305-300 Container Virtualization Practice Test 2 — 15 Questions

Question 1

Which kernel feature provides the isolation necessary for namespaces in container virtualization?

Accepted Answer

Namespaces. Linux namespaces are the kernel feature that provides isolation for containers by giving each container its own view of system resources such as PIDs, network interfaces, mount points, hostnames, and user IDs. Without namespaces, containers would share the host's global resource view and could not be isolated from each other. Namespaces are the foundational isolation primitive that makes container virtualization possible.

Answer

OverlayFS

Answer

Seccomp

Answer

Cgroups

Answer

AppArmor

Question 2

Which THREE commands are used to manage the lifecycle of an LXC container?

Accepted Answer

lxc-start. lxc-start (A) is correct because it is the command that boots an existing, stopped LXC container, transitioning it into the running state and thus initiating its lifecycle. lxc-stop (E) is correct because it gracefully shuts down a running container, ending its active lifecycle phase. lxc-destroy (B) is correct because it permanently deletes a container and its associated resources, completing the lifecycle by removing the container entirely. lxc-pause (C) is not among the marked answers because pausing merely suspends a running container's processes without advancing the start/stop/destroy lifecycle stages. lxc-reboot (D) is not marked correct because it restarts a container rather than representing a distinct lifecycle management stage such as creation, running, stopping, or destruction.

Answer

lxc-pause

Answer

lxc-reboot

Question 3

An administrator is configuring a Docker container to limit its CPU and memory usage. Which TWO of the following options can be used with the docker run command to enforce these resource constraints? (Choose two.)

Accepted Answer

--memory. The --cpus and --memory options are used to set hard limits on CPU and memory resources for a container. --cpus limits the number of CPU cores, while --memory sets the maximum memory. Other options like --cpu-shares and --memory-swap affect relative weights or swap, not hard limits. --blkio-weight is for block I/O, not CPU or memory.

Answer

--memory-swap

Answer

--blkio-weight

Answer

--cpu-shares

Question 4

You are deploying a multi-container application with Docker Compose. The web container must be able to resolve the service name 'db' to the database container's IP address, but the database container must NOT be able to initiate connections to the web container. Both containers are on the same user-defined bridge network 'app_net'. Which configuration change should you make?

Accepted Answer

Attach the db container to a separate user-defined network 'db_net', and attach the web container to both 'app_net' and 'db_net'.. Docker Compose allows a service to join multiple networks, and network membership determines reachability. A container can only communicate with another container if they share at least one network. By isolating the database on its own network and attaching only the web container to both networks, the web container gains access to the database, but the database cannot reach the web container. This pattern is commonly used to enforce security boundaries in multi-tier applications.

Answer

Use 'links' in the web service definition to point to the db service, and remove the shared network.

Answer

Attach the web container to a second user-defined network 'frontend_net', and attach the db container only to 'app_net'.

Answer

Place the db container on an internal-only network and the web container on both the internal network and a frontend network.

Question 5

You are building a container image with Buildah and want to ensure that the resulting image can be run by a non-root user without any additional runtime flags. The application inside writes logs to /var/log/app. Which Dockerfile instruction or Buildah command should you use to make /var/log/app writable by the non-root user in the final image?

Accepted Answer

Use the USER instruction to switch to the non-root user, then RUN mkdir -p /var/log/app && chown user:user /var/log/app. To make a directory writable by a non-root user in the final image, you must create it and set ownership to that user during the build. Switching to the user with USER and then running mkdir and chown ensures the directory is owned correctly in the image layer. Other approaches like VOLUME or COPY --chown do not reliably set directory ownership for existing paths.

Answer

Set the environment variable LOG_DIR=/var/log/app and expect the application to create it

Answer

Add a VOLUME instruction for /var/log/app so the directory is writable at runtime

Answer

Use the --chown flag with a COPY instruction to copy a placeholder file into /var/log/app

Question 6

You are running a Podman container and need to inspect the IP address assigned to its network interface. The container is running in rootless mode with the default network configuration. Which command should you use?

