NCP-CN practice question 16 of 25

[Perform Day 2 Operations] A Platform Engineer is a member of an IT team that provides Kubernetes clusters for three groups within a company named…

[Perform Day 2 Operations] A Platform Engineer is a member of an IT team that provides Kubernetes clusters for three groups within a company named Fin Group, Inc.: Fin VD Fin Insurance Fin TravelThe engineer created workspaces for each group. Fin Group Inc. has its own Active Directory implementation, while each group uses their own Identity Provider. Now, the engineer needs to assign the Tenant Administrators role for each workspace. How will the engineer complete this task?

Answer options

A: Configure a dedicated identity provider for each group to access their own workspace. Correct answer

B: Create a role named admin-tenant-X, where X is the name of the group, and assign that role to manage the corresponding workspace.

C: Create a role binding and assign it to manage the corresponding workspace.

D: Configure the global Active Directory and assign a workspace admin user to each group.

Correct Answer:

A. Configure a dedicated identity provider for each group to access their own workspace.

Explanation

The scenario requires assigning the Tenant Administrator role to users from three different groups, each with its own Identity Provider (IdP). Within Nutanix Kubernetes Engine (NKE), the foundational step to enable role-based access control for external users is to first configure the platform to trust their respective IdPs. The platform engineer must add each group's unique IdP (e.g., SAML, AD/LDAP) to NKE. Once the IdPs are configured and recognized, the engineer can then assign the built-in "Tenant Administrator" role to the appropriate users or groups from each IdP, scoping the permissions to their designated workspace.

Why Incorrect

B: The "Tenant Administrator" is a predefined, built-in role in NKE. Creating a new, custom role for this purpose is unnecessary and incorrect. C: Creating a role binding is a subsequent step that occurs after the identity provider has been configured and the users are recognized by the system. It is not the initial, enabling action. D: This option contradicts the scenario's key constraint that each group uses its own IdP, not the parent company's global Active Directory.

References

1. Nutanix Kubernetes Engine Guide - Authentication: "Nutanix Kubernetes Engine supports authentication with Active Directory (AD) or Lightweight Directory Access Protocol (LDAP) and SAML 2.0 based Identity Providers (IdPs). You can add one or more AD/LDAP directories or SAML IdPs to NKE. After you add a directory or an IdP

you can assign roles to the users and groups from the directory or IdP."

URL: https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Kubernetes-Engine-Guide-v29:mul-security-authentication-c.html

2. Nutanix Kubernetes Engine Guide - Role-Based Access Control: This section details the built-in roles

including "Tenant Administrator

" which grants administrative access to a specific tenant (workspace). It clarifies that these roles are assigned to users/groups from a configured IdP.

URL: https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Kubernetes-Engine-Guide-v29:mul-security-rbac-c.html

Keep practicing

Take the free NCP-CN practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test