NCP-AII · Domain 3 of 5

NCP-AII Domain 3: Control Plane Installation and Configuration

Domain 3 covers the software that turns racked servers into a managed cluster: Base Command Manager with high availability, OS install, Slurm with Enroot and Pyxis, GPU and DOCA drivers, the container toolkit and NGC CLI.

Exam weight
19%
Official objectives
7
Estimated questions estimate
~14
Suggested study time estimate
15–22 hrs

About 13 min read Reviewed October 2026

Overview

Control Plane Installation and Configuration covers the software layers between bare hardware and user jobs. NVIDIA lists seven objectives. The first is installing NVIDIA Base Command Manager (BCM), configuring it and verifying a high-availability pair of head nodes. Then come installing the operating system and installing the cluster itself, which means defining node categories, configuring network interfaces and installing Slurm with Enroot and Pyxis so users can run containers through the scheduler. The remaining objectives cover installing, updating and removing NVIDIA GPU drivers and DOCA drivers, installing the NVIDIA Container Toolkit, demonstrating GPU use with Docker, and installing the NGC CLI on hosts to pull containers and models from the NGC catalog.

At 19%, this is the third-largest domain, about 14 questions. Its tools are used throughout the testing work in Domain 4.

How it's tested

This domain is tested through installation and configuration scenarios. A question describes a BCM cluster, a Slurm job or a container that does not behave as expected, and asks which component, command or setting to change. Knowing the order in which layers are installed and which tool owns each setting is the core skill.

  • Find the owning layer

    A symptom such as a missing GPU in a container is described, and you decide whether the driver, toolkit, runtime or scheduler is at fault.

  • Change it in BCM

    A configuration must apply to many nodes, and you pick the category, software image or interface setting in BCM.

  • Verify the install

    After an install step, you choose the command that proves it worked, such as nvidia-smi inside a container or cmha status.

Reasoning it through

Users report that srun --container-image fails on every compute node, while plain srun jobs work. Slurm itself is healthy, so the problem lies in the container integration. Pyxis provides the --container-image option and calls Enroot to import and start the image. The engineer should confirm that Pyxis is installed and enabled in the Slurm plugin configuration and that Enroot is present in the node software image.

Objectives 7

Official objectives from the NVIDIA outline, in outline order.

