COA Identity, Image, and Compute Management 2 — Questions and Answers
Question 1: Which Keystone token format is the default in OpenStack since the Ocata release and stores token data locally on the server using symmetric encryption?
- UUID
- PKI
- Fernet (Correct answer)
- PKIZ
Correct answer: Fernet
Fernet tokens are the default since Ocata; they are compact, encrypted with a rotating key, and require no persistence in the database.
Question 2: An OpenStack administrator needs to allow a specific project to use GPU resources in a particular server group. Which Keystone construct should be used to grant this targeted access?
- Domain
- Role assignment on the project (Correct answer)
- Service endpoint
- Application credential
Correct answer: Role assignment on the project
Role assignments on a project grant users or groups specific permissions scoped to that project, allowing fine-grained access control.
Question 3: A developer wants their application to authenticate against Keystone without using the user's password. Which Keystone feature should they use?
- Federated identity
- Application credentials (Correct answer)
- Trust delegation
- EC2 credentials
Correct answer: Application credentials
Application credentials allow applications to authenticate as a specific user without storing the user's password, with optional role and expiry restrictions.
Question 4: When running 'openstack image create', which disk format should be specified for an image that will be used with KVM-based hypervisors and supports copy-on-write functionality?
- raw
- vmdk
- qcow2 (Correct answer)
- vhd
Correct answer: qcow2
qcow2 (QEMU Copy-On-Write v2) is the preferred format for KVM and supports snapshots, compression, and copy-on-write natively.
Question 5: What Glance image property must be set to 'bare' when the image file contains only the disk data with no container metadata?
- disk_format
- container_format (Correct answer)
- visibility
- image_type
Correct answer: container_format
The container_format property describes the file format of the container; 'bare' indicates no container or metadata envelope wraps the disk image.
Question 6: An administrator wants to share a private Glance image with a specific project without making it public. Which command achieves this?
- openstack image set --shared <image-id>
- openstack image add project <image-id> <project-id> (Correct answer)
- openstack image set --project <project-id> <image-id>
- openstack image grant <image-id> --project <project-id>
Correct answer: openstack image add project <image-id> <project-id>
'openstack image add project' creates a member relationship between a shared image and a specific project, allowing that project to use it.
Question 7: Which Glance image status indicates the image data has been uploaded successfully and the image is ready for use by Nova to boot instances?
- uploading
- queued
- active (Correct answer)
- saving
Correct answer: active
The 'active' status means Glance has fully received and stored the image data and the image is available for use.
COA Identity, Image, and Compute Management 2
Which Keystone token format is the default in OpenStack since the Ocata release and stores token data locally on the server using symmetric encryption?