Troubleshooting practice questions

You are troubleshooting a performance issue and want to pin a VM process to specific physical CPU cores. Which XML element is used?

Trap 1: <pinning vcpu='0' cores='0'/>

Incorrect syntax.

Trap 2: <cpu-pinning vcpu='0' cpu='0'/>

Incorrect syntax.

Trap 3: <affinity vcpu='0' host-cpu='0'/>

Incorrect syntax.

A
<pinning vcpu='0' cores='0'/>
Why wrong: Incorrect syntax.
B
<cpu-pinning vcpu='0' cpu='0'/>
Why wrong: Incorrect syntax.
C
<cputune><vcpupin vcpu='0' cpuset='0-1'/></cputune>
Correct syntax for CPU pinning.
D
<affinity vcpu='0' host-cpu='0'/>
Why wrong: Incorrect syntax.

Question 2hardmultiple choice

You are troubleshooting a problem where an LXC container cannot access its own /dev/null. What is a common cause in a non-root container?

Trap 1: Wrong kernel version

/dev/null is standard.

Trap 2: Host kernel panic

This would affect the whole system.

Trap 3: Insufficient RAM

This would cause OOM, not device errors.

A
Missing mknod permission
Containers often need to be able to create nodes if they aren't provided by default.
B
Wrong kernel version
Why wrong: /dev/null is standard.
C
Host kernel panic
Why wrong: This would affect the whole system.
D
Insufficient RAM
Why wrong: This would cause OOM, not device errors.

Question 3hardmultiple choice

You are troubleshooting a libvirt migration that fails with 'Operation not supported: Migration requires a storage pool'. You need to perform a block migration where the storage is copied to the destination host. Which command-line flag enables this functionality?

Trap 1: --live-disk

This flag does not exist in the virsh migration toolset.

Trap 2: --migrate-storage

This is not a valid flag for the virsh migrate command.

Trap 3: --block-migrate

This is not the correct syntax for the migration command.

A
--copy-storage-all
This flag forces the migration of all local storage associated with the domain.
B
--live-disk
Why wrong: This flag does not exist in the virsh migration toolset.
C
--migrate-storage
Why wrong: This is not a valid flag for the virsh migrate command.
D
--block-migrate
Why wrong: This is not the correct syntax for the migration command.

Question 4hardmultiple choice

You are troubleshooting a container networking issue. You notice that traffic from the container is not being SNATed. What should you check in the iptables rules?

Trap 1: nat table, PREROUTING chain

This is for DNAT, not SNAT.

Trap 2: filter table, FORWARD chain

This handles packet filtering/dropping, not NAT.

Trap 3: mangle table, OUTPUT chain

This is for packet modification.

A
nat table, PREROUTING chain
Why wrong: This is for DNAT, not SNAT.
B
nat table, POSTROUTING chain
MASQUERADE rules are added here to handle SNAT.
C
filter table, FORWARD chain
Why wrong: This handles packet filtering/dropping, not NAT.
D
mangle table, OUTPUT chain
Why wrong: This is for packet modification.

Question 5hardmultiple choice

You are troubleshooting a Docker container that cannot reach the internet despite the host having connectivity. The container uses the default bridge network. Which iptables chain is most likely causing the block?

Trap 1: PREROUTING

This belongs to the nat table and handles destination NAT.

Trap 2: POSTROUTING

This is used for masquerading (SNAT) traffic leaving the host.

Trap 3: OUTPUT

The OUTPUT chain handles packets originating from the host, not container traffic.

A
PREROUTING
Why wrong: This belongs to the nat table and handles destination NAT.
B
POSTROUTING
Why wrong: This is used for masquerading (SNAT) traffic leaving the host.
C
FORWARD
Docker injects rules into the FORWARD chain to control inter-network traffic.
D
OUTPUT
Why wrong: The OUTPUT chain handles packets originating from the host, not container traffic.

Read the full NAT/PAT explanation →

Question 6hardmultiple choice

You are troubleshooting a libvirt network issue where the virtual machines cannot reach the external gateway. The virtual network uses a NAT configuration. Which file would you inspect to verify the iptables rules generated by libvirt for this network?

Trap 1: /var/lib/libvirt/network/default.xml

This is the runtime state, but the source of truth is in /etc/libvirt/qemu/networks/.

Trap 2: /etc/sysconfig/network-scripts/ifcfg-virbr0

This file defines the bridge interface, not the NAT rules.

Trap 3: /etc/iptables/rules.v4

This file contains static rules, not dynamic libvirt-generated ones.

A
/var/lib/libvirt/network/default.xml
Why wrong: This is the runtime state, but the source of truth is in /etc/libvirt/qemu/networks/.
B
/etc/sysconfig/network-scripts/ifcfg-virbr0
Why wrong: This file defines the bridge interface, not the NAT rules.
C
/etc/libvirt/qemu/networks/default.xml
The XML file defines the network and triggers the iptables rule generation.
D
/etc/iptables/rules.v4
Why wrong: This file contains static rules, not dynamic libvirt-generated ones.