305-300 Container Virtualization — Timed 25 Questions

Question 1

You are using systemd-nspawn to run a container. You notice the container does not have access to the host's system clock. Which flag must be added to the command to allow access to the system time?

Accepted Answer

--capability=CAP_SYS_TIME. Systemd-nspawn uses --private-users and other isolation flags, but specific hardware access requires flags.

Answer

--share-system

Answer

--clock-passthrough

Answer

--bind=/dev/rtc

Question 2

You are configuring an LXC container and need to ensure the container's root filesystem is isolated from the host. Which configuration option in the container's config file restricts access to the host's /dev directory?

Accepted Answer

lxc.cgroup.devices.deny = a. The lxc.mount.entry and specific device nodes configuration are used to manage isolation.

Answer

lxc.mount.auto = proc:mixed sys:mixed

Answer

lxc.namespace.share = 0

Answer

lxc.cap.drop = sys_admin

Question 3

What is the default bridge network created by Docker when the daemon starts?

Accepted Answer

docker0. The default bridge network created by Docker is named 'bridge'.

Answer

eth0

Answer

virbr0

Answer

none

Question 4

Which THREE of the following are valid storage driver options for Docker on Linux?

Accepted Answer

overlay2. Docker supports multiple storage drivers including overlay2, btrfs, and zfs, depending on the underlying filesystem.

Answer

ext4-driver

Answer

vfs

Question 5

You are optimizing a Dockerfile to reduce image size. Which THREE of the following practices are recommended?

Accepted Answer

Remove /var/lib/apt/lists/* after installing packages. Multi-stage builds, minimizing layers, and cleaning up caches are standard practices.

Answer

Use the FROM latest tag for all base images

Answer

Always install recommended packages for security

Question 6

You are troubleshooting a Docker container that cannot reach the internet despite the host having connectivity. The container uses the default bridge network. Which iptables chain is most likely causing the block?

Accepted Answer

FORWARD. Docker adds rules to the FORWARD chain in the filter table to manage traffic between the bridge network and external networks.

Answer

PREROUTING

Answer

POSTROUTING

Answer

OUTPUT

Question 7

You are configuring an LXC container and need to grant it access to a specific host character device without running the container in privileged mode. Which configuration option in the container's config file should you use?

Accepted Answer

lxc.cgroup2.devices.allow. The lxc.cgroup2.devices.allow directive is the standard way to whitelist specific hardware devices for a container in cgroup2-based environments.

Answer

lxc.cap.keep

Answer

lxc.mount.entry

Answer

lxc.hook.pre-start

Question 8

A Docker container is failing to connect to an external database despite the host being able to ping it. You suspect a bridge networking issue. Which command allows you to inspect the current NAT rules created by Docker?

Accepted Answer

iptables -t nat -L -n. Docker manages iptables rules for container networking.

Answer

docker network inspect bridge

Answer

ip link show docker0

Answer

sysctl -a | grep net.bridge

Question 9

You need to run a container that requires access to the host's network namespace directly to perform packet capture. Which Docker run flag should you use?

Accepted Answer

--network host. The --network host flag allows a container to share the host's networking namespace, providing full access to host network interfaces.

Answer

--cap-add NET_ADMIN

Answer

--privileged

Answer

--net bridge

Question 10

Which Docker command is used to display the resource usage (CPU, memory) of running containers?

Accepted Answer

docker stats. 'docker stats' provides a real-time stream of container resource usage statistics.

Answer

docker top

Answer

docker usage

Answer

docker info

Question 11

When building a Dockerfile, which instruction should be used to define the user context for subsequent RUN, CMD, and ENTRYPOINT instructions?

Accepted Answer

USER. The USER instruction sets the UID/GID for processes executed in subsequent steps.

Answer

WORKDIR

Answer

RUN useradd

Answer

AS

Question 12

You need to inspect the metadata of a specific Docker image without pulling it from a remote registry. Which command should you use?

Accepted Answer

docker manifest inspect. docker manifest inspect allows retrieving information about an image's manifest without downloading the layers.

Answer

docker pull --metadata

Answer

docker image history

Answer

docker image inspect

Question 13

You are using systemd-nspawn and want to run a container that shares the host's network namespace. Which flag is required?

Accepted Answer

--network-host. The --private-network flag disables the network, while omitting it or specifically using --network-veth allows various configurations; however, to share the host's namespace, one must use --network-host.

Answer

--private-network=false

Answer

--network-veth

Answer

--share-net

Question 14

In an OpenVZ environment, you need to limit the number of processes a container can create. Which parameter in the container configuration file should be modified?

Accepted Answer

NUMPROC. The 'nproc' (or numproc) parameter in the OpenVZ configuration limits the total number of processes a container is allowed to hold.

Answer

PHYSPAGES

Answer

KMEMSIZE

Answer

PRIVVMPAGES

Question 15

You are using a BSD Jail and want to limit the filesystem access of the jail to a specific directory tree. Which utility or configuration mechanism is primarily used to achieve this?

Accepted Answer

jail.conf path parameter. The 'path' configuration parameter in the jail.conf file defines the root directory of the jail.

Answer

mount -t nullfs

Answer

jail_root_dir

Answer

chroot

Question 16

You are building a multi-stage Dockerfile and want to copy a binary from the 'builder' stage to the final stage. Which syntax is correct?

Accepted Answer

COPY --from=builder /bin/app /bin/app. 'COPY --from=stage_name source destination' is the syntax for multi-stage copying.

Answer

ADD --from=builder /bin/app /bin/app

Answer

COPY builder:/bin/app /bin/app

Answer

COPY --stage=builder /bin/app /bin/app

Question 17

When using Docker volumes, which type of mount should you use if you want the data to persist on the host filesystem at a specific, user-defined path?

Accepted Answer

Bind mount. Bind mounts allow mapping a specific host path to a container path, providing persistence at a known location.

Answer

Named volume

Answer

Anonymous volume

Answer

Tmpfs mount

Question 18

Which command is used to stop all running containers?

Accepted Answer

docker stop $(docker ps -q). 'docker stop $(docker ps -q)' pipes the IDs of running containers to the stop command.

Answer

docker kill --all

Answer

docker rm -f *

Answer

docker prune

Question 19

Which command allows you to enter an existing running container and execute a new command inside it?

Accepted Answer

docker exec. 'docker exec' is the standard command to run a new process in a running container.

Answer

docker commit

Answer

docker attach

Answer

docker run

Question 20

Which flag is used to run a container in the background?

Accepted Answer

-d. The -d or --detach flag runs the container in the background.

Answer

-t

Answer

-b

Answer

-i