COA Data Management & Integration 3 — Questions and Answers
Question 1: An administrator wants to encrypt a Cinder volume at rest. What must be configured first?
- A Barbican endpoint and a volume type with encryption metadata (Correct answer)
- A Swift container with server-side encryption enabled
- A Glance image with disk_format set to encrypted
- An IPSec tunnel between compute and storage nodes
Correct answer: A Barbican endpoint and a volume type with encryption metadata
Cinder volume encryption requires Barbican for key management and a volume type configured with the desired encryption provider and cipher.
Question 2: When migrating a Cinder volume from one backend to another using `cinder migrate`, which condition must be met?
- The volume must be attached to a running instance
- The volume must be in 'available' status (not attached) (Correct answer)
- The destination backend must have twice the volume's capacity free
- The volume must first be converted to a snapshot
Correct answer: The volume must be in 'available' status (not attached)
Cinder volume migration requires the volume to be in 'available' (detached) state so the data can be safely moved to the new backend.
Question 3: Which Swift mechanism enables automatic expiration and deletion of objects after a specified time?
- Setting X-Delete-At or X-Delete-After headers processed by the object expirer daemon (Correct answer)
- Using the tempurl middleware with an expiry parameter
- Configuring the bulk middleware with a TTL policy
- Enabling the staticweb middleware's auto-delete feature
Correct answer: Setting X-Delete-At or X-Delete-After headers processed by the object expirer daemon
Swift's object expirer daemon processes objects tagged with `X-Delete-At` (Unix timestamp) or `X-Delete-After` (seconds) headers, automatically deleting them at the specified time.
Question 4: In a Glance configuration using multiple stores, what does the `default_store` directive specify?
- The store used for image uploads when no store is explicitly requested (Correct answer)
- The read-only store for shared community images
- The store used exclusively for public images
- The backup store activated when the primary fails
Correct answer: The store used for image uploads when no store is explicitly requested
`default_store` in Glance's configuration specifies which backend (e.g., rbd, file, swift) is used when an image is uploaded without an explicit store designation.
Question 5: A developer needs to give a time-limited URL for a private Swift object without exposing credentials. Which feature should they use?
- X-Container-Read ACL
- TempURL (Correct answer)
- FormPOST
- SLO (Static Large Object)
Correct answer: TempURL
TempURL generates a time-limited, cryptographically signed URL that provides temporary access to a private Swift object without exposing account credentials.
Question 6: Which Cinder feature allows administrators to set guaranteed IOPS or throughput limits on volumes?
- Volume retype
- Quality of Service (QoS) specs (Correct answer)
- Volume multiattach
- Transfer request
Correct answer: Quality of Service (QoS) specs
Cinder Quality of Service (QoS) specs are associated with volume types to enforce IOPS, bandwidth, or burst limits on volumes.
Question 7: What is the function of a Manila 'share network' object?
- Defines the NFS/CIFS export path
- Associates a Neutron network and subnet with share access for network-aware backends (Correct answer)
- Sets the maximum size of shares in a project
- Controls which Manila backends are available to a tenant
Correct answer: Associates a Neutron network and subnet with share access for network-aware backends
A Manila share network links a Neutron network and subnet to Manila so that network-aware backends can provision shares accessible on that network.
COA Data Management & Integration 3
An administrator wants to encrypt a Cinder volume at rest.
What must be configured first?