305-300 Practice Test 4 — 25 Questions

Question 1

In a Docker environment, you are observing that container logs are consuming too much disk space. Which logging driver should you configure to limit the number and size of log files?

Accepted Answer

json-file. The json-file logging driver is Docker's default and supports the max-size and max-file options, which limit the size of each log file and the number of rotated files. Configuring these options prevents container logs from consuming excessive disk space. Other drivers either discard logs or forward them without built-in rotation controls.

Answer

none

Answer

syslog

Answer

journald

Question 2

A libvirt storage pool of type 'dir' contains several qcow2 images. You want to create a new snapshot of an existing VM using virsh. Which command sequence is required to create an internal snapshot of the VM's current state?

Accepted Answer

virsh snapshot-create-as --domain . The command 'virsh snapshot-create-as --domain ' creates an internal snapshot of the VM, capturing the state of all its disks and optionally memory. This is the default behavior for virsh snapshot-create-as when no '--disk-only' or '--memspec' is specified, and it requires the disk format to support snapshots (e.g., qcow2).

Answer

virsh snapshot-create-as --domain --disk-only

Answer

qemu-img snapshot -c

Answer

virsh domblklist <vm> --snapshot

Question 3

What is the primary function of the libvirtd daemon?

Accepted Answer

To act as a management API for virtualization technologies. The libvirtd daemon is the core management service in the libvirt ecosystem, providing a stable, hypervisor-agnostic API (via C, Python, etc.) that abstracts underlying virtualization technologies like KVM, QEMU, Xen, and LXC. It listens on a Unix socket (and optionally TCP) to accept management commands for creating, starting, stopping, and monitoring virtual machines. Thus, it acts as a management API for virtualization technologies, not as a hardware emulator or kernel module manager.

Answer

To manage kernel modules for KVM

Answer

To emulate physical hardware for the host

Answer

To provide a graphical interface for QEMU

Question 4

Which command-line tool is primarily used to inspect the metadata and configuration of a running Docker container?

Accepted Answer

docker inspect. docker inspect returns detailed JSON metadata about a container, including its configuration, network settings, mounts, and state. It is the primary tool for examining the low-level details of a running or stopped container.

Answer

docker ps

Answer

docker stats

Answer

docker info

Answer

docker describe

Question 5

When using Vagrant with multiple machines in a single Vagrantfile, how do you define individual configurations?

Accepted Answer

config.vm.define :name. In a multi-machine Vagrantfile, each VM is declared with 'config.vm.define :name do |machine| ... end', which creates a named machine block where per-VM settings (box, network, provider, provisioners) are scoped. This is the canonical Vagrant DSL for multi-machine environments and allows 'vagrant up web' or 'vagrant ssh db' to target individual machines.

Answer

config.vm.box_set

Answer

config.vm.instance

Answer

config.vm.multi

Question 6

What is the primary difference between a container image and a container instance?

Accepted Answer

The image is the template; the instance is the running process. A container image is an immutable, layered filesystem template (built from a Dockerfile) that packages the application and its dependencies. A container instance is a running (or stopped) instantiation of that image with its own writable layer, process namespace, and runtime state. The image is the blueprint; the instance is the executing process.

Answer

Images are stored in RAM, instances are on disk

Answer

Instances cannot be stopped

Answer

The instance is the template; the image is the running process

Answer

They are the same thing

Question 7

A Docker container is failing to connect to an external database despite the host being able to ping it. You suspect a bridge networking issue. Which command allows you to inspect the current NAT rules created by Docker?

Accepted Answer

iptables -t nat -L -n. The correct command is `iptables -t nat -L -n` because Docker uses iptables NAT rules to perform outbound masquerading for containers on bridge networks. When a container sends traffic to an external database, the packet is SNAT'd to the host's IP via rules in the nat table's POSTROUTING chain. Inspecting this table reveals whether Docker's MASQUERADE rule is present and correctly configured, which is essential for diagnosing connectivity failures.

Answer

docker network inspect bridge

Answer

ip link show docker0

Answer

sysctl -a | grep net.bridge

Question 8

A KVM guest is configured with a virtio-blk disk and a virtio-net device. Under heavy network load the guest CPU shows high system time inside the guest, and the host shows high context-switch rates for the QEMU process. The administrator wants to reduce per-packet I/O overhead without changing the guest OS drivers. Which change is most appropriate?

Accepted Answer

Enable vhost-net for the virtio-net device by ensuring the vhost_net kernel module is loaded.. Moving the virtio-net data plane into the kernel with vhost-net reduces the userspace context switches and system time that appear under heavy network load, while preserving the existing virtio-net guest driver. Changing the disk controller, emulating a slower NIC, or adding vCPUs does not target the packet-processing overhead and can even make host CPU usage worse.