Accepted Answer

podman inspect --format '{{.NetworkSettings.IPAddress}}' <container>. The podman inspect command retrieves low-level configuration details of a container, including network settings. The --format option allows extracting specific fields like .NetworkSettings.IPAddress. In rootless mode with slirp4netns, this field may be empty, but it is still the correct command to query network configuration. Other options either require tools inside the container or display network-level information rather than the container's IP address.

Answer

podman ps --format '{{.Networks}}'

Answer

podman network inspect podman

Answer

podman exec <container> ip addr show

Question 7

A Docker host uses the default bridge network. You run a container with `docker run -d --name web nginx`. From another container on the same host, you try to reach `web` by its container name and the connection fails. Which action will make name resolution work between containers on this user-defined bridge network?

Accepted Answer

Create a user-defined bridge network and attach both containers to it.. Docker's embedded DNS server, reachable at 127.0.0.11, is automatically configured only for containers on user-defined networks. It resolves container names and network aliases to their current IPs, enabling service discovery without legacy links. On the default bridge, no such resolver exists, so containers must be addressed by IP or linked. Moving both containers to a shared user-defined bridge restores name resolution.

Answer

Set `--dns 127.0.0.11` on the second container and restart it.

Answer

Add `--link web:web` when starting the second container.

Answer

Publish port 80 with `-p 80:80` on the nginx container.

Question 8

You are troubleshooting a Docker container that fails to start with the error 'no space left on device' even though the host has ample free disk space. The container uses the overlay2 storage driver. Which of the following is the most likely cause?

Accepted Answer

The container's writable layer has reached its size limit due to a quota set with --storage-opt size=.. The error 'no space left on device' for a single container while the host has free space strongly indicates a per-container storage quota. Docker's overlay2 driver supports the --storage-opt size= option to limit the writable layer size. When the container exceeds this limit, writes fail with this error. Checking the container's configuration for size limits and either increasing the quota or cleaning up the container's data resolves the issue.

Answer

The Docker daemon's data-root directory is on a filesystem that is full.

Answer

The container image is corrupted and needs to be re-pulled.

Answer

The overlay2 driver has run out of inodes on the host filesystem.

Question 9

You are building a container image with Buildah and want to minimize the final image size by excluding build-time dependencies. Which approach is most effective?

Accepted Answer

Use a multi-stage build with separate FROM instructions and copy only the necessary artifacts.. Multi-stage builds are the most effective way to minimize image size because they allow you to separate the build environment from the runtime environment. By copying only the necessary artifacts into a minimal final stage, you exclude compilers, package managers, and other build-time dependencies. Buildah supports this by allowing multiple FROM statements in a Containerfile, with each stage building on the previous. The final image contains only the runtime essentials, resulting in a smaller and more secure image.

Answer

Add a RUN rm -rf /tmp/* command at the end of the build to clean up temporary files.

Answer

Use the --squash option when committing the image to merge all layers into one.

Answer

Run buildah rm on all intermediate containers after the build.

Question 10

You are using systemd-nspawn to run a container and want to ensure that the container's root filesystem is mounted read-only to prevent accidental modifications. Which option should you use?

Accepted Answer

--read-only. The --read-only option in systemd-nspawn mounts the container's root filesystem as read-only, preventing any modifications. This is useful for immutable infrastructure or testing scenarios. The other options are either invalid or serve different purposes, such as --volatile for ephemeral changes, and do not enforce a read-only root filesystem.

Answer

--private=read-only

Answer

--mount-ro

Answer

--volatile=read-only

Question 11

You are troubleshooting a Docker container that fails to start with the error "no space left on device" even though the host's root filesystem has free space. The Docker daemon uses the overlay2 storage driver on a dedicated /var/lib/docker partition. Which two actions should you take to resolve the issue? (Choose two.)

