305-300 Practice Test 3 — 25 Questions

Question 1

In the context of container orchestration, what is the role of a 'sidecar' container?

Accepted Answer

To provide auxiliary services like logging or monitoring for the main container. A sidecar container runs alongside the main application container in the same pod, providing auxiliary functionality such as log shipping, metrics collection, proxying, or configuration sync. It shares the pod's network namespace and lifecycle, augmenting rather than replacing the primary container. This is the canonical definition in Kubernetes and general container orchestration.

Answer

To act as a load balancer for the cluster

Answer

To store persistent data for the primary container

Answer

To run in a separate network namespace

Answer

To replace the main container when it crashes

Question 2

What does 'QEMU' stand for?

Accepted Answer

Quick Emulator. QEMU is an open-source emulator and virtualizer that performs hardware virtualization. The name 'QEMU' is an acronym for 'Quick Emulator', reflecting its original design goal of fast emulation of a complete computer system. It is widely used in conjunction with KVM (Kernel-based Virtual Machine) to provide full virtualization on Linux, and it can also run standalone as a pure emulator for cross-platform development and testing.

Answer

Quantum Emulator

Answer

Quick Execution Machine Utility

Answer

Quality Emulator

Question 3

Which TWO commands are used to manage images in Docker?

Accepted Answer

docker tag. docker tag (A) is correct because it manages images by creating a new reference/tag pointing to an existing image (docker tag SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG]), which is an image-level operation. docker build (E) is correct because it manages images by constructing a new image from a Dockerfile and build context, producing an image stored in the local image cache. The other options operate on containers rather than images: docker run (B) creates and starts a container from an image, docker create (C) creates a container without starting it, and docker attach (D) attaches the local standard input/output/error streams to a running container's process.

Answer

docker run

Answer

docker create

Answer

docker attach

Question 4

Which Packer builder is most appropriate for creating an image specifically for Amazon Web Services (AWS)?

Accepted Answer

amazon-ebs. The amazon-ebs builder is Packer's native AWS builder that launches a temporary EC2 instance, provisions it, creates an EBS-backed AMI, and terminates the instance. It is the standard and most appropriate choice for producing AWS AMIs directly. The other builders target different platforms or artifact formats.

Answer

virtualbox-iso

Answer

qemu

Answer

docker

Question 5

What is the purpose of the 'virsh' tool?

Accepted Answer

To manage virtual domains. The 'virsh' tool is a command-line interface for managing libvirt-based virtual machines (domains). It allows administrators to create, start, stop, migrate, and configure virtual domains, as well as manage networks, storage pools, and other resources. It is not used for monitoring CPU temperature, compiling QEMU, or writing disk images to USB.

Answer

To monitor host CPU temperature

Answer

To compile QEMU

Answer

To write disk images to USB

Question 6

Which hypervisor type is considered 'Type 1' virtualization?

Accepted Answer

Xen. Xen is a Type 1 (bare-metal) hypervisor because it runs directly on the host hardware, with the hypervisor itself acting as the lowest software layer and managing guest domains. Type 1 hypervisors do not require a host OS underneath them, giving better performance and isolation for production virtualization. Xen's dom0 and domU architecture is a textbook example of this model.

Answer

VMware Workstation

Answer

VirtualBox

Answer

QEMU (user mode)

Question 7

How can you force a refresh of a libvirt storage pool named 'isos'?

Accepted Answer

virsh pool-refresh isos. 'virsh pool-refresh isos' is the exact libvirt command to refresh a storage pool named 'isos'. This command rescans the pool's underlying storage (e.g., a directory or LVM volume group) and updates libvirt's internal list of available volumes, making new files visible without restarting libvirtd.

Answer

virsh refresh-pool isos

Answer

virsh pool-update isos

Answer

virsh pool-reload isos

Question 8

You are configuring an OpenVZ container. Which command is used to set the hostname of the container from the host?

Accepted Answer

vzctl set CTID --hostname. The `vzctl set --hostname ` command sets the hostname of an OpenVZ container from the host. The `--hostname` option updates the container's configuration and applies the change, optionally with `--save` to persist it to the configuration file.

