305-300 Hard Questions — 25 Difficult Questions

Question 1

In systemd-nspawn, how do you specify a different root directory for the container?

Accepted Answer

-D. The -D flag (long form --directory) in systemd-nspawn specifies the root directory for the container. This is the documented option for pointing nspawn at a directory tree that should be used as the container's filesystem root. For example, 'systemd-nspawn -D /var/lib/machines/mycontainer' boots the container using that path as its root.

Answer

--path

Answer

--root

Answer

-r

Question 2

When configuring cloud-init 'network-config', which format is primarily used to describe network interfaces?

Accepted Answer

YAML. cloud-init's network-config uses YAML as its primary format, following the Netplan v2 schema. The YAML structure defines version, ethernets, addresses, gateways, and nameservers in a hierarchical, human-readable way. While cloud-init can consume other formats in some contexts, the network-config payload is canonically YAML.

Answer

Shell

Answer

INI

Answer

JSON

Question 3

In a Vagrantfile, which method is used to pass environment variables into the guest virtual machine during the provisioning phase?

Accepted Answer

config.vm.provision "shell", env: { "VAR" => "value" }. In a Vagrantfile, environment variables are passed to a shell provisioner using the `env` option on the provisioner block: `config.vm.provision "shell", env: { "VAR" => "value" }`. This injects the variables into the environment of the provisioning script running inside the guest. It is the documented, supported way to make host-side values available to guest provisioning.

Answer

config.env.set

Answer

config.vm.env

Answer

vagrant.env.set

Question 4

You are preparing a KVM guest for a live migration with virsh migrate --live and want the guest's disk writes to be tracked on the source host so that only dirty blocks are transferred after the memory copy begins. The guest disk is a raw image on a local LVM logical volume, and the destination host can reach the source's storage via a shared Fibre Channel LUN, but the LUN is not yet visible on the destination. Which action must you take on the source host before starting the migration to enable dirty-block tracking for this disk?

Accepted Answer

Start a block copy job with virsh blockcopy --domain guest --path vda --dest /dev/mapper/vg_lun --wait --verbose to mirror writes to the shared LUN.. Live migration with only dirty blocks transferred requires a mechanism that records writes while the guest runs. A block copy job using virsh blockcopy mirrors the disk to the destination and maintains a dirty bitmap, so the final pass copies only changed blocks. The destination must be able to see the target LUN, which the shared Fibre Channel setup provides once the copy job points to it.

Answer

Edit the domain XML and add <driver name='qemu' type='raw' cache='none' io='native'/> to the disk definition, then redefine the domain.

Answer

Convert the raw LVM volume to a qcow2 file with qemu-img convert -O qcow2, then start the migration.

Answer

Run virsh domblkthreshold --domain guest --dev vda --threshold 0 to force libvirt to record writes.

Question 5

A KVM guest is configured with a virtio-blk disk backed by a qcow2 image on an NFS mount. During heavy write activity, the guest reports I/O errors and the host logs show 'nfs: server not responding'. You need to improve resilience so that transient NFS outages do not immediately cause guest I/O failures. Which QEMU block device cache mode should you set for the disk to allow the guest to continue operating during brief NFS stalls?

Accepted Answer

cache=writeback. With cache=writeback, the host page cache absorbs writes and acknowledges them to the guest before they reach the NFS server. This buffering allows the guest to keep running during short NFS outages, preventing immediate I/O errors. Other cache modes either force synchronous writes to the network storage or sacrifice data integrity without providing the intended resilience.

Answer

cache=none

Answer

cache=unsafe

Answer

cache=directsync

Question 6

A KVM host uses a storage pool of type 'logical' backed by an LVM volume group named vg_vms. You need to create a new 20 GB volume for a guest directly from this pool using virsh. Which command accomplishes this?

Accepted Answer

virsh vol-create-as vmpool guest1 20G. Provisioning a volume inside an existing libvirt storage pool is done with vol-create-as, specifying the pool name, volume name, and capacity. This uses libvirt's storage driver to allocate the underlying LV in the logical pool. The other commands either create pools, list volumes, or misuse required arguments, and none of them allocate the requested 20 GB volume.

Answer

virsh vol-list vmpool --create guest1 20G

Answer

virsh vol-create-as vg_vms guest1.img 20G

Answer

virsh pool-create-as vmpool logical 20G

Question 7

You are troubleshooting a KVM guest that fails to start with the error 'unsupported configuration: CPU mode 'host-passthrough' requires KVM'. Which of the following is the most likely cause?

Accepted Answer

The guest is configured to use a CPU mode that is only supported by the KVM hypervisor, but the hypervisor is not KVM (e.g., QEMU TCG).. The error 'unsupported configuration: CPU mode 'host-passthrough' requires KVM' occurs when the guest is configured with <cpu mode='host-passthrough'/> but libvirt is not using the KVM hypervisor. This can happen if KVM is not enabled on the host, or if the domain XML explicitly sets a different hypervisor type. host-passthrough exposes the host CPU model and features directly to the guest, which is only possible with hardware virtualization.