3.1 Install BCM, configure, and verify HABase Command Manager head node install and a high-availability head node pair.
What it means
This covers installing NVIDIA Base Command Manager on a head node, completing its initial configuration, adding a second head node and verifying that high availability works with failover between the active and passive head nodes.
What to understand
BCM manages provisioning, monitoring and configuration from the head node through cmsh and Base View. In an HA setup two head nodes share state, one active and one passive, with a shared or replicated store and a failover mechanism. Verification means checking HA status and testing a controlled failover before production use.
How it shows up
A head node failure or HA setup step is described, and you choose the right configuration or check.
Common confusion
Assuming HA is complete once the second head node is installed, without testing failover.
3.2 Install OSInstalling the base operating system on head and compute nodes.
What it means
This covers installing a supported Linux distribution such as DGX OS or Ubuntu on head nodes and compute nodes, either directly or by building BCM software images that are provisioned to nodes over the network.
What to understand
In a BCM cluster, compute nodes normally boot over the network and receive a software image, so OS changes are made in the image and pushed rather than made by hand on each node. The OS version must be supported by the GPU driver, DOCA and storage client versions you plan to run.
How it shows up
An OS change or version choice is described, and you decide where and how it should be applied.
Common confusion
Making manual changes on one compute node that are overwritten at the next provisioning.
3.3 Install Cluster (configure category, configure interfaces, install Slurm/Enroot/Pyxis)BCM categories, node interfaces and the Slurm container stack.
What it means
This covers building the cluster in BCM: defining node categories that group settings and software images, configuring the network interfaces nodes use for management, compute and storage, and installing the Slurm workload manager with Enroot and Pyxis for containerized jobs.
What to understand
A category applies shared settings to many nodes, so changes there reach every member. Interfaces must map to the right networks and IP ranges. Slurm schedules jobs, Enroot turns container images into unprivileged sandboxes, and Pyxis is the Slurm plugin that adds options like --container-image to srun.
How it shows up
A cluster build task or a failing containerized Slurm job is described, and you pick the component or setting.
Common confusion
Confusing Enroot, which runs containers, with Pyxis, which connects Slurm to Enroot.
3.4 Install/update/remove NVIDIA GPU and DOCA driversManaging GPU driver, Fabric Manager and DOCA host packages.
What it means
This covers installing, upgrading and cleanly removing the NVIDIA GPU driver and the DOCA host driver stack for ConnectX and BlueField devices, including related packages such as Fabric Manager on NVSwitch-based systems.
What to understand
Driver versions must match the CUDA and container needs of the cluster, and on HGX and DGX systems with NVSwitch the Fabric Manager version must match the GPU driver exactly. DOCA host packages replace the older standalone networking driver stack. Removal must be complete, including kernel modules, before installing a different branch.
How it shows up
A version mismatch or failed upgrade is described, and you choose the install, update or removal step.
Common confusion
Upgrading the GPU driver without upgrading Fabric Manager to the matching version.
3.5 Install the NVIDIA container toolkitEnabling container runtimes to access GPUs.
What it means
This covers installing the NVIDIA Container Toolkit and configuring a container runtime such as Docker or containerd to use it, so containers can access GPUs and driver libraries from the host.
What to understand
The toolkit does not include the GPU driver; the driver stays on the host and is mounted into containers. After installing the toolkit, the runtime must be configured, for example with nvidia-ctk runtime configure, and the runtime service restarted before containers can use GPUs.
How it shows up
A container cannot see GPUs, and you identify the missing toolkit or runtime configuration step.
Common confusion
Installing the GPU driver inside the container image instead of using the host driver.
3.6 Demonstrate how to use NVIDIA GPUs with DockerRunning GPU containers and selecting devices.
What it means
This covers running GPU-enabled containers with Docker, using the --gpus option to expose all GPUs or specific devices, and verifying access by running nvidia-smi or a CUDA sample inside the container.
What to understand
The --gpus all option exposes every GPU, while a device list limits the container to chosen GPUs. A container image's CUDA version must be supported by the host driver. Running nvidia-smi in the container is the standard quick check that the toolkit and runtime work together.
How it shows up
A docker run command or its output is shown, and you choose the correction or interpret the result.
Common confusion
Expecting a container built for a newer CUDA version to run on an older host driver.
3.7 Install NGC CLI on hostsCommand-line access to the NVIDIA NGC catalog.
What it means
This covers installing the NGC CLI on cluster hosts, configuring it with an API key, organization and team, and using it to list and download containers, models and resources from NGC.
What to understand
The NGC CLI is configured with ngc config set and an API key generated in the NGC portal. Pulling containers from nvcr.io with Docker or Enroot needs registry credentials, using $oauthtoken as the username and the API key as the password. Keys should be protected like any other credential.
How it shows up
A host cannot pull from NGC, and you pick the missing configuration or authentication step.
Common confusion
Using a personal NGC password instead of an API key for the CLI or registry.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Base Command Manager

    NVIDIA cluster manager for provisioning, configuration and monitoring.

    Remember
    Managed through cmsh and Base View from the head node.
    Tested as
    Cluster build questions.
    Trap
    Treating it as a job scheduler.

  • BCM high availability

    Active and passive head nodes with failover.

    Remember
    Verify by checking status and testing failover.
    Tested as
    HA questions.
    Trap
    Calling HA done without a failover test.

  • Node category

    A BCM grouping that applies settings and a software image to many nodes.

    Remember
    Change the category, not single nodes.
    Tested as
    Configuration scope questions.
    Trap
    Editing nodes one by one.

  • Software image

    The OS image BCM provisions to nodes.

    Remember
    Manual node changes are lost at reprovision.
    Tested as
    OS change questions.
    Trap
    Patching a live node only.

