305-300 Practice Exam 4 — 20 Questions

Question 1

You are managing a Xen host and need to live-migrate a domain between two physical servers. The migration fails with a domain lock error. Which command is the standard way to initiate a live migration while ensuring the target host is prepared to receive the domain?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

xl migrate . The xl migrate command is the standard Xen tool for live-migrating a domain to another host, and it handles the necessary preparation on the target host (such as creating the domain configuration and transferring memory state) to receive the domain. It is the direct counterpart to xm migrate in the newer xl toolstack.

Answer

xl save && xl restore

Answer

xen-migrate --live

Answer

virsh migrate --live

Question 2

You are configuring a QEMU-KVM guest to use VirtIO-net. Which parameter in the QEMU command line correctly enables the virtio-net-pci device with a tap interface named tap0?

Accepted Answer

-netdev tap,id=net0,ifname=tap0 -device virtio-net-pci,netdev=net0. The correct QEMU command line uses '-netdev tap,id=net0,ifname=tap0' to define a tap network backend with a unique ID, and then '-device virtio-net-pci,netdev=net0' to attach a virtio-net-pci device to that backend. This two-part syntax is required in modern QEMU to separate the network backend from the device frontend.

Answer

-device virtio-net,backend=tap0

Answer

-netdev tap,id=tap0 -device virtio-net-pci,id=tap0

Answer

-net tap,ifname=tap0,model=virtio

Question 3

A cloud-init configuration file is failing to apply the 'write_files' module. Which log file on the target instance should you examine to diagnose the parsing error?

Accepted Answer

/var/log/cloud-init.log. The /var/log/cloud-init.log file is the primary log for cloud-init and records all stages of the cloud-init process, including the parsing and execution of modules like write_files. When a configuration file fails to apply, cloud-init logs detailed error messages, such as syntax errors or invalid YAML, in this file. Therefore, examining /var/log/cloud-init.log is the correct way to diagnose parsing errors.

Answer

/var/log/syslog

Answer

/var/log/messages

Answer

/var/log/auth.log

Question 4

Which THREE of the following are legitimate security concerns when managing a virtualization host?

Accepted Answer

Unencrypted VNC connections. Option A is correct because VNC is often used to remotely access a virtualization host's console or guest consoles, and VNC traffic is unencrypted by default, allowing credentials and session data to be intercepted on the network. Option B is correct because the libvirt socket (typically /var/run/libvirt/libvirt-sock) provides privileged management access to virtual machines; if permissions are misconfigured, unauthorized users could start, stop, or reconfigure guests. Option D is correct because guest-to-host breakout exploits target hypervisor or emulation vulnerabilities to escape the VM boundary and gain code execution on the host, which is a fundamental virtualization security risk. Option C is not a security concern but a performance/availability consideration, and option E is a storage performance issue rather than a security threat.

Answer

Network interface speed

Answer

Hard drive fragmentation

Question 5

Which option for 'qemu-img create' allows you to create a preallocated image?

Accepted Answer

-o preallocation=full. The correct syntax is qemu-img create -f qcow2 -o preallocation=full disk.qcow2, where preallocation is a format-specific option passed via -o. Setting preallocation=full allocates all the space on the host immediately, avoiding fragmentation and improving write performance at the cost of disk usage. Other valid values are off, metadata, and falloc.

Answer

--prealloc=true

Answer

-p full

Answer

-f preallocated

Question 6

You want to limit the bandwidth of a virtual network interface. Which XML element within <interface> allows you to configure this?

Accepted Answer

. The element inside is the libvirt XML mechanism for traffic shaping on a virtual NIC. It contains and child elements, each accepting an 'average' attribute in kilobytes per second, which sets the token-bucket rate limit enforced by the host's traffic control subsystem.

Answer

<limit-rate>1000</limit-rate>

Answer

<network-speed>1000</network-speed>

Answer

<traffic-control>1000</traffic-control>

Question 7

What is a 'snapshot' in virtualization?

