After performing a failover of encrypted AHV VMs from an on-premises AZ to a recovery AZ, an administrator notices that newly written data is not encrypted. Which post-failover cleanup task must be performed to correct this issue?

In Nutanix AHV, data-at-rest encryption is applied to VMs through storage policies that are linked to categories. When a VM is failed over to a recovery AZ, its association with the original category might be lost, or the corresponding encryption policy may not be correctly applied at the destination. To ensure newly written data is encrypted, the administrator must perform the post-failover task of reassigning the VM to the correct category that is linked to an active encryption policy on the recovery cluster.

A. Replication traffic encryption protects data in-flight between clusters. The issue described is with data at-rest on the storage of the recovery cluster after failover.
C. The replication schedule (RPO) determines how frequently data is replicated. It has no control over the data-at-rest encryption status of a VM post-failover.
D. Recreating the entire recovery plan and categories is an unnecessarily disruptive and drastic step. The issue can be resolved by simply re-associating the existing VM with the correct policy.

1. Nutanix Disaster Recovery Guide v6.8, "Failing Over Encrypted VMs." This section details the process and notes that for encryption to be active post-failover, the VM must be associated with a category linked to an encryption policy at the recovery AZ.

2. Prism Central Guide v2023.4, "Data-at-Rest Encryption for a VM (AHV)." The documentation specifies, "You can enable encryption for a VM by attaching the VM to a category. The category must be associated with an encryption-enabled protection policy."