Nutanix_NCP_DB_breakdown_25 - itnett/FTD02H-N GitHub Wiki

Here’s a detailed breakdown of Section 6 – Administer an NDB Environment, Objective 6.5: Manage Access Controls in NDB. This section focuses on managing access controls within Nutanix Database Service (NDB), including understanding roles, creating custom roles, managing users and groups, mapping users to groups, and sharing entities.

Objective 6.5: Manage Access Controls in NDB

1. Understand Access Controls and Roles

What It Is:
- Understanding access controls and roles involves knowing how permissions are structured and assigned within NDB. Access controls determine what users and groups can do within the NDB environment, while roles group these permissions to simplify management.
Key Concepts:
- Roles: A role is a collection of permissions that can be assigned to users or groups. Roles define what actions can be performed and what resources can be accessed.
- Permissions: Permissions are specific rights or actions that a user can perform, such as creating a database, managing snapshots, or accessing certain configurations.
- Access Controls: These are mechanisms that enforce who can access what resources and what operations they can perform within NDB.
Key Considerations:
- Understand the default roles provided by NDB and when it is necessary to create custom roles.
- Roles should be assigned based on the principle of least privilege, giving users the minimum necessary access to perform their tasks.
What It Is Not:
- It is not about assigning permissions directly to individual users; roles are used to group permissions for easier management.
- It is not static; roles and access controls should be regularly reviewed and updated as organizational needs change.
Reference:
- Privileges and Permissions

2. Create Custom Roles

What It Is:
- Creating custom roles involves defining new roles within NDB that cater to specific organizational needs, beyond the default roles provided by NDB. Custom roles are used to tailor access permissions more precisely.
Key Steps:
- Identify the Need for Custom Roles: Determine when the default roles are insufficient for specific use cases or when finer-grained control is needed.
- Define Role Permissions: Specify the exact permissions that the custom role should include, such as database management, network configuration, or user management.
- Create the Role in NDB: Use the NDB interface to create the new role, assigning the defined permissions.
- Assign the Role: Apply the custom role to users or groups as needed, ensuring that the role aligns with their responsibilities.
Key Considerations:
- Custom roles should be created with security in mind, ensuring that users are only granted the access necessary for their job functions.
- Regularly review custom roles to ensure they remain relevant and secure as organizational needs evolve.
What It Is Not:
- It is not about assigning roles to users; this step focuses on defining the role itself.
- It is not a one-time setup; custom roles should be revisited periodically to ensure they still meet the organization’s needs.
Reference:
- Creating a Role

3. Create Users and Groups

What It Is:
- Creating users and groups in NDB involves setting up individual user accounts and organizing them into groups to manage access more efficiently. Groups allow for easier assignment of roles and permissions to multiple users at once.
Key Steps:
- Create Users: In the NDB interface, add new users by specifying their credentials, contact information, and any initial roles or permissions they should have.
- Create Groups: Define groups that reflect organizational structures, such as departments or teams, and assign users to these groups.
- Assign Roles to Groups: Once users are organized into groups, assign roles to these groups to streamline permission management.
Key Considerations:
- Group users based on their roles and responsibilities to simplify the management of permissions and roles.
- Ensure that user accounts and groups are regularly audited to maintain security and compliance.
What It Is Not:
- It is not just about creating user accounts; the focus is also on organizing users into groups for efficient management.
- It is not about assigning individual permissions directly to users; roles should be used to manage permissions consistently.
Reference:
- Adding a User
- Adding, Updating, and Removing a Group

4. Map Users and Groups

What It Is:
- Mapping users and groups involves linking user accounts and groups to the appropriate roles and permissions within NDB. This ensures that users have the correct access based on their group membership.
Key Steps:
- Assign Users to Groups: Map individual users to the appropriate groups based on their roles within the organization.
- Map Groups to Roles: Ensure that each group is associated with the correct roles, granting the necessary permissions to perform their tasks.
- Verify Access: After mapping, verify that users and groups have the correct access and that there are no conflicts or over-permissions.
Key Considerations:
- Regularly review mappings to ensure that they reflect any organizational changes, such as team restructuring or role changes.
- Mapping should be done with the principle of least privilege in mind to minimize security risks.
What It Is Not:
- It is not about creating new users or roles; it’s about ensuring that existing users and groups are correctly linked to the appropriate roles.
- It is not static; mappings should be regularly reviewed and updated as necessary.
Reference:
- Configuring Active Directory Access

5. Share Entities

What It Is:
- Sharing entities in NDB refers to granting access to specific NDB resources (such as databases, snapshots, or profiles) to users or groups. This allows for controlled sharing of resources across different teams or departments while maintaining security and compliance.
Key Steps:
- Identify Entities to Share: Determine which resources need to be shared and with whom (e.g., specific users or groups).
- Set Sharing Permissions: Use NDB to configure the sharing settings, specifying what actions the users or groups can perform on the shared entities (e.g., view, modify, manage).
- Monitor Shared Access: Regularly review the sharing settings to ensure that only the intended users have access and that there are no unauthorized modifications.
Key Considerations:
- Ensure that shared access is granted based on the minimum necessary permissions to maintain security and data integrity.
- Regularly audit shared entities to ensure that access remains appropriate and secure.
What It Is Not:
- Sharing entities is not about general access control management; it focuses on specific resources within NDB.
- It is not a one-time task; shared entities should be regularly reviewed and adjusted as needed.
Reference:
- NDB Entity Sharing

Summary of Key References

Privileges and Permissions: Guide on the roles, permissions, and access control mechanisms within NDB.
Creating a Role: Steps for creating custom roles in NDB to define specific permissions and access controls.
Adding a User: Instructions for creating and managing user accounts within NDB.
Adding, Updating, and Removing a Group: Guide on managing user groups in NDB for efficient access control.
Configuring Active Directory Access: Instructions on integrating Active Directory with NDB to manage users and groups.
NDB Entity Sharing: Guide on sharing NDB resources with users and groups, including configuring access permissions.

Key Takeaways for Exam Preparation

Access Control Understanding: Be familiar with how access controls and roles are structured within NDB, and how to manage them effectively.
Role and Group Management: Know how to create custom roles and organize users into groups for efficient permission management.
Entity Sharing: Understand how to share specific NDB resources securely, ensuring that permissions are correctly configured and monitored.

By mastering these concepts related to managing access controls in NDB, you’ll be well-prepared to answer questions related to Objective 6.5 on the NCP-DB 6.5 exam.