11.2 Cluster Security Options: Lockdown, Encryption, and the Recycle Bin

11.2 Cluster Security Options: Lockdown, Encryption, and the Recycle Bin

"Identify security options" is the fourth knowledge statement under Objective 3.1. At NCA level you are asked to recognize what each control does and when it applies — not to design a hardening standard.

Cluster Lockdown and SSH Key Authentication

By default, an administrator can SSH to a CVM with a username and password. Cluster lockdown removes that: password-based SSH authentication is disabled, and only public key authentication is accepted.

Why organizations enable it:

• Passwords can be guessed, brute-forced, phished, or shared. Private keys cannot be typed into a phishing page.
• Access becomes auditable per key rather than shared through one account password.
• Removing a departing administrator is a matter of deleting their public key.

The order of operations matters

This is the part that is genuinely examinable, because getting it wrong is how administrators lock themselves out of their own cluster:

1. Add the public key or keys to the cluster through Prism.
2. Test SSH access using those keys and confirm it works.
3. Only then disable remote login with password — in Prism this is presented as clearing the Enable Remote Login with Password option.

[!WARNING] Disabling password login before validating key-based access leaves nobody able to reach the CVM command line. Add keys, prove they work, then lock down. Never the other way round.

Lockdown can be managed from Prism Element for a cluster and from Prism Central across clusters, which is the scalable option for an estate.

Data-at-Rest Encryption

Data-at-rest encryption protects data on the physical drives, so that a drive removed from a node — failed, replaced, decommissioned, or stolen — is unreadable.

Nutanix offers software-based encryption using AES-256, which means the capability does not depend on buying self-encrypting drives. Self-encrypting drives (SEDs) remain an option where an organization already standardizes on them.

Key management is the real decision

Encryption is easy; key management is the design choice:

The principle to carry into the exam: encryption without key management is not a security control. If the keys sit beside the data with no separation, a policy requiring that separation is not satisfied.

What it does and does not protect

Data-at-rest encryption protects physical media. It does not protect against an authenticated user reading data they have legitimate access to, and it is not a substitute for RBAC, network segmentation, or Flow policy. A question that describes limiting which administrators can see which VMs is an RBAC question, not an encryption question.

Access Control

Covered in depth in section 3.2, and named here because Objective 3.1 counts it among the security options:

• Role-based access control assigns permissions through roles rather than to individuals, with built-in roles plus custom roles in Prism Central.
• Directory services integration with Active Directory or LDAP means accounts and their lifecycle live in the directory rather than as local users on the cluster.
• Local break-glass accounts should exist, be few, and be tightly controlled — they are how you recover when the directory is unreachable.
• Least privilege is the assignment principle: give a role the minimum scope the job requires.

The Recycle Bin

The Recycle Bin, available from AOS 5.18 onward, is a safety net for accidental deletion. When a guest VM is deleted, its configuration file and its vDisks are retained for up to 24 hours rather than being destroyed immediately.

What this means in practice:

• A VM deleted by mistake can be recovered within that window.
• Space consumed by a deleted VM is not reclaimed instantly, which occasionally surprises administrators watching capacity after a bulk cleanup.

[!IMPORTANT] The Recycle Bin is not backup. Its retention is a day, and it protects only against deletion — not corruption, not ransomware, not a failure discovered a week later. Snapshots, protection domains, and a backup product remain necessary.

Summary Table