305-300 Practice Test 14 — 15 Questions

Question 1

Which THREE networking modes are natively supported by Docker?

Accepted Answer

bridge. Docker natively supports the bridge network driver (A), which creates a private internal network on the host and is the default mode for containers, allowing them to communicate via the docker0 virtual bridge. Docker also natively supports the none mode (D), which gives a container no network stack except a loopback interface, isolating it from all networking. The host mode (E) is natively supported as well, removing network isolation so the container shares the host's network namespace and IP stack directly. The gateway (B) and tunnel (C) options are not Docker network drivers; gateway is a role or address concept rather than a mode, and tunnel describes overlay/VPN-style connectivity (e.g., Docker overlay or third-party plugins) rather than a native standalone Docker networking mode.

Answer

gateway

Answer

tunnel

Question 2

Which TWO types of namespaces are commonly used to achieve container isolation in Linux?

Accepted Answer

Network. Network namespaces (B) are correct because they give each container its own isolated network stack — separate interfaces, IP addresses, routing tables, and firewall rules — which is a core mechanism used by tools like Docker and Kubernetes for container isolation. PID namespaces (D) are also correct because they isolate the process ID number space, so processes inside a container only see their own PID tree (starting at PID 1) and cannot see or signal host processes. The other options do not belong: GPU (A) and CPU (C) are hardware resources managed via cgroups and device access, not namespace types, and Kernel (E) is not a Linux namespace — the kernel itself is shared, with namespaces isolating specific global resources like mount, UTS, IPC, user, network, and PID.

Answer

GPU

Answer

CPU

Answer

Kernel

Question 3

Which TWO of the following are benefits of using the QCOW2 image format?

Accepted Answer

Dynamic allocation (sparse files). Option C is correct because QCOW2 (QEMU Copy-On-Write version 2) is a sparse image format: it allocates disk blocks only as guest data is actually written, so a 100 GB virtual disk consumes only as much host space as the data stored in it, and it can grow dynamically up to the configured virtual size. Option E is correct because QCOW2 natively supports internal snapshots (stored inside the image file) and external snapshots, allowing point-in-time states of a VM disk to be created and reverted without copying the whole image. Option A is wrong because multi-host file locking is a feature of clustered/shared storage filesystems such as GFS2 or OCFS2, not of the QCOW2 format itself; QCOW2 images are not designed for concurrent write access from multiple hosts. Option B is wrong because hardware acceleration (for example KVM, Intel VT-x/AMD-V, or virtio) is provided by the hypervisor and CPU, not by the image file format. Option D is wrong because QCOW2 does not provide native encryption for all filesystems; encryption in QEMU/KVM is typically handled via LUKS or the qcow2 encryption extension (AES-CBC with a single key), which is not a general 'all filesystems' encryption feature.

Answer

Multi-host file locking

Answer

Hardware acceleration

Answer

Native encryption for all filesystems

Question 4

Which THREE items are typically included in an OpenVZ configuration file?

Accepted Answer

User Beancounters (resource limits). In an OpenVZ container configuration file (typically /etc/vz/conf/<CTID>.conf), User Beancounters (option B) are included as resource limits such as kmemsize, privvmpages, and numproc, which control how much memory, processes, and other resources the container may consume. The OS template reference (option C) is also included, usually via the OSTEMPLATE parameter, which records which OS template (e.g., centos-7-x86_64) was used to create the container and is needed for operations like reinstalling or rebuilding it. Networking parameters (option D) are included as well, with entries such as IP_ADDRESS, HOSTNAME, and NETIF to define the container's IP addressing and virtual network interface. BIOS settings (option A) are not part of an OpenVZ configuration file because OpenVZ containers are OS-level virtualizations that share the host kernel and do not have their own BIOS or firmware. Kernel source code (option E) is likewise not included, since containers use the host's kernel and the configuration file only stores container-specific runtime and resource parameters, not kernel source.

Answer

BIOS settings

Answer

Kernel source code

Question 5

Which TWO commands are valid for inspecting container network settings?