Answer

vzcfg

Answer

hostnamectl

Answer

openvz-edit

Question 9

Which THREE of the following are valid elements inside the <interface type='bridge'> block?

Accepted Answer

. Option A is correct because is the required child element that tells libvirt which host bridge the guest interface should be attached to, and it is valid inside . Option D is correct because is a valid child element that selects the emulated NIC model presented to the guest, with virtio being the paravirtualized option. Option E is correct because is a valid child element used to assign a specific MAC address to the guest interface. Options B and C are not valid here: and are not children of ; IP/gateway configuration belongs in the guest OS or in higher-level network definitions, not in the interface's bridge block.

Answer

Answer

Question 10

Which THREE of the following are common cloud-init modules?

Accepted Answer

packages. Option B (packages) is a standard cloud-init module that installs or upgrades packages on first boot by reading the packages and package_upgrade keys, so it is correct. Option C (runcmd) is a core cloud-init module that executes arbitrary shell commands listed under the runcmd key during the final boot stage, making it correct. Option E (users-groups) is the cloud-init module responsible for creating and configuring users and groups from the users and groups directives, so it is also correct. Options A (network-bridge) and D (disk-partition) are not cloud-init modules; networking is handled by modules such as network-config or the distro's network renderer, and partitioning is handled by modules like disk_setup and growpart, so neither belongs here.

Answer

network-bridge

Answer

disk-partition

Question 11

You are managing a Xen host and need to live-migrate a domain between two physical servers. The migration fails with a domain lock error. Which command is the standard way to initiate a live migration while ensuring the target host is prepared to receive the domain?

Accepted Answer

xl migrate . The xl migrate command is the standard Xen tool for live-migrating a domain to another host, and it handles the necessary preparation on the target host (such as creating the domain configuration and transferring memory state) to receive the domain. It is the direct counterpart to xm migrate in the newer xl toolstack.

Answer

xl save && xl restore

Answer

xen-migrate --live

Answer

virsh migrate --live

Question 12

You are configuring a QEMU-KVM guest to use VirtIO-net. Which parameter in the QEMU command line correctly enables the virtio-net-pci device with a tap interface named tap0?

Accepted Answer

-netdev tap,id=net0,ifname=tap0 -device virtio-net-pci,netdev=net0. The correct QEMU command line uses '-netdev tap,id=net0,ifname=tap0' to define a tap network backend with a unique ID, and then '-device virtio-net-pci,netdev=net0' to attach a virtio-net-pci device to that backend. This two-part syntax is required in modern QEMU to separate the network backend from the device frontend.

Answer

-device virtio-net,backend=tap0

Answer

-netdev tap,id=tap0 -device virtio-net-pci,id=tap0

Answer

-net tap,ifname=tap0,model=virtio

Question 13

A cloud-init configuration file is failing to apply the 'write_files' module. Which log file on the target instance should you examine to diagnose the parsing error?

Accepted Answer

/var/log/cloud-init.log. The /var/log/cloud-init.log file is the primary log for cloud-init and records all stages of the cloud-init process, including the parsing and execution of modules like write_files. When a configuration file fails to apply, cloud-init logs detailed error messages, such as syntax errors or invalid YAML, in this file. Therefore, examining /var/log/cloud-init.log is the correct way to diagnose parsing errors.

Answer

/var/log/syslog

Answer

/var/log/messages

Answer

/var/log/auth.log

Question 14

Which THREE of the following are legitimate security concerns when managing a virtualization host?

Accepted Answer

Unencrypted VNC connections. Option A is correct because VNC is often used to remotely access a virtualization host's console or guest consoles, and VNC traffic is unencrypted by default, allowing credentials and session data to be intercepted on the network. Option B is correct because the libvirt socket (typically /var/run/libvirt/libvirt-sock) provides privileged management access to virtual machines; if permissions are misconfigured, unauthorized users could start, stop, or reconfigure guests. Option D is correct because guest-to-host breakout exploits target hypervisor or emulation vulnerabilities to escape the VM boundary and gain code execution on the host, which is a fundamental virtualization security risk. Option C is not a security concern but a performance/availability consideration, and option E is a storage performance issue rather than a security threat.