Accepted Answer

A saved state of a virtual machine at a point in time. A snapshot in virtualization is a saved state of a virtual machine at a specific point in time, capturing disk contents (and optionally memory/CPU state) so the VM can be reverted to that state. It is not a hardware config, log, or full host backup. Snapshots enable rollback after changes or failures.

Answer

A virtual hardware configuration

Answer

A log file of guest activity

Answer

A backup of the entire host system

Question 8

You are building a multi-stage Dockerfile and want to copy a binary from the 'builder' stage to the final stage. Which syntax is correct?

Accepted Answer

COPY --from=builder /bin/app /bin/app. Docker's multi-stage build feature allows COPY --from=<stage> to pull artifacts from a previously built stage (or an external image) into the current stage. The syntax COPY --from=builder /bin/app /bin/app copies the binary /bin/app from the stage named 'builder' into the final image at /bin/app, keeping the final image small by excluding the builder's toolchain and dependencies.

Answer

ADD --from=builder /bin/app /bin/app

Answer

COPY builder:/bin/app /bin/app

Answer

COPY --stage=builder /bin/app /bin/app

Question 9

Which TWO of the following commands can be used to manage virtual networks in libvirt?

Accepted Answer

virsh net-define. Option A, virsh net-define, is correct because it defines a persistent virtual network in libvirt from an XML configuration file, creating the network object that can later be started and made autostart. Option E, virsh net-list, is correct because it lists the virtual networks known to libvirt and can show their state (active/inactive) and autostart flag, making it a core management command. Option B, virsh net-config, does not exist as a libvirt subcommand; network XML is edited via virsh net-edit or net-define. Option C, virsh net-start-all, is not a valid virsh command; individual networks are started with virsh net-start, and autostart is set with virsh net-autostart. Option D, virsh net-status, is not a real libvirt subcommand; network state is obtained through virsh net-list or virsh net-info.

Answer

virsh net-config

Answer

virsh net-start-all

Answer

virsh net-status

Question 10

You are migrating a legacy application to an LXC container and need to ensure the container has access to the host's /dev/sda block device. Which configuration key must be added to the container's configuration file?

Accepted Answer

lxc.cgroup.devices.allow = b 8:0 rwm. LXC controls device access through the cgroup devices controller, and the config key lxc.cgroup.devices.allow uses the syntax 'TYPE MAJOR:MINOR PERMISSIONS'. For /dev/sda, the type is 'b' (block), major 8, minor 0, and permissions 'rwm' (read, write, mknod). This whitelists the block device so the container can access it, and it must be paired with a bind mount (lxc.mount.entry) to actually expose the device node inside the container.

Answer

lxc.mount.device = /dev/sda

Answer

lxc.cap.sys_admin = 1

Answer

lxc.dev.access = /dev/sda

Question 11

Which command is used to list all defined virtual networks in Libvirt?

Accepted Answer

virsh net-list --all. The `virsh net-list --all` command queries libvirt's virtual network driver and displays every network defined in the hypervisor, including those that are currently inactive. The `--all` flag is essential because without it, virsh only shows networks that are actively running. This is the canonical libvirt-native way to enumerate virtual networks, as opposed to inspecting the underlying Linux bridge layer.

Answer

brctl show

Answer

virsh domiflist

Answer

virsh list-networks

Question 12

You need to run a container that requires access to the host's network namespace directly to perform packet capture. Which Docker run flag should you use?

Accepted Answer

--network host. The --network host flag attaches the container directly to the host's network namespace, meaning the container shares the host's network stack (interfaces, routing table, and loopback). This is exactly what is required for packet capture tools like tcpdump or Wireshark to see host-level traffic without NAT or bridge isolation. Unlike capability grants, this flag changes the network namespace itself, which is the actual requirement stated in the question.

Answer

--cap-add NET_ADMIN

Answer

--privileged

Answer

--net bridge

Question 13

Which command is used to stop all running containers?

Accepted Answer

docker stop $(docker ps -q). docker stop $(docker ps -q) uses command substitution: docker ps -q lists only the IDs of running containers, and those IDs are passed to docker stop, which gracefully sends SIGTERM then SIGKILL after a timeout. This is the idiomatic way to stop all running containers from the shell. The other options either don't exist, target the wrong resource, or perform a different operation.

