305-300 Multiple Select — 30 Questions

Question 1

Which THREE of the following are necessary components for a successful KVM virtualization environment on Linux?

Accepted Answer

The kvm kernel module. Option A (the kvm kernel module) is correct because KVM is implemented as a Linux kernel module that exposes the /dev/kvm interface and provides the core virtualization capability, so without loading kvm (or kvm_intel/kvm_amd) no guest can execute. Option B (QEMU userspace tools) is correct because KVM only handles CPU and memory virtualization in the kernel; QEMU provides the userspace device emulation, BIOS/firmware, and the qemu-system-x86_64 process that actually creates and runs the VM. Option C (hardware support for Intel VT-x or AMD-V) is correct because KVM requires CPU virtualization extensions (vmx or svm) exposed in the CPU flags; without them KVM cannot run hardware-accelerated guests. Option D (a dedicated storage network switch) is not required, since KVM guests can use local disks, files, or any existing network via virtio, and a separate storage switch is only an optional design choice. Option E (a full Xen hypervisor installed) is not required and is in fact an alternative hypervisor; KVM does not depend on Xen, and installing Xen would be a different virtualization stack.

Answer

A dedicated storage network switch

Answer

A full Xen hypervisor installed

Question 2

Which TWO of the following are valid libvirt storage pool lifecycle commands?

Accepted Answer

pool-start. Option B, pool-start, is correct because it is a genuine virsh subcommand that activates a previously defined but inactive storage pool, making its backing storage available for allocation to guests. Option D, pool-destroy, is correct because it is the valid virsh command that stops an active storage pool, tearing down its runtime state without deleting its persistent definition. The other options are not libvirt commands: pool-halt (A) and pool-reboot (C) are not virsh storage pool subcommands at all, and pool-pause (E) does not exist, since libvirt storage pools have no pause state — only active/inactive and defined/undefined states managed via pool-start, pool-destroy, pool-define, and pool-undefine.

Answer

pool-halt

Answer

pool-reboot

Answer

pool-pause

Question 3

Which THREE of the following steps are involved in performing a manual disk migration of a VM?

Accepted Answer

Editing the domain XML on the target host. Manual disk migration of a VM requires copying the VM's disk image to the target host (D), since the storage must be present there before the domain can run; this is typically done with tools like rsync, scp, or cp. The target host's domain XML must then be edited (A) to point to the new disk path and any host-specific settings, because the original XML references the source host's storage location. Finally, the domain is registered on the target host with virsh define (C), which loads the edited XML into libvirt so the VM can be started. Options B and E are not part of the process: reformatting the disk image would destroy the guest's data and filesystem, and updating the host kernel is unrelated to migrating a VM's disk and domain definition.

Answer

Reformatting the disk image

Answer

Updating the host kernel

Question 4

Which TWO components are defined in a Packer 'build' block?

Accepted Answer

sources. In a Packer HCL2 template, the build block is where you declare the sources (option C) that Packer will use to create the image, referencing source blocks defined elsewhere in the template, and the provisioners (option E) that run during the build to customize the machine before the image is captured. Both sources and provisioners are valid arguments inside a build block, e.g. build { sources = ["source.amazon-ebs.example"] provisioners = [ ... ] }. Option A (builders) is not correct because in HCL2 templates the builder is defined inside a source block, not directly as a build block argument. Option B (plugins) is not a build block argument; plugins are installed via packer init and referenced through their source types. Option D (variables) is not defined inside the build block; variables are declared in variable blocks and referenced with var.<name>.

Answer

builders

Answer

plugins

Answer

variables

Question 5

Which TWO of the following are valid storage drivers used by Docker to manage image layers?

Accepted Answer

overlay2. overlay2 (A) is a valid Docker storage driver that uses the OverlayFS union filesystem to stack image layers and is the default driver on most modern Linux distributions. aufs (E) is also a valid Docker storage driver, historically used on Ubuntu/Debian, that implements a union mount to manage image layers. ext4 (B) is a filesystem, not a Docker storage driver, so it cannot manage image layers. vfs-driver (C) is not a real driver name; the actual driver is 'vfs', and it is a simple non-union driver, but the option as written is incorrect. zfs-layer (D) is not a valid driver name; the actual Docker driver is 'zfs', so this option is incorrect.

