305-300 Practice Test 9 — 10 Questions

Question 1

What is the primary difference between a container image and a container instance?

Accepted Answer

The image is the template; the instance is the running process. A container image is an immutable, layered filesystem template (built from a Dockerfile) that packages the application and its dependencies. A container instance is a running (or stopped) instantiation of that image with its own writable layer, process namespace, and runtime state. The image is the blueprint; the instance is the executing process.

Answer

Images are stored in RAM, instances are on disk

Answer

Instances cannot be stopped

Answer

The instance is the template; the image is the running process

Answer

They are the same thing

Question 2

A Docker container is failing to connect to an external database despite the host being able to ping it. You suspect a bridge networking issue. Which command allows you to inspect the current NAT rules created by Docker?

Accepted Answer

iptables -t nat -L -n. The correct command is `iptables -t nat -L -n` because Docker uses iptables NAT rules to perform outbound masquerading for containers on bridge networks. When a container sends traffic to an external database, the packet is SNAT'd to the host's IP via rules in the nat table's POSTROUTING chain. Inspecting this table reveals whether Docker's MASQUERADE rule is present and correctly configured, which is essential for diagnosing connectivity failures.

Answer

docker network inspect bridge

Answer

ip link show docker0

Answer

sysctl -a | grep net.bridge

Question 3

A KVM guest is configured with a virtio-blk disk and a virtio-net device. Under heavy network load the guest CPU shows high system time inside the guest, and the host shows high context-switch rates for the QEMU process. The administrator wants to reduce per-packet I/O overhead without changing the guest OS drivers. Which change is most appropriate?

Accepted Answer

Enable vhost-net for the virtio-net device by ensuring the vhost_net kernel module is loaded.. Moving the virtio-net data plane into the kernel with vhost-net reduces the userspace context switches and system time that appear under heavy network load, while preserving the existing virtio-net guest driver. Changing the disk controller, emulating a slower NIC, or adding vCPUs does not target the packet-processing overhead and can even make host CPU usage worse.

Answer

Increase the number of vCPUs assigned to the guest to absorb the extra system time.

Answer

Change the network device model to e1000 to lower CPU usage on the host.

Answer

Switch the disk from virtio-blk to virtio-scsi and reattach the same image.

Question 4

You are reviewing a KVM host and need to identify which of the following CPU features must be exposed to a guest to allow hardware-assisted nested virtualization inside that guest. (Choose two.)

Accepted Answer

ept or npt, to provide second-level address translation. Hardware-assisted nested virtualization requires both the virtualization extension (vmx on Intel, svm on AMD) and the second-level address translation feature (ept on Intel, npt on AMD) to be exposed to the guest. Together they let the guest hypervisor run its own VMs with hardware acceleration. Flags like hypervisor, aes, and rdrand are unrelated to nesting and do not enable it.

Answer

aes, to accelerate cryptographic operations in the guest

Answer

rdrand, to provide a hardware random number generator

Answer

hypervisor, to indicate the guest is running under a hypervisor

Question 5

A Packer build targeting the qemu builder completes, but the resulting image boots to a login prompt and never runs your provisioning scripts. You configured an ssh communicator with a username and password. Which condition most likely prevents Packer from connecting to the guest during the build?

Accepted Answer

The communicator expects the SSH service to be available on a port that the guest has not yet opened, and no boot command waits for cloud-init or sshd to start.. Packer's qemu builder boots the image and then relies on the configured communicator to run provisioners. If sshd is not started early or the boot command does not poll for the SSH port, the communicator times out and no provisioning occurs. Verifying that the image enables SSH at boot and adding boot wait logic ensures Packer can connect and execute the scripts.

Answer

The guest firewall blocks outbound traffic on port 22.

Answer

The qemu builder does not support SSH communicators and only works with the none communicator.

Answer

Packer requires an Ansible provisioner to be defined before any shell provisioner can execute.