  • Slurm

    The workload manager that schedules jobs on compute nodes.

    Remember
    BCM can install and configure it.
    Tested as
    Scheduling questions.
    Trap
    Confusing it with the cluster manager.

  • Enroot

    Turns container images into unprivileged sandboxes for HPC jobs.

    Remember
    No root daemon required.
    Tested as
    Container questions.
    Trap
    Mixing it up with Pyxis.

  • Pyxis

    Slurm SPANK plugin that runs Enroot containers from srun.

    Remember
    Adds --container-image to srun.
    Tested as
    Container job questions.
    Trap
    Thinking it is a container runtime.

  • Fabric Manager

    Service that configures NVSwitch fabrics on HGX and DGX systems.

    Remember
    Version must match the GPU driver.
    Tested as
    Driver upgrade questions.
    Trap
    Leaving it at an old version.

  • DOCA host packages

    NVIDIA networking driver and SDK stack for ConnectX and BlueField.

    Remember
    Install on hosts that use these adapters.
    Tested as
    Network driver questions.
    Trap
    Mixing it with an old driver stack.

  • NVIDIA Container Toolkit

    Lets container runtimes use host GPUs and driver libraries.

    Remember
    Configure the runtime and restart it.
    Tested as
    Container GPU questions.
    Trap
    Installing drivers in images.

  • docker run --gpus

    Exposes all or selected GPUs to a container.

    Remember
    Use device lists to restrict access.
    Tested as
    Docker questions.
    Trap
    Omitting the option and expecting GPUs.

  • NGC CLI and registry login

    CLI configured with an API key; registry login uses $oauthtoken.

    Remember
    API key, not account password.
    Tested as
    NGC access questions.
    Trap
    Using the wrong username.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Container stack components

ConceptMeaningKey differenceCommon trap
NVIDIA Container Toolkit Connects runtimes to host GPUs Not a runtime itself Thinking it contains the driver
Docker General container engine Uses --gpus with the toolkit Forgetting to restart after configuring
Enroot Unprivileged HPC container runtime No daemon, converts images Confusing it with Pyxis
Pyxis Slurm plugin for Enroot Adds container options to srun Treating it as a runtime

BCM configuration scope

ConceptMeaningKey differenceCommon trap
Node One machine's settings Narrowest scope Using it for fleet-wide changes
Category Shared settings for a node group Applies to all members Editing nodes instead
Software image OS content provisioned to nodes Persists across reprovisioning Patching live nodes only

Driver components

ConceptMeaningKey differenceCommon trap
GPU driver Kernel modules and libraries for GPUs Sets maximum CUDA support Mismatching container CUDA
Fabric Manager NVSwitch fabric service Must equal driver version Upgrading driver alone
DOCA host Network adapter and DPU drivers Separate from GPU driver Assuming GPU driver covers NICs

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Driver in the image

    What candidates pick
    Add the GPU driver to the container image to fix missing GPUs.
    Why it looks right
    The container needs driver libraries.
    Why it's wrong
    The host driver is mounted into containers by the toolkit; drivers inside images conflict with the host kernel module.

    Clue to watch for Containers lack GPUs while the host nvidia-smi works.

  2. Edit the node

    What candidates pick
    Fix a package problem by logging into each compute node.
    Why it looks right
    It works immediately.
    Why it's wrong
    BCM reprovisions nodes from their software image, so manual edits disappear unless the image or category is changed.

    Clue to watch for The cluster is managed by BCM.

  3. Pyxis runs containers

    What candidates pick
    Install only Pyxis to run containers through Slurm.
    Why it looks right
    Pyxis provides the srun option.
    Why it's wrong
    Pyxis depends on Enroot to import and run images; without Enroot the job cannot start.

    Clue to watch for The error appears when the container starts.

  4. Driver upgrade alone

    What candidates pick
    Upgrade only the GPU driver on an NVSwitch system.
    Why it looks right
    The driver is the main package.
    Why it's wrong
    Fabric Manager must run the same version, or the NVSwitch fabric does not initialize and GPUs are unusable for multi-GPU work.