Accepted Answer

docker inspect. Option A, `docker inspect`, is correct because it returns the full JSON configuration of a container, including its NetworkSettings section with IP address, gateway, MAC address, and attached networks. Option E, `docker network inspect`, is correct because it inspects a Docker network object and shows connected containers, subnet, gateway, and driver details. Options B, C, and D are not valid Docker CLI commands, so they cannot be used to inspect container network settings.

Answer

docker show net

Answer

docker net status

Answer

docker list network

Question 6

Which TWO of the following are valid container orchestration platforms?

Accepted Answer

Kubernetes. Kubernetes (B) is a valid container orchestration platform because it schedules and manages containers across a cluster of nodes, handling deployment, scaling, service discovery, and self-healing via components like the kube-apiserver, kubelet, and etcd. Nomad (D) is also a valid orchestration platform, as HashiCorp Nomad schedules and runs containerized and non-containerized workloads across a cluster using job specifications and drivers such as Docker. Nginx (A) is a web server and reverse proxy, not an orchestrator, though it can act as an ingress/load balancer in front of orchestrated workloads. Docker Desktop (C) is a local development environment for building and running containers on a single machine, not a cluster orchestration platform. GitLab (E) is a DevOps/CI-CD platform and Git repository manager, not a container orchestrator, even though it can integrate with Kubernetes.

Answer

Nginx

Answer

Docker Desktop

Answer

GitLab

Question 7

Which THREE configuration items can be managed via cloud-init 'write_files' module?

Accepted Answer

Target path (path). The cloud-init write_files module is designed to create arbitrary files on an instance during boot, and each file entry is defined by three key attributes: the destination path (option A, 'path'), the file's permissions (option C, 'permissions'), and the file's content (option E, 'content'). The 'path' specifies where the file is written on the filesystem, the 'permissions' sets the octal mode (e.g., '0644') applied to the file, and 'content' supplies the actual data written to that file. Options B and D are incorrect because service status is managed by cloud-init's 'runcmd' or systemd/service modules, and kernel parameters are handled by the 'sysctl' module or bootloader configuration, not by write_files.

Answer

Service status

Answer

Kernel parameters

Question 8

Which THREE of the following are necessary to enable QEMU guest agent integration?

Accepted Answer

Installing qemu-guest-agent inside the guest. Option A is correct because the QEMU guest agent requires the qemu-guest-agent package (or equivalent, e.g., qemu-ga) to be installed and running inside the guest OS so it can communicate over the virtio-serial channel. Option B is correct because the VM's libvirt XML must define a channel device of type 'unix' with the target name 'org.qemu.guest_agent.0' (typically using a virtio-serial port) to provide the host-guest communication path. Option D is correct because the channel device is only instantiated at VM start, so the guest must be restarted (or the domain rebooted) for the new channel to become available and the agent to connect. Option C is not required because the guest agent uses a virtio-serial channel, not a network bridge, so no bridge configuration is needed. Option E is not required because VNC password authentication is unrelated to guest agent integration and only affects graphical console access.

Answer

Adding a network bridge

Answer

Enabling VNC password

Question 9

Which TWO methods can be used to pass configuration data to cloud-init during instance creation?

Accepted Answer

user-data. Option B (user-data) is correct because cloud-init's primary mechanism for receiving instance-specific configuration at launch is the user-data blob, which can contain cloud-config YAML, shell scripts, or cloud-boothook directives that cloud-init parses on first boot. Option E (metadata) is correct because cloud-init also consumes instance metadata (for example, EC2 IMDS or OpenStack metadata service) to obtain configuration such as hostname, SSH keys, and network settings during initialization. Option A (kernel-args) is not a standard cloud-init configuration channel, since kernel command-line parameters are used for boot-time kernel behavior rather than passing structured config data to cloud-init. Option C (bios-injection) is not a supported cloud-init datasource method, as BIOS settings are firmware-level and not used to deliver cloud-init configuration. Option D (sys-config) is not a recognized cloud-init mechanism; no such datasource or configuration-passing method exists in cloud-init's documented interfaces.

Answer

kernel-args

Answer

bios-injection

Answer

sys-config

Question 10

Which TWO of the following are true regarding container orchestration platforms?

