Explanation
The ENTRYPOINT instruction in a Dockerfile specifies the default command to run when a container is started from the image. The ENTRYPOINT instruction can be written in two forms: exec form and shell form.
The exec form uses a JSON array to specify the command and its arguments, such as [ “executable”,
“param1”, “param2” ]. The shell form uses a single string to specify the command and its arguments, such as
“executable param1 param2”. The shell form is converted to the exec form by adding /bin/sh -c to the beginning of the command. Therefore, the following statements in a Dockerfile are equivalent and will lead to a container that outputs hello world:
ENTRYPOINT [ “echo hello world” ] ENTRYPOINT [ “/bin/sh”, “-c”, “echo hello world” ] ENTRYPOINT
“echo hello world” ENTRYPOINT [ “echo”, “hello”, “world” ] ENTRYPOINT [ “/bin/sh”, “-c”, “echo”,
“hello”, “world” ] ENTRYPOINT “echo hello world”
The other statements in the question are invalid or incorrect. The statement A. ENTRYPOINT “echo Hello World” is invalid because it uses double quotes to enclose the entire command, which is not allowed in the shell form. The statement D. ENTRYPOINT echo Hello World is incorrect because it does not use quotes to enclose the command, which is required in the shell form. The statement E. ENTRYPOINT “echo”, “Hello”,
“World” is invalid because it uses double quotes to separate the command and its arguments, which is not allowed in the exec form. References:
* Dockerfile reference | Docker Docs
* Using the Dockerfile ENTRYPOINT and CMD Instructions – ATA Learning
* Difference Between run, cmd and entrypoint in a Dockerfile

Cloud management tools are primarily designed tooptimize and control cloud-based resourcesin virtualized and containerized environments. According to virtualization and containerization documentation, one of the most significant benefits of these tools isefficient resource allocation. Cloud management platforms enable administrators to dynamically assign compute, storage, and network resources based on workload demand, ensuring optimal utilization of infrastructure.
These tools continuously monitor resource consumption across virtual machines and containers, helping prevent underutilization and resource contention. By leveraging centralized dashboards, policy-based management, and automation, cloud management tools ensure that workloads receive appropriate resources while minimizing waste. This capability is especially critical in private, public, and hybrid cloud environments where scalability and cost control are essential.
While features such as automated scaling, billing integration, and security enhancements may be supported by specific cloud platforms, they aresecondary capabilitiesrather than the core function. Encryption, for example, is typically handled by underlying security services rather than cloud management tools themselves.
Similarly, billing and invoicing are more closely associated with cloud service provider platforms.
Virtualization notes consistently emphasize thatefficient resource allocationis the foundational benefit that enables performance optimization, cost efficiency, and scalability in cloud-managed environments.

The WORKDIR instruction sets the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY and ADD instructions that follow it in the Dockerfile1. The RUN instruction executes commands in a new layer on top of the current image and commits the results2. The RUN cd command does not change the working directory for the next RUN instruction, because each RUN command runs in a new shell and a new environment3. Therefore, the file test is created in the root directory (/) of the container image, not in the /tmp directory. References:
* Dockerfile reference: WORKDIR
* Dockerfile reference: RUN
* difference between RUN cd and WORKDIR in Dockerfile

Explanation
In an IaaS cloud, the most common method for provisioning new computing instances is to use an image file that contains a pre-installed operating system and software. This image file is also known as a machine image, a virtual appliance, or a template. The image file can be customized for a specific purpose, such as a web server, a database server, or a development environment. The image file can be stored in a repository or a library that is accessible by the cloud provider or the user. When a new instance is requested, the cloud provider copies the image file to a virtual disk and attaches it to the instance. The instance then boots from the virtual disk and runs the operating system and software from the image file. This method is faster and more efficient than installing the operating system and software from scratch for each new instance. It also ensures consistency and reliability across multiple instances that use the same image file. References:
* LPI Virtualization and Containerization Exam Objectives, Topic 305.1: Virtualization Concepts and Theory, Objective: Describe the concept of machine images and templates
* LPI Virtualization and Containerization Study Guide, Chapter 1: Virtualization Concepts and Theory, Section: Machine Images and Templates
* LPI LPIC-3 305 Certification Sample Questions and Practice Exam, Question 10: In an IaaS cloud, what is a common method for provisioning new computing instances with an operating system and software?

