NCP-AIO Administration Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use Kubernetes ResourceQuota and LimitRange objects to restrict GPU memory per namespace.

  Why it's wrong here

  Kubernetes ResourceQuota and LimitRange can limit CPU, memory, and extended resources such as nvidia.com/gpu, but they cannot partition or isolate GPU device memory. A quota controls how many GPUs a namespace may request, not what happens inside the GPU. Tenants sharing a GPU could still access each other's memory, so this action does not meet the isolation requirement.

• ✗

  Configure NVIDIA vGPU with different vGPU profiles for each tenant.

  Why it's wrong here

  NVIDIA vGPU is designed for virtualized environments using a hypervisor and vGPU manager, not for bare-metal Kubernetes clusters. While vGPU profiles can isolate memory, they require a virtualization layer that is not present in a standard containerized Kubernetes deployment. Applying vGPU here would not integrate with the GPU Operator's device plugin model and is architecturally mismatched for this scenario.

• ✓

  Deploy the NVIDIA GPU Operator with the device plugin configured to advertise MIG resources.

  Why this is correct

  For Kubernetes to schedule workloads onto MIG instances, the NVIDIA device plugin must advertise each MIG slice as a schedulable resource, which the GPU Operator configures via its MIG strategy setting. Without this, MIG instances exist on the GPU but are invisible to the scheduler. Enabling the device plugin to expose MIG resources is therefore a necessary action to make tenant isolation effective.

• ✓

  Enable Multi-Instance GPU (MIG) mode on supported GPUs and assign separate MIG instances to each tenant.

  Why this is correct

  MIG partitions a supported GPU into isolated instances with dedicated memory, cache, and compute slices, providing hardware-level isolation between tenants. Assigning distinct MIG instances ensures that one tenant's workloads cannot read or write another tenant's GPU memory. This directly satisfies the isolation requirement and is a correct action for multi-tenant inference on hardware that supports MIG.

• ✗

  Enable time-slicing of GPUs so that multiple tenants share the same GPU context.

  Why it's wrong here

  Time-slicing multiplexes workloads onto a single GPU by switching contexts, but all workloads share the same memory space and there is no hardware isolation between them. A tenant could potentially access another tenant's data in GPU memory. Because the requirement is strict memory isolation, time-slicing is the opposite of what is needed and would undermine the security objective.