Answer

ext4

Answer

vfs-driver

Answer

zfs-layer

Question 6

Which TWO of the following commands are used for VM disk image management?

Accepted Answer

qemu-img create. Option B, `qemu-img create`, is correct because it is the standard qemu-img subcommand used to create a new VM disk image, specifying the format (e.g., qcow2, raw) and size. Option E, `qemu-img info`, is correct because it displays metadata about an existing disk image, such as its virtual size, disk size, format, and backing file. The other options are not valid qemu-img subcommands: `qemu-img list` (A) does not exist for enumerating images, `qemu-img status` (C) is not a qemu-img operation, and `qemu-img format` (D) is not a subcommand — formatting is done via the `-f`/`-O` options on create/convert.

Answer

qemu-img list

Answer

qemu-img status

Answer

qemu-img format

Question 7

Which THREE directives are valid under the cloud-init 'users' configuration section?

Accepted Answer

name. In the cloud-init 'users' configuration section, the 'name' directive (A) is valid and required, as it defines the login name of the user account to be created. The 'ssh_authorized_keys' directive (B) is also valid, allowing a list of public SSH keys to be injected into the user's ~/.ssh/authorized_keys file for passwordless authentication. The 'groups' directive (E) is valid as well, specifying a list of supplementary groups to which the user should be added. The 'expiration_date' option (C) is not a recognized cloud-init user directive; account expiration is handled via the 'expire' directive (or 'expiredate' in some schemas), not 'expiration_date'. The 'security_level' option (D) is not part of the cloud-init users schema at all and has no meaning in this context.

Answer

expiration_date

Answer

security_level

Question 8

Which TWO commands are used to manage images in Docker?

Accepted Answer

docker tag. docker tag (A) is correct because it manages images by creating a new reference/tag pointing to an existing image (docker tag SOURCE_IMAGE[:TAG] TARGET_IMAGE[:TAG]), which is an image-level operation. docker build (E) is correct because it manages images by constructing a new image from a Dockerfile and build context, producing an image stored in the local image cache. The other options operate on containers rather than images: docker run (B) creates and starts a container from an image, docker create (C) creates a container without starting it, and docker attach (D) attaches the local standard input/output/error streams to a running container's process.

Answer

docker run

Answer

docker create

Answer

docker attach

Question 9

Which THREE of the following are valid elements inside the <interface type='bridge'> block?

Accepted Answer

. Option A is correct because is the required child element that tells libvirt which host bridge the guest interface should be attached to, and it is valid inside . Option D is correct because is a valid child element that selects the emulated NIC model presented to the guest, with virtio being the paravirtualized option. Option E is correct because is a valid child element used to assign a specific MAC address to the guest interface. Options B and C are not valid here: and are not children of ; IP/gateway configuration belongs in the guest OS or in higher-level network definitions, not in the interface's bridge block.

Answer

Answer

Question 10

Which THREE of the following are common cloud-init modules?

Accepted Answer

packages. Option B (packages) is a standard cloud-init module that installs or upgrades packages on first boot by reading the packages and package_upgrade keys, so it is correct. Option C (runcmd) is a core cloud-init module that executes arbitrary shell commands listed under the runcmd key during the final boot stage, making it correct. Option E (users-groups) is the cloud-init module responsible for creating and configuring users and groups from the users and groups directives, so it is also correct. Options A (network-bridge) and D (disk-partition) are not cloud-init modules; networking is handled by modules such as network-config or the distro's network renderer, and partitioning is handled by modules like disk_setup and growpart, so neither belongs here.

Answer

network-bridge

Answer

disk-partition

Question 11

Which THREE of the following are legitimate security concerns when managing a virtualization host?