Answer

Increase the number of vCPUs assigned to the guest to absorb the extra system time.

Answer

Change the network device model to e1000 to lower CPU usage on the host.

Answer

Switch the disk from virtio-blk to virtio-scsi and reattach the same image.

Question 9

You are reviewing a KVM host and need to identify which of the following CPU features must be exposed to a guest to allow hardware-assisted nested virtualization inside that guest. (Choose two.)

Accepted Answer

ept or npt, to provide second-level address translation. Hardware-assisted nested virtualization requires both the virtualization extension (vmx on Intel, svm on AMD) and the second-level address translation feature (ept on Intel, npt on AMD) to be exposed to the guest. Together they let the guest hypervisor run its own VMs with hardware acceleration. Flags like hypervisor, aes, and rdrand are unrelated to nesting and do not enable it.

Answer

aes, to accelerate cryptographic operations in the guest

Answer

rdrand, to provide a hardware random number generator

Answer

hypervisor, to indicate the guest is running under a hypervisor

Question 10

A Packer build targeting the qemu builder completes, but the resulting image boots to a login prompt and never runs your provisioning scripts. You configured an ssh communicator with a username and password. Which condition most likely prevents Packer from connecting to the guest during the build?

Accepted Answer

The communicator expects the SSH service to be available on a port that the guest has not yet opened, and no boot command waits for cloud-init or sshd to start.. Packer's qemu builder boots the image and then relies on the configured communicator to run provisioners. If sshd is not started early or the boot command does not poll for the SSH port, the communicator times out and no provisioning occurs. Verifying that the image enables SSH at boot and adding boot wait logic ensures Packer can connect and execute the scripts.

Answer

The guest firewall blocks outbound traffic on port 22.

Answer

The qemu builder does not support SSH communicators and only works with the none communicator.

Answer

Packer requires an Ansible provisioner to be defined before any shell provisioner can execute.

Question 11

You are configuring a KVM host that will run several guests. You want each guest to be able to communicate with other guests and the host on the same subnet, while still allowing external hosts to reach the guests directly. You decide to use a libvirt virtual network with a bridge. Which libvirt network configuration element must be present to enable direct Layer 2 connectivity between the guests and the physical LAN?

Accepted Answer

<forward mode='bridge'/> with a bridge name that matches an existing host bridge.. A libvirt network with forward mode bridge and a bridge name that matches an existing host bridge places guest interfaces directly on the physical LAN bridge, giving them Layer 2 connectivity to other guests, the host, and external hosts. NAT, routed, and private modes either hide guests behind NAT, require Layer 3 routing, or isolate them entirely, so they do not provide the required direct connectivity.

Answer

<forward mode='private'/> to isolate guest traffic from the host and external network.

Answer

<forward mode='nat'/> with a private subnet and DHCP range.

Answer

<forward mode='route'/> with a dedicated subnet and static routes on the physical router.

Question 12

You are using Vagrant to manage a development environment. You need to run a shell script that installs dependencies after the VM boots for the first time. Which provisioner type should you use in your Vagrantfile?

Accepted Answer

shell. Vagrant's shell provisioner is designed to execute shell scripts or inline commands on the guest machine. It is the standard way to install software and configure a VM during provisioning. Other provisioners like file, ansible_local, or docker serve different purposes and would not directly run a shell script to install dependencies. Thus, the shell provisioner is the correct choice.

Answer

ansible_local

Answer

docker

Answer

file

Question 13

A KVM host runs a Windows guest whose virtual disk is backed by a raw image file on an NFS mount. After a host reboot, the guest fails to start with 'Permission denied' on the disk path, although the file exists and is readable by root. The host uses SELinux enforcing mode. Which action resolves the problem?

Accepted Answer

Set the SELinux boolean 'virt_use_nfs' with 'setsebool -P virt_use_nfs on'.. A confined QEMU process cannot touch NFS storage unless the virt_use_nfs boolean is enabled, which is exactly what the Permission denied error after reboot indicates. The persistent form of setsebool applies the change across reboots. Relabeling local images, changing ownership, or disabling the security driver either targets the wrong path or weakens host security without solving the specific access denial.

Answer

Add 'security_driver = "none"' to /etc/libvirt/qemu.conf and restart libvirtd.

Answer

Change the disk image ownership to 'qemu:qemu' with 'chown qemu:qemu' on the NFS-mounted file.

Answer

Run 'restorecon -R -v /var/lib/libvirt/images' to reset file contexts on the local image directory.

