COA Networking and Storage Configuration 2 — Questions and Answers
Question 1: Which Neutron agent is responsible for implementing security groups on compute nodes using iptables?
- neutron-dhcp-agent
- neutron-l3-agent
- neutron-openvswitch-agent (Correct answer)
- neutron-metadata-agent
Correct answer: neutron-openvswitch-agent
The neutron-openvswitch-agent (or linuxbridge-agent) runs on compute nodes and enforces security group rules via iptables.
Question 2: What is the purpose of a Neutron floating IP?
- Assign a fixed internal IP to an instance
- Map a public IP to an instance's private IP via NAT (Correct answer)
- Enable IPv6 dual-stack on a router
- Reserve a DHCP lease permanently
Correct answer: Map a public IP to an instance's private IP via NAT
Floating IPs use NAT on the L3 agent to map an externally routable address to an instance's fixed private IP.
Question 3: In Cinder, which command creates a volume from an existing bootable volume snapshot?
- cinder create --snapshot-id <id> (Correct answer)
- cinder snapshot-create --volume <id>
- cinder extend --snapshot <id>
- cinder upload-to-image --snapshot <id>
Correct answer: cinder create --snapshot-id <id>
cinder create --snapshot-id <id> provisions a new volume pre-populated with the snapshot's data.
Question 4: Which OpenStack networking object defines allowed IP/MAC pairs on a port to prevent spoofing?
- Security group rule
- Port binding
- Allowed address pair (Correct answer)
- Router interface
Correct answer: Allowed address pair
Allowed address pairs let administrators declare additional IP/MAC combinations permitted on a port beyond the primary assignment.
Question 5: What Swift container ACL grants any authenticated user read access?
- .r:*
- .rlistings
- *:* (Correct answer)
- .r:*,.rlistings
Correct answer: *:*
The ACL value *:* grants read access to any authenticated OpenStack user across all projects.
Question 6: Which Neutron resource must be created before attaching a router to an external network?
- Subnet with gateway_ip set
- External network with router:external=True (Correct answer)
- Floating IP pool
- DHCP port on the external network
Correct answer: External network with router:external=True
The network must be marked with router:external=True so the L3 agent recognizes it as an uplink for external connectivity.
Question 7: Which Cinder volume status indicates that a volume is attached to an instance and in active use?
- available
- in-use (Correct answer)
- reserved
- attaching
Correct answer: in-use
The 'in-use' status means the volume is currently attached to a running instance.
COA Networking and Storage Configuration 2
Which Neutron agent is responsible for implementing security groups on compute nodes using iptables?