305-300 Container Virtualization Practice Test 7 — 15 Questions

Question 1

Which THREE instructions in a Dockerfile can modify the image's filesystem?

Accepted Answer

ADD. ADD is correct because it copies files, directories, or remote URLs from the build context or a URL into the image filesystem, creating or modifying files in the resulting layer. RUN is correct because it executes a command in a new layer on top of the current image and commits the results, so commands like apt-get install or mkdir directly modify the image's filesystem. COPY is correct because it copies files or directories from the build context into the image filesystem, adding them as a new layer. ENV is not correct because it only sets environment variables in the image metadata and does not alter any files. EXPOSE is not correct because it only documents the intended network port in image metadata and does not change the filesystem.

Answer

ENV

Answer

EXPOSE

Question 2

Which TWO of the following are true regarding the differences between rkt (Rocket) and Docker?

Accepted Answer

rkt utilized a daemonless architecture. Option D is correct because rkt was designed with a daemonless architecture, meaning containers were launched directly by the rkt CLI process without a long-running central daemon like Docker's dockerd. Option E is correct because rkt natively understood the concept of a Pod (a group of co-located containers sharing namespaces), which aligned with Kubernetes' Pod abstraction and allowed rkt to run Kubernetes Pods directly via its pod manifest support. Options A, B, and C are incorrect: rkt supported multiple image formats (including Docker images and ACI), Docker is not a sub-project of rkt (they are independent, competing container runtimes), and Docker has always relied on a daemon (dockerd) to manage containers.

Answer

rkt only supported binary images

Answer

Docker is a sub-project of rkt

Answer

Docker never had a daemon

Question 3

Which THREE of the following are components of the Docker architecture?

Accepted Answer

Docker Daemon. Docker Daemon (A) is correct because dockerd is the persistent background service that listens for Docker API requests and manages Docker objects such as images, containers, networks, and volumes. Docker Client (C) is correct because the docker CLI is the primary user interface that sends commands to the daemon via the Docker REST API over a socket or network. Docker Registry (E) is correct because it is the storage and distribution system for Docker images, with Docker Hub as the default public registry from which images are pulled and to which they are pushed. Docker Kernel (B) is not a Docker component; Docker relies on the host OS kernel's features (namespaces, cgroups) but does not ship its own kernel. Docker GUI (D) is not a core architectural component; graphical tools like Docker Desktop or Portainer are optional third-party or wrapper interfaces, not part of the Docker architecture itself.

Answer

Docker Kernel

Answer

Docker GUI

Question 4

Which TWO of the following are true regarding container orchestration platforms?

Accepted Answer

They automate container deployment. Option B is correct because container orchestration platforms such as Kubernetes, Docker Swarm, and Amazon ECS are specifically designed to automate the deployment, scheduling, and scaling of containers across a cluster of hosts. Option D is correct because these platforms continuously monitor container health through liveness and readiness probes (e.g., Kubernetes livenessProbe/readinessProbe) and automatically restart or reschedule unhealthy containers to maintain the desired state. Option A is incorrect because orchestration platforms sit above and consume a container runtime such as containerd or CRI-O rather than replacing it. Option C is incorrect because orchestration platforms can run on bare metal, virtual machines, or cloud instances. Option E is incorrect because orchestration platforms are designed to manage many different container images simultaneously, not a single image.

Answer

They replace the container runtime

Answer

They only run on bare metal

Answer

They require a single container image

Question 5

A developer is building a container image and wants to reduce its final size by ensuring that no package manager cache files remain in the image layers. Which Dockerfile instruction should be used to remove these temporary files during the build?

Accepted Answer

RUN rm -rf /var/cache/apt/*. To reduce image size by removing temporary files, the deletion must occur in the same layer where the files were created. The RUN instruction executes commands during the build, so using RUN to remove cache files in the same layer ensures they are not committed to the final image. Other instructions like CMD, ENTRYPOINT, or ADD do not execute during build and cannot remove files.

Answer

ADD rm -rf /var/cache/apt/*

Answer

ENTRYPOINT rm -rf /var/cache/apt/*

Answer

CMD rm -rf /var/cache/apt/*

Question 6

A system administrator is troubleshooting a container that cannot resolve DNS names for other containers on the same user-defined Docker bridge network. The container's /etc/resolv.conf points to 127.0.0.11. Which Docker feature is responsible for providing this DNS resolution?

Accepted Answer

Docker's embedded DNS server. Docker's embedded DNS server provides name resolution for containers on user-defined networks. It listens on 127.0.0.11 and resolves container names and aliases, enabling service discovery. This is automatically configured and does not require an external DNS server. The host's resolver or a separate DNS container would not be used by default in this scenario.

Answer

The Docker daemon's --dns flag

Answer

A DNS server running in a separate container

Answer

The host's systemd-resolved service

Question 7

An administrator needs to run a container that requires access to a specific block device on the host, such as /dev/sdb, for direct I/O operations. Which Docker run option should be used to grant the container access to this device?

Accepted Answer

--device /dev/sdb. The --device option is designed to expose a specific host device to a container while properly configuring device cgroup permissions. It allows the container to perform I/O on that device. Other options like --privileged grant broad access, volume mounts do not set permissions, and capabilities alone do not bypass device cgroup restrictions.

