NCP-AIO Installation and Deployment Practice Question
An AI infrastructure team is preparing an air-gapped data center to install the NVIDIA GPU Operator. They have mirrored all required container images into a private registry. During installation, the Operator's pods fail with ImagePullBackOff because the components still reference images under nvcr.io. Which configuration is required to make the Operator and its managed components pull from the private registry?
⚠ Common exam trap
The trap here is believing that a network-level redirection such as DNS or a pull policy change can substitute for rewriting the actual image repository references and supplying registry credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set the chart values for the image repository and tag for each component, and provide an image pull secret in the Operator namespace.
Air-gapped installs require pre-mirroring every image and rewriting all image references in the Helm values to the private registry, including the Operator and each managed component. Authentication to the private registry is supplied through an image pull secret placed in the Operator namespace so the kubelet can pull. DNS tricks, pull policy changes, or imagined auto-mirroring do not redirect image references and leave the components failing.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable the Operator's auto-mirroring feature so it copies images from nvcr.io at runtime.
Why it's wrong here
The GPU Operator has no auto-mirroring capability that fetches images from the internet during installation. In an air-gapped environment there is no path to nvcr.io at all, so images must be mirrored ahead of time and the manifests must reference the private registry explicitly.
- ✓
Set the chart values for the image repository and tag for each component, and provide an image pull secret in the Operator namespace.
Why this is correct
In an air-gapped installation, every component image reference must be overridden to point at the private registry, including the Operator itself and the driver, toolkit, device plugin, and DCGM exporter images. The pull secret must exist in the namespace so kubelet can authenticate. Without these overrides the manifests still name nvcr.io and pulls fail.
- ✗
Configure a DNS override so nvcr.io resolves to the private registry's IP address.
Why it's wrong here
DNS redirection does not satisfy registry authentication or repository path layout, and the private registry would not serve the expected nvcr.io paths or TLS certificates. This approach is fragile and unsupported; the correct method is to rewrite the image references in the Helm values to the private registry.
- ✗
Add nvcr.io to the cluster's imagePullPolicy as Never.
Why it's wrong here
imagePullPolicy is a per-container setting with values Always, IfNotPresent, or Never; it is not a cluster-wide list of registries. Setting it to Never would prevent pulling entirely and rely on images already cached on nodes, which is not a supported way to redirect pulls to a private registry.
About these practice questions
One of 309 original NCP-AIO practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official NVIDIA exam blueprint
This NCP-AIO practice question is part of Courseiva's free NVIDIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NCP-AIO exam.