305-300 Hard Questions — 25 Difficult Questions

Question 1

You are using Docker and want to create a volume that is shared between multiple containers and persists even if the containers are deleted. What is the best approach?

Accepted Answer

Named volume. Named volumes are specifically designed for persistence and sharing independent of container lifecycles.

Answer

Anonymous volume

Answer

Tmpfs

Answer

Bind mount

Question 2

Which THREE of the following attributes can be defined within the <memoryBacking> XML block?

Accepted Answer

<hugepages/>. hugepages, locked, and source (type) are all valid components of memory backing.

Answer

<swap-limit/>

Answer

<balloon-rate/>

Question 3

Which THREE networking modes are natively supported by Docker?

Accepted Answer

bridge. Bridge, host, and none are standard Docker network drivers.

Answer

gateway

Answer

tunnel

Question 4

You are using systemd-nspawn to run a container. You notice the container does not have access to the host's system clock. Which flag must be added to the command to allow access to the system time?

Accepted Answer

--capability=CAP_SYS_TIME. Systemd-nspawn uses --private-users and other isolation flags, but specific hardware access requires flags.

Answer

--share-system

Answer

--clock-passthrough

Answer

--bind=/dev/rtc

Question 5

In a FreeBSD Jail, how can you ensure the jail starts automatically at boot?

Accepted Answer

Set jail_enable=YES in /etc/rc.conf. Setting 'jail_enable="YES"' in /etc/rc.conf is required for the jails subsystem to start.

Answer

Create a symlink in /etc/init.d

Answer

Use systemd

Answer

Add a cron job

Question 6

When configuring a Docker volume that needs to be shared between multiple containers, which storage driver storage path is recommended to ensure persistent data availability if the host reboots?

Accepted Answer

-v /host/path:/container/path. Using a named volume or a bind mount to a host directory ensures persistence beyond the container lifecycle.

Answer

--link

Answer

--tmpfs

Answer

--volume-driver=none

Answer

--memory

Question 7

You are performing a live migration of a VM using libvirt. The source and destination hosts share a common storage pool (NFS). Which option should be used with 'virsh migrate' to ensure only the memory state is transferred?

Accepted Answer

--copy-storage-none. --live --copy-storage-none allows migration without moving the disk image if the storage is shared.

Answer

--shared-storage

Answer

--migrate-memory-only

Answer

--unsafe

Question 8

You are troubleshooting a performance issue and want to pin a VM process to specific physical CPU cores. Which XML element is used?

Accepted Answer

. The and elements are used for CPU pinning.

Answer

Answer

<cpu-pinning vcpu='0' cpu='0'/>

Answer

Question 9

You are optimizing a Dockerfile to reduce image size. Which THREE of the following practices are recommended?

Accepted Answer

Remove /var/lib/apt/lists/* after installing packages. Multi-stage builds, minimizing layers, and cleaning up caches are standard practices.

Answer

Use the FROM latest tag for all base images

Answer

Always install recommended packages for security

Question 10

In an OpenVZ environment, you need to limit the number of processes a container can create. Which parameter in the container configuration file should be modified?

Accepted Answer

NUMPROC. The 'nproc' (or numproc) parameter in the OpenVZ configuration limits the total number of processes a container is allowed to hold.

Answer

PHYSPAGES

Answer

KMEMSIZE

Answer

PRIVVMPAGES

Question 11

You are troubleshooting a problem where an LXC container cannot access its own /dev/null. What is a common cause in a non-root container?

Accepted Answer

Missing mknod permission. Lack of device node creation in the container's /dev directory or improper cgroup permissions often causes this.

Answer

Wrong kernel version

Answer

Host kernel panic

Answer

Insufficient RAM

Question 12

Which THREE storage drivers are supported by Docker?

Accepted Answer

devicemapper. Overlay2, devicemapper, and aufs are well-known Docker storage drivers.

Answer

xfs

Answer

ext4

Question 13

You are using systemd-nspawn. How do you create an image of a container to be used as a template?

Accepted Answer

machinectl export-tar. 'machinectl export-tar' is used to export a systemd-nspawn container (machine) to a tarball.

Answer

tar -cvf

Answer

docker export

Answer

lxc-copy

Question 14

When migrating a Libvirt domain using 'virsh migrate --live', which option must be specified to ensure the guest's memory state is copied over the network?

Accepted Answer

--copy-storage-all. The --live option manages the memory transfer, but the --copy-storage-all or --block-incremental option is required if the disks are not on shared storage.

Answer

--shared-storage

Answer

--migrate-disk

Answer

--memory-copy

Question 15

You are using an overlay network in Docker Swarm. What is the standard protocol used for the control plane and data plane communication between nodes?

Accepted Answer

VXLAN. VXLAN is the standard encapsulation protocol used by Docker overlay networks.

Answer

BGP

Answer

IPsec

Answer

GRE

Question 16

Which THREE items are typically included in an OpenVZ configuration file?

Accepted Answer

User Beancounters (resource limits). OpenVZ configs contain networking definitions, resource limits (UBC), and OS template references.

Answer

BIOS settings

Answer

Kernel source code

Question 17

You are configuring an OpenVZ container. Which command is used to set the hostname of the container from the host?

Accepted Answer

vzctl set CTID --hostname. 'vzctl set [CTID] --hostname [NAME] --save' is the correct command to update the container's hostname.

Answer

vzcfg

Answer

hostnamectl

Answer

openvz-edit

Question 18

In systemd-nspawn, how do you specify a different root directory for the container?

Accepted Answer

-D. The -D or --directory flag specifies the root path.

Answer

--path

Answer

--root

Answer

-r

Question 19

In a Docker swarm, which mode of service publishing allows incoming traffic to be load-balanced across all healthy container replicas?

Accepted Answer

ingress. The 'ingress' network mode in Swarm allows external traffic to hit any node and be routed to a container via the routing mesh.

Answer

macvlan

Answer

overlay

Answer

host

Question 20

Which TWO of the following are true regarding the differences between rkt (Rocket) and Docker?

Accepted Answer

rkt utilized a daemonless architecture. rkt focused on pods and a daemonless architecture, whereas Docker initially used a centralized daemon.

Answer

rkt only supported binary images

Answer

Docker is a sub-project of rkt

Answer

Docker never had a daemon