Answer

The host CPU is too old and does not support the host-passthrough mode.

Answer

The guest's XML configuration has a typo in the CPU mode attribute.

Answer

The host CPU does not support hardware virtualization extensions.

Question 8

You are deploying a multi-container application with Docker Compose. The web container must be able to resolve the service name 'db' to the database container's IP address, but the database container must NOT be able to initiate connections to the web container. Both containers are on the same user-defined bridge network 'app_net'. Which configuration change should you make?

Accepted Answer

Attach the db container to a separate user-defined network 'db_net', and attach the web container to both 'app_net' and 'db_net'.. Docker Compose allows a service to join multiple networks, and network membership determines reachability. A container can only communicate with another container if they share at least one network. By isolating the database on its own network and attaching only the web container to both networks, the web container gains access to the database, but the database cannot reach the web container. This pattern is commonly used to enforce security boundaries in multi-tier applications.

Answer

Use 'links' in the web service definition to point to the db service, and remove the shared network.

Answer

Attach the web container to a second user-defined network 'frontend_net', and attach the db container only to 'app_net'.

Answer

Place the db container on an internal-only network and the web container on both the internal network and a frontend network.

Question 9

A running KVM guest named db1 has its root disk on a qcow2 image. You need to create a point-in-time snapshot of the guest's disk and memory state so it can be reverted later, while keeping the guest running. Which virsh command should you use?

Accepted Answer

virsh snapshot-create-as db1 snap1. To capture both disk and memory state of a running guest for later reversion, snapshot-create-as without disk-only or external flags creates an internal snapshot containing the full state. Disk-only omits memory, memspec requires an external disk snapshot, and save stops the guest rather than snapshotting it.

Answer

virsh save db1 /var/lib/libvirt/save/db1.save

Answer

virsh snapshot-create-as db1 snap1 --memspec file=/var/lib/libvirt/save/db1.mem,snapshot=external

Answer

virsh snapshot-create-as db1 snap1 --disk-only

Question 10

You are building a container image with Buildah and want to ensure that the resulting image can be run by a non-root user without any additional runtime flags. The application inside writes logs to /var/log/app. Which Dockerfile instruction or Buildah command should you use to make /var/log/app writable by the non-root user in the final image?

Accepted Answer

Use the USER instruction to switch to the non-root user, then RUN mkdir -p /var/log/app && chown user:user /var/log/app. To make a directory writable by a non-root user in the final image, you must create it and set ownership to that user during the build. Switching to the user with USER and then running mkdir and chown ensures the directory is owned correctly in the image layer. Other approaches like VOLUME or COPY --chown do not reliably set directory ownership for existing paths.

Answer

Set the environment variable LOG_DIR=/var/log/app and expect the application to create it

Answer

Add a VOLUME instruction for /var/log/app so the directory is writable at runtime

Answer

Use the --chown flag with a COPY instruction to copy a placeholder file into /var/log/app

Question 11

You are troubleshooting a Docker container that fails to start with the error 'no space left on device' even though the host has ample free disk space. The container uses the overlay2 storage driver. Which of the following is the most likely cause?

Accepted Answer

The container's writable layer has reached its size limit due to a quota set with --storage-opt size=.. The error 'no space left on device' for a single container while the host has free space strongly indicates a per-container storage quota. Docker's overlay2 driver supports the --storage-opt size= option to limit the writable layer size. When the container exceeds this limit, writes fail with this error. Checking the container's configuration for size limits and either increasing the quota or cleaning up the container's data resolves the issue.

Answer

The Docker daemon's data-root directory is on a filesystem that is full.

Answer

The container image is corrupted and needs to be re-pulled.

Answer

The overlay2 driver has run out of inodes on the host filesystem.

Question 12

You are troubleshooting a Docker container that fails to start with the error "no space left on device" even though the host's root filesystem has free space. The Docker daemon uses the overlay2 storage driver on a dedicated /var/lib/docker partition. Which two actions should you take to resolve the issue? (Choose two.)

Accepted Answer

Run `docker system prune -a` to remove unused images, containers, and build cache.. The error indicates a lack of resources on the /var/lib/docker filesystem. Checking inode usage with `df -i` determines if inodes are exhausted, and `docker system prune -a` reclaims both inodes and block space by removing unused Docker objects. Other options either do not apply to overlay2 or do not address the immediate shortage.

Answer

Move the Docker data directory to a filesystem with more free inodes by editing /etc/docker/daemon.json.

Answer

Increase the size of the Docker container's writable layer by adding `--storage-opt size=10G`.

Answer

Restart the Docker daemon with `systemctl restart docker`.