Question 6

You are configuring a KVM host that will run several guests. You want each guest to be able to communicate with other guests and the host on the same subnet, while still allowing external hosts to reach the guests directly. You decide to use a libvirt virtual network with a bridge. Which libvirt network configuration element must be present to enable direct Layer 2 connectivity between the guests and the physical LAN?

Accepted Answer

<forward mode='bridge'/> with a bridge name that matches an existing host bridge.. A libvirt network with forward mode bridge and a bridge name that matches an existing host bridge places guest interfaces directly on the physical LAN bridge, giving them Layer 2 connectivity to other guests, the host, and external hosts. NAT, routed, and private modes either hide guests behind NAT, require Layer 3 routing, or isolate them entirely, so they do not provide the required direct connectivity.

Answer

<forward mode='private'/> to isolate guest traffic from the host and external network.

Answer

<forward mode='nat'/> with a private subnet and DHCP range.

Answer

<forward mode='route'/> with a dedicated subnet and static routes on the physical router.

Question 7

You are using Vagrant to manage a development environment. You need to run a shell script that installs dependencies after the VM boots for the first time. Which provisioner type should you use in your Vagrantfile?

Accepted Answer

shell. Vagrant's shell provisioner is designed to execute shell scripts or inline commands on the guest machine. It is the standard way to install software and configure a VM during provisioning. Other provisioners like file, ansible_local, or docker serve different purposes and would not directly run a shell script to install dependencies. Thus, the shell provisioner is the correct choice.

Answer

ansible_local

Answer

docker

Answer

file

Question 8

A KVM host runs a Windows guest whose virtual disk is backed by a raw image file on an NFS mount. After a host reboot, the guest fails to start with 'Permission denied' on the disk path, although the file exists and is readable by root. The host uses SELinux enforcing mode. Which action resolves the problem?

Accepted Answer

Set the SELinux boolean 'virt_use_nfs' with 'setsebool -P virt_use_nfs on'.. A confined QEMU process cannot touch NFS storage unless the virt_use_nfs boolean is enabled, which is exactly what the Permission denied error after reboot indicates. The persistent form of setsebool applies the change across reboots. Relabeling local images, changing ownership, or disabling the security driver either targets the wrong path or weakens host security without solving the specific access denial.

Answer

Add 'security_driver = "none"' to /etc/libvirt/qemu.conf and restart libvirtd.

Answer

Change the disk image ownership to 'qemu:qemu' with 'chown qemu:qemu' on the NFS-mounted file.

Answer

Run 'restorecon -R -v /var/lib/libvirt/images' to reset file contexts on the local image directory.

Question 9

You are provisioning a KVM guest with virt-install. The guest must use a pre-existing disk image located at /var/lib/libvirt/images/web.img and must not have the image created or modified by virt-install. Which option should you include in the virt-install command?

Accepted Answer

--disk path=/var/lib/libvirt/images/web.img,import. When a disk image already exists and contains a bootable operating system, virt-install must be told not to create or format it. The import suboption within --disk achieves exactly this, allowing the new domain to boot from the existing image. Other suboptions such as readonly, shareable, or sparse address different storage behaviors and do not satisfy the requirement of reusing an unmodified image.

Answer

--disk path=/var/lib/libvirt/images/web.img,sparse

Answer

--disk path=/var/lib/libvirt/images/web.img,readonly

Answer

--disk path=/var/lib/libvirt/images/web.img,shareable

Question 10

You are using systemd-nspawn to run a container and need to allow it to use the host's network stack directly, without any network namespace isolation. Which option should you pass to systemd-nspawn?

Accepted Answer

Do not specify any network-related option.. systemd-nspawn creates a new network namespace only when a network-related option is given. Without any such option, the container inherits the host's network namespace and thus shares its network stack. Options like `--private-network` or `--network-interface` would introduce isolation or a dedicated interface, which is not what the scenario requires.

Answer

`--private-network`

Answer

`--network-namespace=host`

Answer

`--network-interface=host0`