An administrator is required to restore a long list of VMs from snapshot due to a security incident. How could the administrator leverage Intelligent Operations to compile a list of VMs recovered from snapshots?

A snapshot-recovery operation generates a Prism Central event (for example, “VM Snapshot Restore Succeeded”). An Event-triggered Playbook can watch for this event and automatically apply an action such as Assign Category → “snapshot-recovered” to the affected VM. Because Categories are first-class searchable objects in Prism Central, the administrator can later filter or report on all VMs with the “snapshot-recovered” category, thereby obtaining the required list. Alert- or time-based Playbooks do not capture this recovery event, so they cannot reliably build the list.

B. Alert triggers fire only on Prism alerts; snapshot-restore produces an event, not an alert, so no VMs would be captured.
C. Time-based triggers run on a schedule and do not react to individual snapshot-restore events; they neither detect nor list the recovered VMs.
D. “Alerts Matching Criteria” still depends on alert objects (severity, type); with no alert generated for snapshot recovery, the Playbook never runs.

1. Nutanix Prism Central Administration Guide v6.7, “Playbooks → Event Triggers,” pp. 541-543: describes event-based Playbooks and example using “Assign Category” after VM events.

2. Nutanix Prism Central Administration Guide v6.7, “Event Reference,” p. 916: lists “VM Snapshot Restore Succeeded” as a system event.

3. Nutanix University NCP-MCA 6.x Courseware, Module 7 “Intelligent Operations,” Slide 15: recommends assigning a category via event-triggered Playbook to tag VMs for later reporting.