Answer

--privileged

Answer

-v /dev/sdb:/dev/sdb

Answer

--cap-add SYS_RAWIO

Question 8

You are running a Podman container as a non-root user with rootless mode. The container needs to bind to TCP port 80 inside the container's network namespace so a legacy application can listen for HTTP traffic. Which capability must be added to the container to allow binding to this privileged port without running the container as root?

Accepted Answer

CAP_NET_BIND_SERVICE. Binding to ports below 1024 requires the CAP_NET_BIND_SERVICE capability when the process does not have root privileges. In rootless Podman, the container process is mapped to an unprivileged user, so the kernel denies the bind on port 80 unless this capability is explicitly added. The other capabilities listed address unrelated privilege areas and would not resolve the bind failure.

Answer

CAP_NET_ADMIN

Answer

CAP_DAC_OVERRIDE

Answer

CAP_SYS_ADMIN

Question 9

A Docker host runs a container with the default bridge network. The container needs to resolve external DNS names, but `docker exec mycontainer ping example.com` fails with 'unknown host'. The host itself resolves names correctly. Which Docker daemon configuration should you check first?

Accepted Answer

The `--dns` flag or `dns` setting in `/etc/docker/daemon.json`. Containers using the default bridge network inherit DNS resolver settings from the Docker daemon. When the host resolves names but the container does not, the daemon's DNS configuration is the prime suspect. Inspecting `/etc/docker/daemon.json` for a `dns` key or the daemon's `--dns` flag reveals whether an unreachable or incorrect resolver was injected into the container.

Answer

The `--iptables` flag in the Docker daemon configuration

Answer

The `--userland-proxy` setting in the Docker daemon

Answer

The `--bridge` flag specifying a custom bridge interface

Question 10

You are using Docker and need to inspect the metadata of a running container, including its IP address, environment variables, and mounted volumes. Which command provides all this information in a single JSON output?

Accepted Answer

docker inspect <container>. The docker inspect command outputs comprehensive JSON metadata for a container, including network settings, environment variables, and mounts. Other commands like docker ps, docker stats, and docker logs serve different purposes such as listing, monitoring, or retrieving logs. Only docker inspect provides the full configuration details required in this scenario.

Answer

docker logs <container>

Answer

docker ps --format json

Answer

docker stats <container>

Question 11

You are building a Docker image and want to ensure that a build-time variable is available only during the build, not persisted in the final image's environment. Which instruction should you use?

Accepted Answer

ARG. `ARG` is designed for values that are needed only while building the image. It can be supplied with `--build-arg` and is not stored in the final image's environment. `ENV` would persist the value, while `LABEL` and `EXPOSE` serve unrelated metadata and port documentation purposes. Only the build-argument instruction meets the requirement of a transient build-time variable.

Answer

ENV

Answer

LABEL

Answer

EXPOSE

Question 12

You are configuring a rootless Podman container that must persist data across container restarts and also needs to communicate with other containers on the same host using a user-defined network. Which two actions must you perform to achieve these goals? (Choose two.)

Accepted Answer

Create a user-defined network with podman network create and attach the container to it.. To persist data across restarts in rootless Podman, a named volume created with podman volume create and mounted into the container is the correct approach. For containers to communicate by name on the same host, a user-defined network created with podman network create and attached to the container is required. The other options either introduce unnecessary privileges or do not address both requirements.

Answer

Use a bind mount to a host directory and set the --userns=host flag to avoid permission issues.

Answer

Add the --ipc=host flag to allow containers to share memory and communicate.

Answer

Run the container with the --privileged flag to allow volume mounting and network access.

Question 13

You are building a Docker image for a Python web application. The Dockerfile currently contains:

FROM python:3.9-slim
COPY . /app
WORKDIR /app
RUN pip install -r requirements.txt
CMD ["python", "app.py"]

After building, you notice that every time you change app.py, the entire pip install step re-runs, making builds slow. Which change to the Dockerfile will best address this?

Accepted Answer

Move the COPY instruction to after the RUN pip install instruction, and copy only requirements.txt before the RUN.. Docker builds images layer by layer and caches each layer based on the instruction and the files it references. By copying only requirements.txt and running pip install before copying the rest of the source, the expensive dependency installation layer remains cached as long as requirements.txt is unchanged. Subsequent changes to application code only invalidate later layers, resulting in much faster rebuilds.

Answer

Add a .dockerignore file that excludes app.py so that changes to it do not invalidate the cache.

Answer

Use a multistage build with a separate stage for dependencies, and copy the installed packages from the builder stage into the final stage.

Answer

Combine the COPY and RUN instructions into a single RUN instruction using a shell command to copy files and install dependencies.

Question 14

A developer wants to run a short-lived container that executes a command and then removes itself automatically after exit. Which `docker run` flag should be used?

Accepted Answer

`--rm`. `--rm` is specifically designed to remove the container automatically when it exits. It is commonly used for one-off commands and CI jobs. The other flags control background execution, STDIN, or TTY allocation, none of which affect post-exit cleanup. Only `--rm` ensures the container does not linger after its task finishes.

Answer

`--detach`

Answer

`--interactive`

Answer

`--tty`

Question 15

You are using Docker and need to view the layers that make up an image to understand its build history. Which command should you use?

Accepted Answer

docker history <image>. The docker history command lists the layers of an image along with the commands that created them, making it the right tool to understand build history. docker inspect provides metadata but not a layer-by-layer history, docker layers does not exist, and docker diff is for container filesystem changes. Therefore, docker history is the correct answer.

Answer

docker inspect <image>

Answer

docker layers <image>

Answer

docker diff <image>