305-300 Container Virtualization Practice Test 3 — 15 Questions

Question 1

A Docker container is failing to connect to an external database despite the host being able to ping it. You suspect a bridge networking issue. Which command allows you to inspect the current NAT rules created by Docker?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

iptables -t nat -L -n. The correct command is `iptables -t nat -L -n` because Docker uses iptables NAT rules to perform outbound masquerading for containers on bridge networks. When a container sends traffic to an external database, the packet is SNAT'd to the host's IP via rules in the nat table's POSTROUTING chain. Inspecting this table reveals whether Docker's MASQUERADE rule is present and correctly configured, which is essential for diagnosing connectivity failures.

Answer

docker network inspect bridge

Answer

ip link show docker0

Answer

sysctl -a | grep net.bridge

Question 2

You need to run a container that requires access to the host's network namespace directly to perform packet capture. Which Docker run flag should you use?

Accepted Answer

--network host. The --network host flag attaches the container directly to the host's network namespace, meaning the container shares the host's network stack (interfaces, routing table, and loopback). This is exactly what is required for packet capture tools like tcpdump or Wireshark to see host-level traffic without NAT or bridge isolation. Unlike capability grants, this flag changes the network namespace itself, which is the actual requirement stated in the question.

Answer

--cap-add NET_ADMIN

Answer

--privileged

Answer

--net bridge

Question 3

Which Docker command is used to display the resource usage (CPU, memory) of running containers?

Accepted Answer

docker stats. `docker stats` is the dedicated Docker CLI subcommand that streams live resource-usage metrics for running containers, including CPU percentage, memory usage/limit, memory percentage, network I/O, block I/O, and PIDs. It reads these values from the cgroup statistics exposed by the container runtime, so it reflects actual kernel-level accounting rather than estimates. By default it shows all running containers and refreshes continuously until you press Ctrl+C.

Answer

docker top

Answer

docker usage

Answer

docker info

Question 4

When building a Dockerfile, which instruction should be used to define the user context for subsequent RUN, CMD, and ENTRYPOINT instructions?

Accepted Answer

USER. The USER instruction in a Dockerfile sets the user (and optionally group) that subsequent RUN, CMD, and ENTRYPOINT instructions will execute as. It changes the runtime identity inside the image for all following instructions and for the container's default process. This is the standard way to drop root privileges in a container image.

Answer

WORKDIR

Answer

RUN useradd

Answer

AS

Question 5

You need to inspect the metadata of a specific Docker image without pulling it from a remote registry. Which command should you use?

Accepted Answer

docker manifest inspect. 'docker manifest inspect' queries the registry's manifest API directly and returns metadata such as platform variants, digests, and layer information without downloading the image layers. It is the correct tool for inspecting a remote image's metadata without pulling it.

Answer

docker pull --metadata

Answer

docker image history

Answer

docker image inspect

Question 6

In an OpenVZ environment, you need to limit the number of processes a container can create. Which parameter in the container configuration file should be modified?

Accepted Answer

NUMPROC. In OpenVZ, the NUMPROC parameter in the container's configuration file (e.g., /etc/vz/conf/CTID.conf) directly controls the maximum number of processes and threads that can exist within that container. It acts as a hard limit on the total process count, preventing a single container from exhausting the host's process table. This is the correct parameter to modify when you need to restrict process creation for a specific container.

Answer

PHYSPAGES

Answer

KMEMSIZE

Answer

PRIVVMPAGES

Question 7

You are building a multi-stage Dockerfile and want to copy a binary from the 'builder' stage to the final stage. Which syntax is correct?

Accepted Answer

COPY --from=builder /bin/app /bin/app. Docker's multi-stage build feature allows COPY --from=<stage> to pull artifacts from a previously built stage (or an external image) into the current stage. The syntax COPY --from=builder /bin/app /bin/app copies the binary /bin/app from the stage named 'builder' into the final image at /bin/app, keeping the final image small by excluding the builder's toolchain and dependencies.

Answer

ADD --from=builder /bin/app /bin/app

Answer

COPY builder:/bin/app /bin/app

Answer

COPY --stage=builder /bin/app /bin/app

Question 8

When using Docker volumes, which type of mount should you use if you want the data to persist on the host filesystem at a specific, user-defined path?