    Clue to watch for The system is HGX or DGX with NVSwitch.

  5. Install equals HA

    What candidates pick
    Treat HA as finished after adding the second head node.
    Why it looks right
    Both head nodes are running.
    Why it's wrong
    HA is only proven when status checks pass and a controlled failover succeeds.

    Clue to watch for The question asks how to verify HA.

  6. Password for NGC

    What candidates pick
    Log into nvcr.io with the NGC account password.
    Why it looks right
    It is the familiar credential.
    Why it's wrong
    The registry expects $oauthtoken as username and an NGC API key as password.

    Clue to watch for Authentication fails when pulling from nvcr.io.

Answer framework

Use these steps to find the correct layer and fix for a control plane scenario.

  1. Place the problem in the stack: BCM head nodes, OS and software image, Slurm and its container plugins, drivers, container runtime or NGC access.
  2. If the change applies to many nodes, make it in the BCM category or software image rather than on a single node.
  3. For driver issues, check version compatibility first, including Fabric Manager on NVSwitch systems and DOCA on nodes with ConnectX or BlueField adapters.
  4. For container issues, confirm the host driver works, the toolkit is installed, the runtime is configured and restarted, and Enroot and Pyxis are present for Slurm jobs.
  5. Verify with the command that proves the layer works, such as an HA status check, nvidia-smi in a container or an NGC download.

Practice question

After installing the NVIDIA Container Toolkit on a node with a working GPU driver, an engineer runs docker run --gpus all with a CUDA base image and gets an error that no GPU runtime is available. What is the most likely missing step?

Want more like this? The NCP-AII practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Study this domain in the order you would build a cluster. Start with Base Command Manager: read the BCM installation and administrator manuals listed on the certification page, then install a small test cluster if you can, even in virtual machines. Learn cmsh basics, how categories and software images work, and how to set up and test head node HA.

Next, install Slurm through BCM and add Enroot and Pyxis. Run a plain srun job, then a containerized one, and note which component produces which error when something is missing. This hands-on contrast is what the exam tests.

Then practice driver work on a GPU host. Install a driver branch, check it with nvidia-smi, remove it completely and install another. On NVSwitch systems, review why Fabric Manager must match the driver. Install the DOCA host packages on a node with a ConnectX adapter. Finish with the container toolkit, docker run --gpus variations and NGC CLI setup. Keep a short table of each component, what it does and how you verify it, and review it before practice tests.

FAQ

How much of the NCP-AII is Control Plane Installation and Configuration?

Control Plane Installation and Configuration is 19% of the NCP-AII, about 14 of the 70 to 75 questions, making it the third-largest domain.

What is Base Command Manager?

NVIDIA Base Command Manager is the cluster management software used to provision nodes, manage software images and categories, monitor the cluster and install workload managers such as Slurm.

What are Enroot and Pyxis?

Enroot is a lightweight tool that runs container images as unprivileged sandboxes. Pyxis is a Slurm plugin that lets users start Enroot containers directly from srun.

Why must Fabric Manager match the driver?

On NVSwitch-based systems, Fabric Manager configures the switch fabric and works closely with the GPU driver. A version mismatch prevents the fabric from initializing correctly.

Does the exam cover Kubernetes?

The published objectives for this domain name Slurm, Enroot and Pyxis, Docker and the container toolkit. Kubernetes is not named in the current objective list, so focus on the listed tools.

What does the container toolkit actually do?

It lets container runtimes such as Docker use the host's GPUs by mounting the driver libraries and devices into containers at start time.

How do I authenticate to NGC?

Generate an API key in the NGC portal, configure the CLI with ngc config set, and log into nvcr.io using $oauthtoken as the username and the key as the password.

Other Artificial Intelligence & Machine Learning certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered BCM with HA, OS images, categories, Slurm with Enroot and Pyxis, drivers, the container toolkit and NGC. Check whether you can find the faulty layer quickly.

Take the NCP-AII practice test Check your NCP-AII readiness

Keep going