Answer

docker kill --all

Answer

docker rm -f *

Answer

docker prune

Question 14

You are using libvirt to manage a QEMU VM. You want to pass a specific host USB device with vendor ID 1234 and product ID 5678 to the guest. Which XML element is used inside the <devices> block to define this?

Accepted Answer

. Libvirt's canonical way to pass a host USB device to a guest is the element with mode='subsystem' and type='usb', containing a block with and . This tells QEMU to detach the device from the host and attach it to the guest via USB redirection, and the IDs must be in hexadecimal with the 0x prefix.

Answer

Answer

Answer

<usb-passthrough vendor='1234' product='5678'/>

Question 15

How do you define a new libvirt virtual network from an XML file named 'net.xml'?

Accepted Answer

virsh net-define net.xml. The virsh net-define command parses an XML file and defines a persistent libvirt virtual network from it, registering the network configuration with libvirt without starting it. This is the correct command to load a network definition from net.xml into libvirt's configuration.

Answer

virsh net-load net.xml

Answer

virsh define net.xml

Answer

virsh net-create net.xml

Question 16

In a Docker environment, you are observing that container logs are consuming too much disk space. Which logging driver should you configure to limit the number and size of log files?

Accepted Answer

json-file. The json-file logging driver is Docker's default and supports the max-size and max-file options, which limit the size of each log file and the number of rotated files. Configuring these options prevents container logs from consuming excessive disk space. Other drivers either discard logs or forward them without built-in rotation controls.

Answer

none

Answer

syslog

Answer

journald

Question 17

A libvirt storage pool of type 'dir' contains several qcow2 images. You want to create a new snapshot of an existing VM using virsh. Which command sequence is required to create an internal snapshot of the VM's current state?

Accepted Answer

virsh snapshot-create-as --domain . The command 'virsh snapshot-create-as --domain ' creates an internal snapshot of the VM, capturing the state of all its disks and optionally memory. This is the default behavior for virsh snapshot-create-as when no '--disk-only' or '--memspec' is specified, and it requires the disk format to support snapshots (e.g., qcow2).

Answer

virsh snapshot-create-as --domain --disk-only

Answer

qemu-img snapshot -c

Answer

virsh domblklist <vm> --snapshot

Question 18

What is the primary function of the libvirtd daemon?

Accepted Answer

To act as a management API for virtualization technologies. The libvirtd daemon is the core management service in the libvirt ecosystem, providing a stable, hypervisor-agnostic API (via C, Python, etc.) that abstracts underlying virtualization technologies like KVM, QEMU, Xen, and LXC. It listens on a Unix socket (and optionally TCP) to accept management commands for creating, starting, stopping, and monitoring virtual machines. Thus, it acts as a management API for virtualization technologies, not as a hardware emulator or kernel module manager.

Answer

To manage kernel modules for KVM

Answer

To emulate physical hardware for the host

Answer

To provide a graphical interface for QEMU

Question 19

Which command-line tool is primarily used to inspect the metadata and configuration of a running Docker container?

Accepted Answer

docker inspect. docker inspect returns detailed JSON metadata about a container, including its configuration, network settings, mounts, and state. It is the primary tool for examining the low-level details of a running or stopped container.

Answer

docker ps

Answer

docker stats

Answer

docker info

Answer

docker describe

Question 20

When using Vagrant with multiple machines in a single Vagrantfile, how do you define individual configurations?

Accepted Answer

config.vm.define :name. In a multi-machine Vagrantfile, each VM is declared with 'config.vm.define :name do |machine| ... end', which creates a named machine block where per-VM settings (box, network, provider, provisioners) are scoped. This is the canonical Vagrant DSL for multi-machine environments and allows 'vagrant up web' or 'vagrant ssh db' to target individual machines.

Answer

config.vm.box_set

Answer

config.vm.instance

Answer

config.vm.multi