Accepted Answer

Run `docker system prune -a` to remove unused images, containers, and build cache.. The error indicates a lack of resources on the /var/lib/docker filesystem. Checking inode usage with `df -i` determines if inodes are exhausted, and `docker system prune -a` reclaims both inodes and block space by removing unused Docker objects. Other options either do not apply to overlay2 or do not address the immediate shortage.

Answer

Move the Docker data directory to a filesystem with more free inodes by editing /etc/docker/daemon.json.

Answer

Increase the size of the Docker container's writable layer by adding `--storage-opt size=10G`.

Answer

Restart the Docker daemon with `systemctl restart docker`.

Question 12

You are configuring a rootless Podman container that needs to bind to a privileged port (port 80) on the host. Which TWO of the following are required to achieve this? (Choose two.)

Accepted Answer

Publish the port using -p 80:80, which uses rootless port forwarding.. For rootless Podman to bind to a privileged port like 80, the host's sysctl net.ipv4.ip_unprivileged_port_start must be set to 80 or lower, allowing unprivileged users to bind to that port. Additionally, publishing the port with -p 80:80 sets up rootless port forwarding, which uses a proxy to bind the host port. Both are required: the sysctl removes the kernel restriction, and the port mapping configures the forwarding. Without the sysctl, the proxy cannot bind to port 80; without the port mapping, the container's service is not exposed.

Answer

Use the --cap-add=NET_BIND_SERVICE option when running the container.

Answer

Run the container with the --privileged flag.

Answer

Add the user to the docker group.

Question 13

You are configuring an LXC container and need to ensure that a directory on the host, /srv/data, is available inside the container at /mnt/data with read-write access. Which LXC configuration entry accomplishes this?

Accepted Answer

`lxc.mount.entry = /srv/data mnt/data none bind,rw 0 0`. The correct LXC configuration for a read-write bind mount uses `lxc.mount.entry` with the source path, a destination path relative to the container root (no leading slash), filesystem type `none`, and options `bind,rw`. This ensures the host directory is accessible inside the container with write permissions.

Answer

`lxc.mount.entry = /srv/data mnt/data none bind 0 0`

Answer

`lxc.mount.entry = /srv/data /mnt/data none bind,ro 0 0`

Answer

`lxc.rootfs.mount = /srv/data`

Question 14

You are optimizing a Dockerfile to reduce image size. Which THREE of the following practices are recommended?

Accepted Answer

Remove /var/lib/apt/lists/* after installing packages. Option C is correct because after running apt-get install, the package lists stored in /var/lib/apt/lists/* are no longer needed at runtime, and deleting them in the same RUN layer prevents them from being baked into the image and bloating its size. Option D is correct because multi-stage builds let you compile or build in an intermediate stage and copy only the resulting artifacts into a minimal final stage, so compilers, SDKs, and other build-time dependencies never end up in the shipped image. Option E is correct because chaining commands with && in a single RUN creates one layer; if you split them across multiple RUN instructions, intermediate files created and later deleted still persist in earlier layers and inflate the image. Option A is not recommended because the latest tag is mutable and non-deterministic, leading to unpredictable builds and larger or incompatible base images rather than a size optimization. Option B is not recommended because installing recommended packages pulls in extra dependencies you may not need, increasing image size and attack surface; --no-install-recommends is the preferred approach.

Answer

Use the FROM latest tag for all base images

Answer

Always install recommended packages for security

Question 15

You are troubleshooting a Docker container that cannot reach the internet despite the host having connectivity. The container uses the default bridge network. Which iptables chain is most likely causing the block?

Accepted Answer

FORWARD. Docker's default bridge network relies on the host's FORWARD chain to route packets between the docker0 bridge and the external interface. If the FORWARD chain's default policy is DROP (common on hardened hosts or when firewalld/ufw is misconfigured), container traffic is silently dropped even though the host itself has internet access. Docker normally inserts its own DOCKER-USER and DOCKER-FORWARD rules to permit this, but a conflicting firewall rule or a policy change can override them.

Answer

PREROUTING

Answer

POSTROUTING

Answer

OUTPUT