Explanation
Container-based virtualization is a method of operating system-level virtualization that allows multiple isolated user spaces (containers) to run on the same host system1. Each container shares the same operating system kernel as the host, but has its own file system, libraries, and processes2. Therefore, the statements A and C are false, as containers do not run their own kernels or rely on hardware support from the CPU. The statement E is also false, as Linux does support container-based virtualization through various technologies, such as cgroups, namespaces, LXC, Docker, etc12. The statement B is true, as different containers may use different distributions of the same operating system, such as Debian, Ubuntu, Fedora, etc., as long as they are compatible with the host kernel3. The statement D is also true, as all containers run within the operating system kernel of the host system, which provides isolation and resource management for them12. References:
* 1: Containerization (computing) – Wikipedia.
* 2: What are containers? | Google Cloud.
* 3: What is Container-Based Virtualization? – StackHowTo.

unshare
Explanation
The unshare command is used to run a process in a new Linux namespace12. It takes one or more flags to specify which namespaces to create or unshare from the parent process1. For example, to run a shell in a new mount, network, and PID namespace, one can use:
unshare -mnp /bin/bash
References:
* 1: unshare(1) – Linux manual page – man7.org
* 2: A gentle introduction to namespaces in Linux – Packagecloud

Explanation
Libvirt is a toolkit that provides a common API for managing different virtualization technologies, such as KVM, Xen, LXC, and others. Libvirt allows users to configure and control various aspects of a virtual machine (also called a domain), such as its CPU, memory, disk, network, and other resources. Among the resources that can be limited by libvirt for a KVM domain are:
* Amount of CPU time: Libvirt allows users to specify the number of virtual CPUs (vCPUs) that a domain can use, as well as the CPU mode, model, topology, and tuning parameters. Users can also set the CPU shares, quota, and period to control the relative or absolute amount of CPU time that a domain can consume. Additionally, users can pin vCPUs to physical CPUs or NUMA nodes to improve performance and isolation. These settings can be configured in the domain XML file under the <cpu> and <cputune> elements12.
* Size of available memory: Libvirt allows users to specify the amount of memory that a domain can use, as well as the memory backing, tuning, and NUMA node parameters. Users can also set the memory hard and soft limits, swap hard limit, and minimum guarantee to control the memory allocation and reclaim policies for a domain. These settings can be configured in the domain XML file under the <memory>, <memoryBacking>, and <memtune> elements13.
The other resources listed in the question are not directly limited by libvirt for a KVM domain. File systems allowed in the domain are determined by the disk and filesystem devices that are attached to the domain, which can be configured in the domain XML file under the <disk> and <filesystem> elements14. Number of running processes and number of available files are determined by the operating system and the file system of the domain, which are not controlled by libvirt.
References:
* libvirt: Domain XML format
* CPU Allocation
* Memory Allocation
* Hard drives, floppy disks, CDROMs

Full virtualization is a virtualization approach where the hypervisor provides a complete simulation of the underlying hardware, allowingunmodified guest operating systemsto run without awareness of virtualization. Virtualization documentation consistently states that one of the defining characteristics of full virtualization is thatguest operating systems do not need to be modified, making optionCcorrect.
Additionally, modern full virtualization platforms benefit fromhardware-assisted virtualization, such as Intel VT-x and AMD-V CPU extensions. These extensions significantly improve performance by offloading virtualization tasks to the processor, making optionBcorrect.
Option A is incorrect because Linux-based hypervisors like KVM can perform full virtualization entirely within the Linux ecosystem. Option D is false because all virtualization introduces some performance overhead, even if minimal. Option E is incorrect because full virtualization is widely used in production environments, including enterprise data centers and cloud platforms.
Therefore, based on virtualization principles and documentation, the correct answers areB and C.

change-media
Explanation:
In libvirt-based virtualization environments, thevirsh change-mediasubcommand is used to change the media attached to removable devices such asCD-ROM drives. According to libvirt documentation, this command allows administrators to insert or eject ISO images from a running virtual machine without shutting it down.
This functionality is commonly used during operating system installations or software updates. The change- media command supports both live and persistent changes depending on the options used.
Therefore, the correct and documented answer ischange-media.

Vagrant supports multipleproviders, allowing it to work with different virtualization and container platforms.
According to official Vagrant documentation, supported providers includeVirtualBox,VMware, andDocker.
VirtualBox is the default and most commonly used provider. VMware is supported through official plugins.
Docker is also supported as a provider, enabling lightweight container-based development environments.
Option D (“Haws”) is an apparent typographical error and does not correspond to a valid virtualization platform. While Vagrant can integrate with AWS via community or third-party plugins, the option as written is invalid.
Therefore, the correct answers areA, B, and C.

