305-300 Container Virtualization Practice Test 6 — 15 Questions

Question 1

You are managing an LXC container and need to create a snapshot of the container's root file system. Which command achieves this?

Accepted Answer

lxc-snapshot -n container_name. The `lxc-snapshot -n <container_name>` command creates a snapshot of an LXC container's root filesystem. It is the standard LXC utility for snapshotting containers, allowing you to capture the current state of the container's filesystem for backup or rollback purposes.

Answer

lxc-checkpoint -n container_name

Answer

lxc-copy -s container_name

Answer

lxc-backup

Answer

lxc-clone --snapshot

Question 2

Which command-line tool is primarily used to inspect the metadata and configuration of a running Docker container?

Accepted Answer

docker inspect. docker inspect returns detailed JSON metadata about a container, including its configuration, network settings, mounts, and state. It is the primary tool for examining the low-level details of a running or stopped container.

Answer

docker ps

Answer

docker stats

Answer

docker info

Answer

docker describe

Question 3

What is the primary function of the ENTRYPOINT instruction in a Dockerfile?

Accepted Answer

Configuring the executable that runs when the container starts. ENTRYPOINT defines the executable that runs when the container starts, making the container behave like a self-contained command. Unlike CMD, which provides default arguments that can be overridden at 'docker run', ENTRYPOINT is not replaced by command-line arguments — those arguments are appended to it. This is why ENTRYPOINT is used to configure a container as an executable.

Answer

Setting environment variables

Answer

Defining volume mount points

Answer

Specifying metadata

Answer

Installing software packages

Question 4

Which file is primarily responsible for defining the configuration and environment variables for an OpenVZ container?

Accepted Answer

/etc/vz/conf/CTID.conf. OpenVZ stores per-container configuration files in /etc/vz/conf/ using the container ID (CTID) as the filename, e.g., /etc/vz/conf/101.conf. This file defines resource limits, network settings, and environment variables for that specific container. The global OpenVZ configuration is in /etc/vz/vz.conf, but per-container settings live in the CTID.conf file.

Answer

/etc/openvz/config

Answer

/var/lib/vz/config

Answer

/etc/vz/container.conf

Answer

/etc/vz/vz.conf

Question 5

You are using BSD Jails and need to start a jail. Which utility is the standard management tool for jail administration?

Accepted Answer

jail. The jail utility is the standard FreeBSD command for creating, starting, and managing jails. Running jail with parameters such as path, hostname, and command starts a new jail. It is the foundational management tool, complemented by jexec for entering a running jail and jls for listing jails.

Answer

jexec

Answer

jails-admin

Answer

jail-manage

Answer

jls

Question 6

When cleaning up Docker resources, which command will remove all stopped containers, unused networks, and dangling images in one step?

Accepted Answer

docker system prune. docker system prune removes all stopped containers, unused networks, dangling images, and (with -a) unused images in a single command. It is the one-step cleanup command that consolidates what would otherwise require separate container prune, network prune, and image prune invocations.

Answer

docker container prune

Answer

docker volume prune

Answer

docker image prune -a

Answer

docker cleanup

Question 7

In the context of container orchestration, what is the role of a 'sidecar' container?

Accepted Answer

To provide auxiliary services like logging or monitoring for the main container. A sidecar container runs alongside the main application container in the same pod, providing auxiliary functionality such as log shipping, metrics collection, proxying, or configuration sync. It shares the pod's network namespace and lifecycle, augmenting rather than replacing the primary container. This is the canonical definition in Kubernetes and general container orchestration.

Answer

To act as a load balancer for the cluster

Answer

To store persistent data for the primary container

Answer

To run in a separate network namespace

Answer

To replace the main container when it crashes

Question 8

You are debugging a Docker network issue where containers on different hosts cannot communicate. Which network driver is specifically designed to support multi-host overlay networking?

Accepted Answer

overlay. The 'overlay' driver is specifically designed for multi-host networking in Docker Swarm, using VXLAN tunnels to encapsulate container traffic across hosts. It creates a distributed network that spans multiple Docker daemons, enabling containers on different hosts to communicate as if on the same Layer 2 network.

Answer

bridge

Answer

macvlan

Answer

ipvlan

Answer

host

Question 9

What is the primary difference between a container image and a container instance?