Accepted Answer

They automate container deployment. Option B is correct because container orchestration platforms such as Kubernetes, Docker Swarm, and Amazon ECS are specifically designed to automate the deployment, scheduling, and scaling of containers across a cluster of hosts. Option D is correct because these platforms continuously monitor container health through liveness and readiness probes (e.g., Kubernetes livenessProbe/readinessProbe) and automatically restart or reschedule unhealthy containers to maintain the desired state. Option A is incorrect because orchestration platforms sit above and consume a container runtime such as containerd or CRI-O rather than replacing it. Option C is incorrect because orchestration platforms can run on bare metal, virtual machines, or cloud instances. Option E is incorrect because orchestration platforms are designed to manage many different container images simultaneously, not a single image.

Answer

They replace the container runtime

Answer

They only run on bare metal

Answer

They require a single container image

Question 11

What is the purpose of 'virt-top'?

Accepted Answer

To show real-time statistics for VMs. virt-top is a command-line utility that provides real-time performance statistics for virtual machines managed by libvirt. It is modeled after the Unix top command and displays metrics such as CPU usage, memory allocation, and I/O activity for each running guest. This allows administrators to monitor VM resource consumption dynamically, similar to how top monitors processes on a physical host.

Answer

To manage network bridges

Answer

To edit VM configuration files

Answer

To install new guest OSs

Question 12

Which command checks the status of the libvirtd service?

Accepted Answer

systemctl status libvirtd. The command `systemctl status libvirtd` is correct because on modern Linux distributions using systemd, `systemctl` is the standard tool to query the status of a service unit. It provides detailed information including whether the service is active, its PID, recent log entries, and any dependencies. Since libvirtd is typically managed as a systemd unit, this command directly checks its runtime state.

Answer

service libvirtd status

Answer

libvirtd --check

Answer

virsh service-status

Question 13

Which TWO of the following are true regarding the differences between rkt (Rocket) and Docker?

Accepted Answer

rkt utilized a daemonless architecture. Option D is correct because rkt was designed with a daemonless architecture, meaning containers were launched directly by the rkt CLI process without a long-running central daemon like Docker's dockerd. Option E is correct because rkt natively understood the concept of a Pod (a group of co-located containers sharing namespaces), which aligned with Kubernetes' Pod abstraction and allowed rkt to run Kubernetes Pods directly via its pod manifest support. Options A, B, and C are incorrect: rkt supported multiple image formats (including Docker images and ACI), Docker is not a sub-project of rkt (they are independent, competing container runtimes), and Docker has always relied on a daemon (dockerd) to manage containers.

Answer

rkt only supported binary images

Answer

Docker is a sub-project of rkt

Answer

Docker never had a daemon

Question 14

In a FreeBSD Jail, how can you ensure the jail starts automatically at boot?

Accepted Answer

Set jail_enable=YES in /etc/rc.conf. On FreeBSD, the rc system reads /etc/rc.conf at boot, and setting `jail_enable="YES"` activates the jail subsystem so that jails defined in /etc/jail.conf (or jail_* variables) are started by the rc.d/jail script. Without this flag, jails must be started manually with `service jail start` or `jexec`.

Answer

Create a symlink in /etc/init.d

Answer

Use systemd

Answer

Add a cron job

Question 15

Which TWO of the following are common ways to connect to a virtual machine's console?

Accepted Answer

VNC. VNC (Option B) is correct because it is a widely used remote framebuffer protocol that provides graphical console access to a virtual machine, commonly exposed by hypervisors such as KVM/QEMU, Xen, and VMware for out-of-band console connections. Spice (Option E) is also correct because it is a remote-display protocol designed specifically for virtualized environments (notably KVM/QEMU via libvirt) that delivers the VM's graphical console, including keyboard, video, and mouse. Telnet (Option A) is a text-based terminal protocol for remote shell access, not a VM graphical console mechanism, and it is insecure besides. HTTP (Option C) is an application-layer protocol for serving web content, not a console-connection method. FTP (Option D) is a file-transfer protocol and has nothing to do with interactive console access.

Answer

Telnet

Answer

HTTP

Answer

FTP