Question 14

You are provisioning a KVM guest with virt-install. The guest must use a pre-existing disk image located at /var/lib/libvirt/images/web.img and must not have the image created or modified by virt-install. Which option should you include in the virt-install command?

Accepted Answer

--disk path=/var/lib/libvirt/images/web.img,import. When a disk image already exists and contains a bootable operating system, virt-install must be told not to create or format it. The import suboption within --disk achieves exactly this, allowing the new domain to boot from the existing image. Other suboptions such as readonly, shareable, or sparse address different storage behaviors and do not satisfy the requirement of reusing an unmodified image.

Answer

--disk path=/var/lib/libvirt/images/web.img,sparse

Answer

--disk path=/var/lib/libvirt/images/web.img,readonly

Answer

--disk path=/var/lib/libvirt/images/web.img,shareable

Question 15

You are using systemd-nspawn to run a container and need to allow it to use the host's network stack directly, without any network namespace isolation. Which option should you pass to systemd-nspawn?

Accepted Answer

Do not specify any network-related option.. systemd-nspawn creates a new network namespace only when a network-related option is given. Without any such option, the container inherits the host's network namespace and thus shares its network stack. Options like `--private-network` or `--network-interface` would introduce isolation or a dedicated interface, which is not what the scenario requires.

Answer

`--private-network`

Answer

`--network-namespace=host`

Answer

`--network-interface=host0`

Question 16

You are using Docker and need to inspect the metadata of a running container, including its IP address, environment variables, and mounted volumes. Which command provides all this information in a single JSON output?

Accepted Answer

docker inspect <container>. The docker inspect command outputs comprehensive JSON metadata for a container, including network settings, environment variables, and mounts. Other commands like docker ps, docker stats, and docker logs serve different purposes such as listing, monitoring, or retrieving logs. Only docker inspect provides the full configuration details required in this scenario.

Answer

docker logs <container>

Answer

docker ps --format json

Answer

docker stats <container>

Question 17

You are using QEMU/KVM with libvirt on a host and want to gracefully shut down a running domain named 'db01' so the guest OS performs its normal shutdown sequence. Which virsh command should you use?

Accepted Answer

virsh shutdown db01. A graceful shutdown is initiated with virsh shutdown, which delivers an ACPI power-button event or uses the QEMU guest agent to request an orderly OS shutdown. This allows the guest to flush caches and stop services cleanly. Hard power-off, suspension, and configuration removal do not perform a graceful guest shutdown, so they do not meet the requirement.

Answer

virsh suspend db01

Answer

virsh destroy db01

Answer

virsh undefine db01

Question 18

You are configuring a rootless Podman container that must persist data across container restarts and also needs to communicate with other containers on the same host using a user-defined network. Which two actions must you perform to achieve these goals? (Choose two.)

Accepted Answer

Create a user-defined network with podman network create and attach the container to it.. To persist data across restarts in rootless Podman, a named volume created with podman volume create and mounted into the container is the correct approach. For containers to communicate by name on the same host, a user-defined network created with podman network create and attached to the container is required. The other options either introduce unnecessary privileges or do not address both requirements.

Answer

Use a bind mount to a host directory and set the --userns=host flag to avoid permission issues.

Answer

Add the --ipc=host flag to allow containers to share memory and communicate.

Answer

Run the container with the --privileged flag to allow volume mounting and network access.

Question 19

You are using systemd-nspawn to run a container and want to ensure that the container's processes are isolated from the host's process tree. Which option should you use?

Accepted Answer

Process isolation is enabled by default with PID namespaces; no additional option is needed.. systemd-nspawn automatically sets up a PID namespace for each container, ensuring that processes inside the container are isolated from the host's process tree. This means container processes cannot see or interact with host processes, and vice versa. No additional option is needed to achieve this basic level of process isolation. Other options like --private-users add user namespace isolation, but process isolation is a default behavior. Therefore, the correct answer is that no extra option is required.

Answer

--private-users

Answer

--boot

Answer

--private-network

Question 20

You are configuring an LXC container and need to limit its CPU and memory usage. Which TWO of the following configuration options in the container's config file are valid for this purpose? (Choose two.)

Accepted Answer

lxc.cgroup2.cpu.max = 50000 100000. LXC uses cgroup v2 settings to enforce resource limits. The options lxc.cgroup2.cpu.max and lxc.cgroup2.memory.max are valid and directly limit CPU bandwidth and memory usage, respectively. The other options either use non-existent configuration keys or, in the case of cpuset.cpus, control CPU affinity rather than usage limits. Thus, only the cgroup2-based limits achieve the goal.

Answer

lxc.cgroup2.cpuset.cpus = 0-1

Answer

lxc.memory.limit = 1G

Answer

lxc.cpu.limit = 2