Answer

Network interface speed

Answer

Hard drive fragmentation

Question 15

Which option for 'qemu-img create' allows you to create a preallocated image?

Accepted Answer

-o preallocation=full. The correct syntax is qemu-img create -f qcow2 -o preallocation=full disk.qcow2, where preallocation is a format-specific option passed via -o. Setting preallocation=full allocates all the space on the host immediately, avoiding fragmentation and improving write performance at the cost of disk usage. Other valid values are off, metadata, and falloc.

Answer

--prealloc=true

Answer

-p full

Answer

-f preallocated

Question 16

You want to limit the bandwidth of a virtual network interface. Which XML element within <interface> allows you to configure this?

Accepted Answer

. The element inside is the libvirt XML mechanism for traffic shaping on a virtual NIC. It contains and child elements, each accepting an 'average' attribute in kilobytes per second, which sets the token-bucket rate limit enforced by the host's traffic control subsystem.

Answer

<limit-rate>1000</limit-rate>

Answer

<network-speed>1000</network-speed>

Answer

<traffic-control>1000</traffic-control>

Question 17

What is a 'snapshot' in virtualization?

Accepted Answer

A saved state of a virtual machine at a point in time. A snapshot in virtualization is a saved state of a virtual machine at a specific point in time, capturing disk contents (and optionally memory/CPU state) so the VM can be reverted to that state. It is not a hardware config, log, or full host backup. Snapshots enable rollback after changes or failures.

Answer

A virtual hardware configuration

Answer

A log file of guest activity

Answer

A backup of the entire host system

Question 18

You are building a multi-stage Dockerfile and want to copy a binary from the 'builder' stage to the final stage. Which syntax is correct?

Accepted Answer

COPY --from=builder /bin/app /bin/app. Docker's multi-stage build feature allows COPY --from=<stage> to pull artifacts from a previously built stage (or an external image) into the current stage. The syntax COPY --from=builder /bin/app /bin/app copies the binary /bin/app from the stage named 'builder' into the final image at /bin/app, keeping the final image small by excluding the builder's toolchain and dependencies.

Answer

ADD --from=builder /bin/app /bin/app

Answer

COPY builder:/bin/app /bin/app

Answer

COPY --stage=builder /bin/app /bin/app

Question 19

Which TWO of the following commands can be used to manage virtual networks in libvirt?

Accepted Answer

virsh net-define. Option A, virsh net-define, is correct because it defines a persistent virtual network in libvirt from an XML configuration file, creating the network object that can later be started and made autostart. Option E, virsh net-list, is correct because it lists the virtual networks known to libvirt and can show their state (active/inactive) and autostart flag, making it a core management command. Option B, virsh net-config, does not exist as a libvirt subcommand; network XML is edited via virsh net-edit or net-define. Option C, virsh net-start-all, is not a valid virsh command; individual networks are started with virsh net-start, and autostart is set with virsh net-autostart. Option D, virsh net-status, is not a real libvirt subcommand; network state is obtained through virsh net-list or virsh net-info.

Answer

virsh net-config

Answer

virsh net-start-all

Answer

virsh net-status

Question 20

You are migrating a legacy application to an LXC container and need to ensure the container has access to the host's /dev/sda block device. Which configuration key must be added to the container's configuration file?

Accepted Answer

lxc.cgroup.devices.allow = b 8:0 rwm. LXC controls device access through the cgroup devices controller, and the config key lxc.cgroup.devices.allow uses the syntax 'TYPE MAJOR:MINOR PERMISSIONS'. For /dev/sda, the type is 'b' (block), major 8, minor 0, and permissions 'rwm' (read, write, mknod). This whitelists the block device so the container can access it, and it must be paired with a bind mount (lxc.mount.entry) to actually expose the device node inside the container.

Answer

lxc.mount.device = /dev/sda

Answer

lxc.cap.sys_admin = 1

Answer

lxc.dev.access = /dev/sda