentation states, "When you enable cluster lockdown, password-based login to the CVMs is disabled for all users, including the default nutanix and admin users. You can only log in to the CVMs by using SSH with public key authentication." (Document available via the Nutanix Portal).

2. Nutanix University - Nutanix Certified Associate (NCA) 6.5 Student Guide: The "Securing a Nutanix Cluster" module describes Cluster Lockdown as the feature used to disable password-based SSH access and enforce key-based authentication for enhanced security.