305-300 Practice Test 13 — 15 Questions

Question 1

When building a Dockerfile, which instruction should be used to define the user context for subsequent RUN, CMD, and ENTRYPOINT instructions?

Accepted Answer

USER. The USER instruction in a Dockerfile sets the user (and optionally group) that subsequent RUN, CMD, and ENTRYPOINT instructions will execute as. It changes the runtime identity inside the image for all following instructions and for the container's default process. This is the standard way to drop root privileges in a container image.

Answer

WORKDIR

Answer

RUN useradd

Answer

AS

Question 2

You are building a Docker image for a Python web application. The Dockerfile currently contains:

FROM python:3.9-slim
COPY . /app
WORKDIR /app
RUN pip install -r requirements.txt
CMD ["python", "app.py"]

After building, you notice that every time you change app.py, the entire pip install step re-runs, making builds slow. Which change to the Dockerfile will best address this?

Accepted Answer

Move the COPY instruction to after the RUN pip install instruction, and copy only requirements.txt before the RUN.. Docker builds images layer by layer and caches each layer based on the instruction and the files it references. By copying only requirements.txt and running pip install before copying the rest of the source, the expensive dependency installation layer remains cached as long as requirements.txt is unchanged. Subsequent changes to application code only invalidate later layers, resulting in much faster rebuilds.

Answer

Add a .dockerignore file that excludes app.py so that changes to it do not invalidate the cache.

Answer

Use a multistage build with a separate stage for dependencies, and copy the installed packages from the builder stage into the final stage.

Answer

Combine the COPY and RUN instructions into a single RUN instruction using a shell command to copy files and install dependencies.

Question 3

Which Docker command is used to display the resource usage (CPU, memory) of running containers?

Accepted Answer

docker stats. `docker stats` is the dedicated Docker CLI subcommand that streams live resource-usage metrics for running containers, including CPU percentage, memory usage/limit, memory percentage, network I/O, block I/O, and PIDs. It reads these values from the cgroup statistics exposed by the container runtime, so it reflects actual kernel-level accounting rather than estimates. By default it shows all running containers and refreshes continuously until you press Ctrl+C.

Answer

docker top

Answer

docker usage

Answer

docker info

Question 4

Which command provides system-wide information about the Docker installation?

Accepted Answer

docker info. The `docker info` command provides system-wide information about the Docker installation, including the number of containers and images, storage driver, logging driver, kernel version, operating system, CPU and memory resources, and Docker root directory. It is the standard command for a high-level overview of the Docker daemon's configuration and state.

Answer

docker inspect

Answer

docker status

Answer

docker version

Question 5

You need to add a second NIC to a VM via XML. How do you ensure the second NIC uses a different MAC address than the first one?

Accepted Answer

Add a second block with a unique . Each network interface in a libvirt domain is defined by an element containing a child. To add a second NIC, you add another block with a unique MAC address. Libvirt can auto-generate a MAC if omitted, but explicitly specifying a unique one ensures no conflict with the first NIC.

Answer

You cannot have two NICs in one VM

Answer

Libvirt assigns the same MAC automatically

Answer

Use the same but different

Question 6

In a Vagrant environment, where should sensitive data like API keys be stored to avoid committing them to version control?

Accepted Answer

A .env file excluded from git. Sensitive data such as API keys should be stored in a .env file that is excluded from version control (e.g., via .gitignore), so secrets are not committed to the repository. This keeps credentials out of source history while still allowing the application to load them at runtime.

Answer

A box metadata file

Answer

The Vagrantfile

Answer

The provisioner script

Question 7

In a Docker swarm, which mode of service publishing allows incoming traffic to be load-balanced across all healthy container replicas?

Accepted Answer

ingress. In Docker Swarm, the ingress mode publishes a service on the routing mesh, so the port is exposed on every swarm node and incoming traffic is load-balanced across all healthy replicas of the service. This is the default publishing mode and is what enables any node to accept traffic for a service regardless of where its tasks run.

Answer

macvlan

Answer

overlay

Answer

host

Question 8

You are debugging a Docker image buildup that fails at the 'RUN' instruction due to missing network access during the build. What command option should be checked if the build environment uses a proxy?

Accepted Answer

--build-arg. Docker's build-time proxy configuration is passed via --build-arg with the predefined HTTP_PROXY, HTTPS_PROXY, and NO_PROXY arguments, which Docker automatically recognizes and injects into the build environment. The --proxy flag does not exist in docker build, so --build-arg is the correct mechanism for supplying proxy settings when RUN instructions need network access.

Answer

--proxy

Answer

--privileged

Answer

--network=host

Answer

--env-file

Question 9

When managing storage pools using virsh, which command would you use to list all defined storage pools, including those that are inactive?

Accepted Answer

virsh pool-list --all. The correct command is `virsh pool-list --all`. In libvirt's virsh CLI, `pool-list` is the dedicated subcommand for enumerating storage pools, and the `--all` flag extends the default output (which shows only active pools) to include inactive pools as well. This mirrors the pattern used by `virsh list --all` for domains, making it the canonical way to see every defined pool regardless of state.