Accepted Answer

Bind mount. A bind mount maps a specific host directory or file path directly into the container, giving the user full control over the exact host location where data persists. This is the correct choice when the requirement is a user-defined, specific host path, because named and anonymous volumes are managed by Docker in its own storage area (/var/lib/docker/volumes) and do not let you choose an arbitrary host path. Bind mounts are the only Docker volume type that satisfies the 'specific, user-defined path' requirement.

Answer

Named volume

Answer

Anonymous volume

Answer

Tmpfs mount

Question 9

Which command is used to stop all running containers?

Accepted Answer

docker stop $(docker ps -q). docker stop $(docker ps -q) uses command substitution: docker ps -q lists only the IDs of running containers, and those IDs are passed to docker stop, which gracefully sends SIGTERM then SIGKILL after a timeout. This is the idiomatic way to stop all running containers from the shell. The other options either don't exist, target the wrong resource, or perform a different operation.

Answer

docker kill --all

Answer

docker rm -f *

Answer

docker prune

Question 10

Which command allows you to enter an existing running container and execute a new command inside it?

Accepted Answer

docker exec. The `docker exec` command runs a new process inside an already-running container, which is exactly what is needed to enter a container and execute a command such as a shell. For example, `docker exec -it <container> /bin/bash` opens an interactive shell inside the running container without stopping or restarting it. This is the standard, non-disruptive way to access a running container.

Answer

docker commit

Answer

docker attach

Answer

docker run

Question 11

Which flag is used to run a container in the background?

Accepted Answer

-d. The `-d` (or `--detach`) flag tells `docker run` to start the container and immediately return control to the shell, running the container in the background. Without it, the container runs in the foreground and attaches its STDOUT/STDERR to your terminal, blocking the prompt until the process exits. This is the standard way to launch long-running services like web servers or databases.

Answer

-t

Answer

-b

Answer

-i

Question 12

In a Docker environment, you are observing that container logs are consuming too much disk space. Which logging driver should you configure to limit the number and size of log files?

Accepted Answer

json-file. The json-file logging driver is Docker's default and supports the max-size and max-file options, which limit the size of each log file and the number of rotated files. Configuring these options prevents container logs from consuming excessive disk space. Other drivers either discard logs or forward them without built-in rotation controls.

Answer

none

Answer

syslog

Answer

journald

Question 13

You are configuring LXC and want to set a CPU limit for a container. Which cgroup parameter is used to specify the quota of CPU time in microseconds?

Accepted Answer

lxc.cgroup.cpu.cfs_quota_us. The cgroup CPU controller exposes the CFS (Completely Fair Scheduler) bandwidth control parameters cpu.cfs_quota_us and cpu.cfs_period_us. In LXC, these are set via the lxc.cgroup.cpu.cfs_quota_us key, which specifies the maximum CPU time (in microseconds) the container's tasks may consume within each period defined by cpu.cfs_period_us. Setting cfs_quota_us to 50000 with the default period of 100000 us effectively caps the container at 50% of one CPU core.

Answer

lxc.cgroup.cpu.limit

Answer

lxc.cgroup.cpu.shares

Answer

lxc.cgroup.cpu.period_us

Question 14

Which instruction in a Dockerfile is best suited for installing packages to minimize image size?

Accepted Answer

RUN apt-get update && apt-get install -y package && rm -rf /var/lib/apt/lists/*. The RUN instruction with apt-get update, install, and cleanup in a single layer is best because it prevents the apt package lists from being stored in the final image. By combining update, install, and rm -rf /var/lib/apt/lists/* in one RUN, Docker creates a single layer where the lists are downloaded, used, and then deleted before the layer is committed. This minimizes image size because the intermediate files never persist in any layer. Other options either don't install packages (COPY, CMD) or leave cached lists in the image (RUN without cleanup).

Answer

COPY apt-cache /

Answer

CMD apt-get install package

Answer

RUN apt-get update && apt-get install -y package

Question 15

You are troubleshooting a container networking issue. You notice that traffic from the container is not being SNATed. What should you check in the iptables rules?

Accepted Answer

nat table, POSTROUTING chain. SNAT (Source NAT) is performed in the nat table's POSTROUTING chain, which is traversed after the routing decision and just before the packet leaves the interface. If container traffic is not being SNATed, the POSTROUTING chain in the nat table is where the MASQUERADE or SNAT rule should exist. Checking this chain will reveal whether the rule is missing, misordered, or not matching the container's source subnet.

Answer

nat table, PREROUTING chain

Answer

filter table, FORWARD chain

Answer

mangle table, OUTPUT chain