Question 13

You are configuring a rootless Podman container that needs to bind to a privileged port (port 80) on the host. Which TWO of the following are required to achieve this? (Choose two.)

Accepted Answer

Publish the port using -p 80:80, which uses rootless port forwarding.. For rootless Podman to bind to a privileged port like 80, the host's sysctl net.ipv4.ip_unprivileged_port_start must be set to 80 or lower, allowing unprivileged users to bind to that port. Additionally, publishing the port with -p 80:80 sets up rootless port forwarding, which uses a proxy to bind the host port. Both are required: the sysctl removes the kernel restriction, and the port mapping configures the forwarding. Without the sysctl, the proxy cannot bind to port 80; without the port mapping, the container's service is not exposed.

Answer

Use the --cap-add=NET_BIND_SERVICE option when running the container.

Answer

Run the container with the --privileged flag.

Answer

Add the user to the docker group.

Question 14

You are using Packer to build a VMware vSphere template. The build fails with an error that the 'vsphere-iso' builder cannot find the ISO file on a datastore. You have uploaded the ISO to a content library. Which Packer configuration option should you use to reference the ISO from the content library?

Accepted Answer

iso_paths with a content library path. The vsphere-iso builder in Packer allows the iso_paths option to accept both datastore paths and content library paths. When an ISO is stored in a content library, you must use iso_paths with a content library URL format. Other options like iso_url are not used by this builder, and content_library_iso is not a valid configuration key. Therefore, using iso_paths with a content library path is the correct approach.

Answer

content_library_iso

Answer

iso_url

Answer

iso_paths

Question 15

Which THREE of the following steps are involved in performing a manual disk migration of a VM?

Accepted Answer

Editing the domain XML on the target host. Manual disk migration of a VM requires copying the VM's disk image to the target host (D), since the storage must be present there before the domain can run; this is typically done with tools like rsync, scp, or cp. The target host's domain XML must then be edited (A) to point to the new disk path and any host-specific settings, because the original XML references the source host's storage location. Finally, the domain is registered on the target host with virsh define (C), which loads the edited XML into libvirt so the VM can be started. Options B and E are not part of the process: reformatting the disk image would destroy the guest's data and filesystem, and updating the host kernel is unrelated to migrating a VM's disk and domain definition.

Answer

Reformatting the disk image

Answer

Updating the host kernel

Question 16

Which THREE of the following are valid options for 'virsh shutdown'?

Accepted Answer

--mode acpi. The virsh shutdown command accepts a --mode option that selects how the guest is asked to power down: --mode acpi (A) sends an ACPI power-button event so the guest OS performs a clean, orderly shutdown; --mode agent (B) uses the QEMU guest agent (qemu-guest-agent) to request shutdown from inside the guest; and --mode initctl (C) triggers the shutdown via the guest's initctl/systemd mechanism. These three are the documented valid values for --mode in virsh shutdown. Options D (--mode force) and E (--mode hard) are not valid values for virsh shutdown; forced or hard power-off is performed with virsh destroy, not by a shutdown mode.

Answer

--mode force

Answer

--mode hard

Question 17

You are using Docker and want to create a volume that is shared between multiple containers and persists even if the containers are deleted. What is the best approach?

Accepted Answer

Named volume. A named volume is created and managed by Docker with a user-specified name, stored under /var/lib/docker/volumes, and persists independently of container lifecycle. It can be mounted into multiple containers simultaneously, making it the best choice for shared, persistent data. Named volumes are the recommended approach for production data persistence.

Answer

Anonymous volume

Answer

Tmpfs

Answer

Bind mount

Question 18

A VM is hanging because of a specific hardware emulation bug in QEMU. You need to enable the 'qxl' video device to see if it resolves display issues. What is the XML tag to define the video device in the domain config?

Accepted Answer

. In libvirt domain XML, video devices are defined with the

Answer

Answer

Answer

Question 19

You are performing a live migration of a VM using libvirt. The source and destination hosts share a common storage pool (NFS). Which option should be used with 'virsh migrate' to ensure only the memory state is transferred?

Accepted Answer

--copy-storage-none. When source and destination hosts share storage (e.g., an NFS pool), the disk image is already accessible to both, so only the VM's memory state and device state need to be transferred. The '--copy-storage-none' option tells virsh migrate not to copy any storage, which is exactly the shared-storage scenario. This minimizes migration time and network traffic.

Answer

--shared-storage

Answer

--migrate-memory-only

Answer

--unsafe

Question 20

In cloud-init, which syntax is required at the very beginning of the configuration file to ensure it is recognized as a cloud-config script?

Accepted Answer

#cloud-config. Cloud-init identifies a cloud-config file by the literal header #cloud-config on the very first line. Without this exact shebang-style marker, cloud-init treats the payload as a different user-data format (e.g., shell script or MIME multipart) and will not process the YAML directives.

Answer

#!/bin/bash

Answer

#cloud-init

Answer

---