305-300 Sample Questions & Answers

The correct way to apply a custom seccomp profile to a Docker container is by using the --security-opt flag. The syntax is seccomp= . This instructs the container runtime to load the specified profile and restrict the container's allowed system calls to only those defined in the file. The other options use incorrect flags (--seccomp-profile, --apparmor) or incorrect syntax for the security option.

The xl save command is used to stop a domain and save its current state, including its entire memory content, to a file on disk. The domain is terminated on the hypervisor after the save is complete. This state can then be restored later using xl restore. xl snapshot is for disk snapshots, xl suspend pauses the domain but keeps its state in the host's memory, and xl migrate moves a running domain to another host.

A NAT-forwarded network is the standard libvirt configuration that meets these requirements. It creates a virtual bridge, runs a DHCP server to assign IPs to VMs on a private subnet, and uses iptables rules on the host to perform Network Address Translation (NAT) for outbound traffic. This isolates the VMs while providing them with internet access. A bridged network would place them on the same L2 network as the host, an isolated network would prevent internet access, and a routed network requires additional static routes on the external network.

The most effective way to handle builder-specific provisioning is to use a single provisioner block with different environment_vars for each builder, controlled by only or except clauses. However, since the variables are different, a cleaner approach is to use two distinct provisioner blocks. One block would have only = ["amazon-ebs"] and set AWS_REGION, while the other would have only = ["qemu"] and set BUILD_TYPE. This provides clear separation and ensures the correct environment variables are passed to the script depending on which builder is active.

Docker Compose is the ideal tool for this scenario, as it allows defining a multi-container application in a single YAML file (Req 1). By default, Compose creates a custom bridge network for the application, allowing all services to communicate via their service names (e.g., rabbitmq) without exposing ports (Req 2). The ports mapping for the frontend service satisfies Req 3. Defining a named volume at the top level and mounting it into the RabbitMQ service provides persistent storage (Req 4). Kubernetes is a more complex solution than required, and the manual script approach lacks the declarative and portable nature of Compose.

The guestfish command with the -i option automatically inspects the disk image, finds the operating system, and mounts the filesystems in their correct locations (e.g., /dev/sda1 on /). The --rw flag is crucial to open the disk image in read-write mode. The upload command then copies the local file to the specified destination within the mounted guest filesystem. This is the most efficient and reliable method, as it avoids manual inspection and mounting of partitions.

By default, Docker utilizes several namespaces for isolation. PID provides an independent process tree where the container's main process is PID 1. NET provides an isolated network stack with its own interfaces and routing table. MNT provides an isolated view of the filesystem hierarchy. The USER namespace is not used by default; enabling it (for rootless containers) is a specific configuration choice. Cgroup is a mechanism for resource limiting, not a namespace for isolation in the same way.

Libvirt's network filtering capabilities are managed through the nwfilter-* family of commands. To apply a MAC spoofing prevention rule, you would first define a filter using an XML file with virsh nwfilter-define . The XML would contain rules, often using the built-in clean-traffic chain, to ensure that outgoing packets have the same MAC address as the VM's interface. After defining the filter, you would then edit the domain's configuration (virsh edit) to apply this filter to the specific interface. The other commands relate to DHCP reservations or interface attachment, not L2 security filtering.

The standard key in a cloud-init #cloud-config file for defining a list of software packages to be installed is packages:. cloud-init will then use the appropriate package manager for the underlying distribution (e.g., apt on Debian/Ubuntu, yum/dnf on RHEL/CentOS) to install the listed packages. The users: key is used for user creation, and ssh_authorized_keys: is used for adding public keys.

LXD applies profiles in the order they are listed for the container. If the same key exists in multiple profiles, the value from the right-most (last applied) profile in the list will override the values from earlier profiles. Any locally defined configuration on the container itself will override all profile values.