Accepted Answer

Unencrypted VNC connections. Option A is correct because VNC is often used to remotely access a virtualization host's console or guest consoles, and VNC traffic is unencrypted by default, allowing credentials and session data to be intercepted on the network. Option B is correct because the libvirt socket (typically /var/run/libvirt/libvirt-sock) provides privileged management access to virtual machines; if permissions are misconfigured, unauthorized users could start, stop, or reconfigure guests. Option D is correct because guest-to-host breakout exploits target hypervisor or emulation vulnerabilities to escape the VM boundary and gain code execution on the host, which is a fundamental virtualization security risk. Option C is not a security concern but a performance/availability consideration, and option E is a storage performance issue rather than a security threat.

Answer

Network interface speed

Answer

Hard drive fragmentation

Question 12

Which TWO of the following commands can be used to manage virtual networks in libvirt?

Accepted Answer

virsh net-define. Option A, virsh net-define, is correct because it defines a persistent virtual network in libvirt from an XML configuration file, creating the network object that can later be started and made autostart. Option E, virsh net-list, is correct because it lists the virtual networks known to libvirt and can show their state (active/inactive) and autostart flag, making it a core management command. Option B, virsh net-config, does not exist as a libvirt subcommand; network XML is edited via virsh net-edit or net-define. Option C, virsh net-start-all, is not a valid virsh command; individual networks are started with virsh net-start, and autostart is set with virsh net-autostart. Option D, virsh net-status, is not a real libvirt subcommand; network state is obtained through virsh net-list or virsh net-info.

Answer

virsh net-config

Answer

virsh net-start-all

Answer

virsh net-status

Question 13

You are reviewing a KVM host and need to identify which of the following CPU features must be exposed to a guest to allow hardware-assisted nested virtualization inside that guest. (Choose two.)

Accepted Answer

ept or npt, to provide second-level address translation. Hardware-assisted nested virtualization requires both the virtualization extension (vmx on Intel, svm on AMD) and the second-level address translation feature (ept on Intel, npt on AMD) to be exposed to the guest. Together they let the guest hypervisor run its own VMs with hardware acceleration. Flags like hypervisor, aes, and rdrand are unrelated to nesting and do not enable it.

Answer

aes, to accelerate cryptographic operations in the guest

Answer

rdrand, to provide a hardware random number generator

Answer

hypervisor, to indicate the guest is running under a hypervisor

Question 14

You are configuring a rootless Podman container that must persist data across container restarts and also needs to communicate with other containers on the same host using a user-defined network. Which two actions must you perform to achieve these goals? (Choose two.)

Accepted Answer

Create a user-defined network with podman network create and attach the container to it.. To persist data across restarts in rootless Podman, a named volume created with podman volume create and mounted into the container is the correct approach. For containers to communicate by name on the same host, a user-defined network created with podman network create and attached to the container is required. The other options either introduce unnecessary privileges or do not address both requirements.

Answer

Use a bind mount to a host directory and set the --userns=host flag to avoid permission issues.

Answer

Add the --ipc=host flag to allow containers to share memory and communicate.

Answer

Run the container with the --privileged flag to allow volume mounting and network access.

Question 15

You are configuring an LXC container and need to limit its CPU and memory usage. Which TWO of the following configuration options in the container's config file are valid for this purpose? (Choose two.)

Accepted Answer

lxc.cgroup2.cpu.max = 50000 100000. LXC uses cgroup v2 settings to enforce resource limits. The options lxc.cgroup2.cpu.max and lxc.cgroup2.memory.max are valid and directly limit CPU bandwidth and memory usage, respectively. The other options either use non-existent configuration keys or, in the case of cpuset.cpus, control CPU affinity rather than usage limits. Thus, only the cgroup2-based limits achieve the goal.

Answer

lxc.cgroup2.cpuset.cpus = 0-1

Answer

lxc.memory.limit = 1G

Answer

lxc.cpu.limit = 2

Question 16

An administrator is configuring a KVM host that will run a latency-sensitive guest. The goal is to reduce scheduling jitter and improve cache locality for that guest's vCPUs. Which TWO measures are appropriate? (Choose two.)