Answer

virsh list-pools --inactive

Answer

virsh pool-info --all

Answer

virsh pool-show --all

Question 10

What is the primary function of the ENTRYPOINT instruction in a Dockerfile?

Accepted Answer

Configuring the executable that runs when the container starts. ENTRYPOINT defines the executable that runs when the container starts, making the container behave like a self-contained command. Unlike CMD, which provides default arguments that can be overridden at 'docker run', ENTRYPOINT is not replaced by command-line arguments — those arguments are appended to it. This is why ENTRYPOINT is used to configure a container as an executable.

Answer

Setting environment variables

Answer

Defining volume mount points

Answer

Specifying metadata

Answer

Installing software packages

Question 11

Which THREE of the following are valid components of a libvirt domain XML configuration?

Accepted Answer

. The element (A) is a valid top-level component of a libvirt domain XML; it defines the guest OS boot configuration such as the boot device order and the type of firmware (for example hvm or arch). The element (C) is also valid and specifies the CPU model and features exposed to the guest, such as host-passthrough or a named model like qemu64. The element (D) is a required top-level container in a libvirt domain XML that holds all guest device definitions, including disks, network interfaces, graphics, and controllers. The unmarked options do not belong: (B) is not a recognized libvirt domain XML element, and (E) is not a valid libvirt domain XML element either (network configuration is expressed through entries inside and separate libvirt network XML files).

Answer

<kernel-module>

Answer

<network-config>

Question 12

Which TWO of the following commands can be used to monitor VM resource utilization?

Accepted Answer

virsh domstats. Option A, `virsh domstats`, is correct because it queries the libvirt hypervisor for detailed per-domain statistics such as CPU time, memory balloon usage, block I/O, and network interface counters, making it a valid VM resource-utilization monitoring command. Option E, `virt-top`, is correct because it is a top-like utility that displays real-time CPU, memory, and I/O utilization for individual guests running under libvirt/KVM. The remaining options do not belong: `virsh show-stats`, `virsh monitor-cpu`, and `virsh check-load` are not valid virsh subcommands, so they cannot be used to monitor VM resource utilization.

Answer

virsh show-stats

Answer

virsh monitor-cpu

Answer

virsh check-load

Question 13

Which TWO of the following are key features of the QEMU-KVM hypervisor?

Accepted Answer

Hardware-assisted virtualization. QEMU-KVM is a combination of the KVM kernel module and the QEMU userspace emulator, and its defining feature is hardware-assisted virtualization: KVM leverages CPU virtualization extensions such as Intel VT-x (vmx) and AMD-V (svm) to run guest code directly on the host CPU, which is why option A is correct. Option B is also correct because QEMU provides comprehensive device emulation, presenting virtual hardware such as IDE/SCSI controllers, NICs (e.g., e1000, virtio-net), VGA adapters, and USB controllers to guests, and it also supports paravirtualized virtio devices for performance. The remaining options do not belong: automated host patching (C) is a configuration-management function handled by tools like Ansible, Puppet, or yum/dnf, not by the hypervisor itself; an integrated disk backup service (D) is not part of QEMU-KVM, since backups are performed with external tools such as qemu-img, libvirt snapshots, or third-party backup software; and a built-in web server (E) is not a QEMU-KVM feature, as remote management is typically provided by separate stacks like libvirt, virt-manager, or oVirt/Proxmox.

Answer

Automated host patching

Answer

Integrated disk backup service

Answer

Built-in web server

Question 14

Which THREE of the following XML elements are used to define a virtual disk in a domain?

Accepted Answer

. In libvirt domain XML, a virtual disk is defined inside a element, and the three marked options are its core components. Option A, , specifies the hypervisor driver (qemu) and the disk image format (qcow2), which tells libvirt how to handle the backing file. Option D, , defines the guest-visible device name and the bus/controller (virtio) used to attach the disk to the VM. Option E, , points to the host-side disk image file that backs the virtual disk. The unmarked options do not belong: and are used in filesystem/container or guest-agent contexts (e.g., devices for virtio-9p or virtiofs), not for defining a standard virtual disk in a domain.

Answer

<mount-point path='/'>

Answer

Question 15

Which THREE of the following are components of the Docker architecture?

Accepted Answer

Docker Daemon. Docker Daemon (A) is correct because dockerd is the persistent background service that listens for Docker API requests and manages Docker objects such as images, containers, networks, and volumes. Docker Client (C) is correct because the docker CLI is the primary user interface that sends commands to the daemon via the Docker REST API over a socket or network. Docker Registry (E) is correct because it is the storage and distribution system for Docker images, with Docker Hub as the default public registry from which images are pulled and to which they are pushed. Docker Kernel (B) is not a Docker component; Docker relies on the host OS kernel's features (namespaces, cgroups) but does not ship its own kernel. Docker GUI (D) is not a core architectural component; graphical tools like Docker Desktop or Portainer are optional third-party or wrapper interfaces, not part of the Docker architecture itself.

Answer

Docker Kernel

Answer

Docker GUI