Accepted Answer

The image is the template; the instance is the running process. A container image is an immutable, layered filesystem template (built from a Dockerfile) that packages the application and its dependencies. A container instance is a running (or stopped) instantiation of that image with its own writable layer, process namespace, and runtime state. The image is the blueprint; the instance is the executing process.

Answer

Images are stored in RAM, instances are on disk

Answer

Instances cannot be stopped

Answer

The instance is the template; the image is the running process

Answer

They are the same thing

Question 10

When configuring a systemd-nspawn container, what is the effect of the --private-network option?

Accepted Answer

It isolates the container's network from the host. The --private-network option in systemd-nspawn creates a new, isolated network namespace for the container. This means the container gets its own loopback interface and no external network interfaces, completely separating its network stack from the host's. As a result, the container cannot communicate with the host or external networks unless additional virtual interfaces are configured.

Answer

It forces the container to use a bridge

Answer

It disables network encryption

Answer

It restricts access to localhost

Answer

It prevents the container from starting

Question 11

Which Dockerfile instruction is used to copy a file from the host file system into the image?

Accepted Answer

COPY. The COPY instruction copies files or directories from the build context (host) into the image filesystem. It is the preferred instruction for straightforward file copying because it does not perform any automatic extraction or remote URL fetching. COPY is explicit and predictable.

Answer

RUN

Answer

ADD

Answer

PUSH

Answer

IMPORT

Question 12

Which command-line option is used to run a Docker container in the background (detached mode)?

Accepted Answer

-d. The -d (or --detach) flag runs a Docker container in the background, returning the container ID and freeing the terminal. This is the standard way to start long-running services like web servers without blocking the shell. Combined with -p for port mapping and --name for identification, it is the canonical detached-mode invocation.

Answer

-i

Answer

--bg

Answer

-b

Answer

-t

Question 13

Which TWO of the following are valid storage drivers used by Docker to manage image layers?

Accepted Answer

overlay2. overlay2 (A) is a valid Docker storage driver that uses the OverlayFS union filesystem to stack image layers and is the default driver on most modern Linux distributions. aufs (E) is also a valid Docker storage driver, historically used on Ubuntu/Debian, that implements a union mount to manage image layers. ext4 (B) is a filesystem, not a Docker storage driver, so it cannot manage image layers. vfs-driver (C) is not a real driver name; the actual driver is 'vfs', and it is a simple non-union driver, but the option as written is incorrect. zfs-layer (D) is not a valid driver name; the actual Docker driver is 'zfs', so this option is incorrect.

Answer

ext4

Answer

vfs-driver

Answer

zfs-layer

Question 14

Which THREE items are typically included in an OpenVZ configuration file?

Accepted Answer

User Beancounters (resource limits). In an OpenVZ container configuration file (typically /etc/vz/conf/<CTID>.conf), User Beancounters (option B) are included as resource limits such as kmemsize, privvmpages, and numproc, which control how much memory, processes, and other resources the container may consume. The OS template reference (option C) is also included, usually via the OSTEMPLATE parameter, which records which OS template (e.g., centos-7-x86_64) was used to create the container and is needed for operations like reinstalling or rebuilding it. Networking parameters (option D) are included as well, with entries such as IP_ADDRESS, HOSTNAME, and NETIF to define the container's IP addressing and virtual network interface. BIOS settings (option A) are not part of an OpenVZ configuration file because OpenVZ containers are OS-level virtualizations that share the host kernel and do not have their own BIOS or firmware. Kernel source code (option E) is likewise not included, since containers use the host's kernel and the configuration file only stores container-specific runtime and resource parameters, not kernel source.

Answer

BIOS settings

Answer

Kernel source code

Question 15

Which TWO types of namespaces are commonly used to achieve container isolation in Linux?

Accepted Answer

Network. Network namespaces (B) are correct because they give each container its own isolated network stack — separate interfaces, IP addresses, routing tables, and firewall rules — which is a core mechanism used by tools like Docker and Kubernetes for container isolation. PID namespaces (D) are also correct because they isolate the process ID number space, so processes inside a container only see their own PID tree (starting at PID 1) and cannot see or signal host processes. The other options do not belong: GPU (A) and CPU (C) are hardware resources managed via cgroups and device access, not namespace types, and Kernel (E) is not a Linux namespace — the kernel itself is shared, with namespaces isolating specific global resources like mount, UTS, IPC, user, network, and PID.

Answer

GPU

Answer

CPU

Answer

Kernel