Accepted Answer

Isolate host CPUs from the general scheduler using the kernel's isolcpus or cpuset controls and assign the guest to them.. Reducing jitter and improving cache locality for a latency-sensitive guest is achieved by dedicating host CPUs to it and preventing the scheduler from moving or preempting its vCPU threads. Pinning vCPU threads to specific physical CPUs and isolating those CPUs from the general scheduler via isolcpus or cpusets together provide that isolation. Disk cache settings, memory ballooning, and adding vCPUs do not address CPU scheduling jitter.

Answer

Increase the number of vCPUs assigned to the guest so the scheduler has more threads to choose from.

Answer

Set the guest's disk cache mode to 'none' in the domain XML.

Answer

Enable the virtio-balloon driver and set a memory balloon target for the guest.

Question 17

You are troubleshooting a KVM guest that fails to boot after you changed its XML configuration. You want to verify and correct the guest's definition without starting it. Which TWO of the following actions are appropriate? (Choose two.)

Accepted Answer

Use virsh define /path/to/guest.xml to update the persistent domain definition from an edited XML file.. To correct a guest's persistent XML without starting it, you can either edit the XML directly with virsh edit, which validates before saving, or prepare an edited XML file and apply it with virsh define. Both update the persistent definition. Using virsh create would only start a transient guest, and undefining is destructive and unnecessary.

Answer

Use virsh undefine guestname then virsh define guest.xml to replace the configuration.

Answer

Use virsh dumpxml guestname > guest.xml, edit the file, then run virsh create guest.xml to apply changes persistently.

Answer

Use virsh start guestname --validate to check the XML and start the guest if valid.

Question 18

You need to enable and configure a UEFI firmware boot for a new KVM guest on a libvirt host. Which TWO of the following steps are required? (Choose two.)

Accepted Answer

Set the domain's element to use with the OVMF code and variable store paths, or select the UEFI firmware via the firmware autoselection feature.. Enabling UEFI boot requires the OVMF firmware files to be present on the host and the domain XML to reference them via a pflash loader or firmware autoselection. Neither the disk image format nor the guest agent is relevant to UEFI support, and there is no 'uefi' boot device value in libvirt XML.

Answer

Disable the QEMU guest agent channel because it conflicts with UEFI variable services.

Answer

Convert the guest disk image from qcow2 to raw format because UEFI firmware cannot boot from qcow2.

Answer

Add a element to the domain's section to select UEFI boot order.

Question 19

Which TWO of the following are valid storage pool types in libvirt?

Accepted Answer

logical. Option C (logical) is correct because libvirt defines a 'logical' storage pool type that manages LVM volume groups, allowing volumes to be created as logical volumes within an existing VG. Option E (iscsi) is correct because libvirt supports an 'iscsi' storage pool type that connects to an iSCSI target and exposes its LUNs as volumes via the iscsi-direct or iscsi pool driver. The other options are not valid libvirt pool types: 'nfs-server' is not a pool type (NFS is handled by the 'netfs' pool type), 'virtual-disk' is not a recognized libvirt pool type, and 'remote-disk' is not a libvirt pool type either. Valid libvirt pool types include dir, fs, netfs, logical, disk, iscsi, scsi, mpath, rbd, sheepdog, gluster, zfs, and vstorage, which confirms that only logical and iscsi fit the scenario.

Answer

nfs-server

Answer

virtual-disk

Answer

remote-disk

Question 20

Which THREE of the following are valid components of a libvirt domain XML configuration?

Accepted Answer

. The element (A) is a valid top-level component of a libvirt domain XML; it defines the guest OS boot configuration such as the boot device order and the type of firmware (for example hvm or arch). The element (C) is also valid and specifies the CPU model and features exposed to the guest, such as host-passthrough or a named model like qemu64. The element (D) is a required top-level container in a libvirt domain XML that holds all guest device definitions, including disks, network interfaces, graphics, and controllers. The unmarked options do not belong: (B) is not a recognized libvirt domain XML element, and (E) is not a valid libvirt domain XML element either (network configuration is expressed through entries inside and separate libvirt network XML files).

Answer

<kernel-module>

Answer

<network-config>