Explanation
IaaS is a type of cloud computing service that offers essential compute, storage, and networking resources on demand, on a pay-as-you-go basis. IaaS is one of the four types of cloud services, along with software as a service (SaaS), platform as a service (PaaS), and serverless12. IaaS eliminates the need for enterprises to procure, configure, or manage infrastructure themselves, and they only pay for what they use23. Some examples of IaaS providers are Microsoft Azure, Google Cloud, and Amazon Web Services.

KVM User Networking (SLIRP) provides basic network connectivity without requiring root privileges or bridge configuration. According to QEMU/KVM documentation, one key limitation is thatICMP (ping) is not supported.
User Networking allows outbound TCP/UDP connections but restricts inbound connections and ICMP traffic.
Therefore,Cis the correct answer.

Explanation
Capabilities are a way of implementing fine-grained access control in Linux. They are a set of flags that define the privileges that a process can have. By default, a process inherits the capabilities of its parent, but some capabilities can be dropped or added by the process itself or by the kernel. In the context of container virtualization, capabilities are used to prevent processes from performing actions that might infringe the container, such as accessing the host’s devices, mounting filesystems, changing the system time, or killing other processes. Capabilities allow containers to run with a reduced set of privileges, enhancing the security and isolation of the container environment. For example, Docker uses a default set of capabilities that are granted to the processes running inside a container, and allows users to add or drop capabilities as needed12.
References:
* Capabilities | Docker Documentation1
* Linux Capabilities: Making Them Work in Containers2

Explanation
The command lxc-attach is used to execute a command in a running LXC container. It allows the user to start a process inside the container and attach to its standard input, output, and error streams1. For example, the command lxc-attach -n mycontainer — ls -lh /home will list all the files and directories in the /home directory of the container named mycontainer1. The other options are not valid LXC commands. The command lxc-batch does not exist. The command lxc-run is an alias for lxc-start, which is used to start a container, not to execute a command in it2. The command lxc-enter is also an alias for lxc-attach, but it is deprecated and should not be used3. The command lxc-eval is also not a valid LXC command. References:
* 1: Executing a command inside a running LXC – Unix & Linux Stack Exchange.
* 2: lxc-start: start a container. – SysTutorials.
* 3: lxc-attach: start a process inside a running container. – SysTutorials.

Docker stack is a command that allows users to deploy and manage a stack of services on a Docker Swarm cluster. A stack is a group of interrelated services that share dependencies and can be orchestrated and scaled together. A stack is typically defined by a Compose file, which is a YAML file that describes the services, networks, volumes, and other resources of the stack. To use docker stack to run a Compose file on a Swarm, the user must first create and initialize a Swarm cluster, which is a group of machines (nodes) that are running the Docker Engine and are joined into a single entity. The Swarm cluster has one or more managers, which are responsible for maintaining the cluster state and orchestrating the services, and one or more workers, which are the nodes that run the services.
When the user runs docker stack deploy with a Compose file, the command parses the file and creates the services as specified. However, docker stack does not build or upload the images referenced in the Compose file to any registry. Instead, it instructs the Swarm nodes to pull the images from a registry, which can be the public Docker Hub or a private registry. The user must ensure that the images are available in the registry before deploying the stack, otherwise the deployment will fail. The user can use docker build and docker push commands to create and upload the images to the registry, or use an automated build service such as Docker Hub or GitHub Actions. The user must also make sure that the image names and tags in the Compose file match the ones in the registry, and that the Swarm nodes have access to the registry if it is private. By pulling the images from a registry, docker stack ensures that the Swarm nodes have the same and latest version of the images, and that the images are distributed across the cluster in an efficient way.
The other options are not correct. Docker stack does not build the images locally or on the Swarm nodes, nor does it copy or transfer the images to the Swarm nodes. Docker stack also does not pass the images to the Swarm master, as this would create a bottleneck and a single point of failure. Docker stack relies on the registry as the source of truth for the images, and delegates the image pulling to the Swarm nodes. References:
* Deploy a stack to a swarm | Docker Docs1
* docker stack deploy | Docker Docs2
* docker build | Docker Docs3
* docker push | Docker Docs4