Vskills Certified OpenStack Professional — Questions and Answers

Question 1: What is a 'security group' in Neutron?

A pool of IP addresses for floating IP allocation
A VLAN reserved for secure management traffic
A group of admin users with elevated network permissions
A set of firewall rules applied to VM network interfaces (Correct answer)

Correct answer: A set of firewall rules applied to VM network interfaces

Security groups are sets of IP filter rules (firewall rules) that are applied to a VM's network interface.

Question 2: What is the purpose of Nova's 'resize' operation?

Modifying the network bandwidth allocation of an instance
Expanding the root disk partition of a running VM
Changing a VM's flavor to one with different vCPU/RAM/disk specifications (Correct answer)
Reducing a Cinder volume attached to a VM

Correct answer: Changing a VM's flavor to one with different vCPU/RAM/disk specifications

Nova resize allows changing a VM's flavor (compute resources like vCPUs and RAM) by migrating it to a host that can accommodate the new flavor.

Question 3: Which OpenStack service provides shared filesystem storage (NFS/CIFS) as a service?

Cinder
Glance
Swift
Manila (Correct answer)

Correct answer: Manila

Manila is the OpenStack Shared File System service that provides shared filesystems over NFS, CIFS, and other protocols.

Question 4: Which Neutron plug-in mechanism uses software-defined networking (SDN) with virtual switches?

LinuxBridge ML2 driver
SR-IOV driver
MACVLAN driver
Open vSwitch (OVS) ML2 driver (Correct answer)

Correct answer: Open vSwitch (OVS) ML2 driver

The Open vSwitch (OVS) ML2 driver is a widely used Neutron mechanism driver that leverages OVS for virtual switching.

Question 5: In OpenStack Neutron, what is the role of a 'router'?

Applies security group rules
Connects tenant networks to external networks and routes traffic between subnets (Correct answer)
Manages floating IP allocation pools
Provides DHCP to instances

Correct answer: Connects tenant networks to external networks and routes traffic between subnets

A Neutron router connects internal tenant subnets to each other and to external networks for internet access.

Question 6: In Swift, what does the term 'consistency' refer to?

All objects require a quorum write before acknowledging success
Object checksums are verified on every read operation
All reads return the latest written data immediately (strong consistency)
Swift uses eventual consistency where replicas sync asynchronously (Correct answer)

Correct answer: Swift uses eventual consistency where replicas sync asynchronously

Swift uses an eventual consistency model where object replicas may temporarily be out of sync but converge over time.

Question 7: What format does Glance support for storing image metadata?

Only YAML property files
JSON objects stored separately in Swift
Key-value properties stored in the Glance database alongside image records (Correct answer)
XML configuration files in the image filesystem

Correct answer: Key-value properties stored in the Glance database alongside image records

Glance stores image metadata as key-value properties in the database, including architecture, OS type, and minimum disk requirements.

Question 8: Which OpenStack service provides container cluster management (Kubernetes, Docker Swarm)?

Magnum (Correct answer)
Zun
Ironic
Kolla

Correct answer: Magnum

Magnum provisions and manages container orchestration engines like Kubernetes and Docker Swarm as first-class resources.

Question 9: What is a Keystone 'role' used for?

Creating a service endpoint for a new OpenStack component
Defining the geographic region where a service is deployed
Granting permissions to users by assigning named roles within a project (Correct answer)
Setting resource quotas for a specific project

Correct answer: Granting permissions to users by assigning named roles within a project

Keystone roles are named identifiers (e.g., 'admin', 'member') assigned to users within projects to define their permissions.

Question 10: What is a Keystone 'domain' used for in multi-tenant deployments?

A geographic region hosting OpenStack services
A network domain managed by Neutron
A DNS domain for service endpoint resolution
A high-level administrative boundary for grouping projects and users (Correct answer)

Correct answer: A high-level administrative boundary for grouping projects and users

Keystone domains provide a high-level administrative boundary to isolate users and projects, enabling multi-organization deployments.

Question 11: In OpenStack, what is an 'endpoint' registered in Keystone?

A URL representing a specific OpenStack service API in a specific region and interface type (Correct answer)
A VM instance accessible via floating IP
A Neutron port connected to an external network
A physical network interface on a compute node

Correct answer: A URL representing a specific OpenStack service API in a specific region and interface type

A Keystone endpoint is a URL entry in the service catalog for a specific service, region, and interface (public/internal/admin).

Question 12: What is a Nova 'host aggregate' used for?

Grouping compute nodes with specific hardware characteristics for targeted scheduling (Correct answer)
Aggregating network bandwidth across bonded NICs on compute hosts
Combining multiple physical servers into a single virtual compute node
Aggregating CPU capacity statistics across all compute nodes

Correct answer: Grouping compute nodes with specific hardware characteristics for targeted scheduling

Host aggregates group compute nodes by hardware properties (e.g., GPU, SSD) and use metadata to guide Nova scheduler placement.

Question 13: Which three parts of OpenStack are required for Nova to work?

Glance, Keystone and Horizon
Neutron, Horizon and Glance
Cinder, Swift and Kolla
Keystone, Glance and Neutron (Correct answer)

Correct answer: Keystone, Glance and Neutron

Explanation: <br> Nova gives enterprises a way to provision resources, such as VMs, bare-metal servers and containers. To perform its basic functions, Nova requires the Keystone, Glance and Neutron components.

Question 14: What is the purpose of 'scoped tokens' in Keystone v3?

Tokens that are only valid for API calls to a specific service like Nova
Tokens encrypted with a project-specific key
Tokens bound to a specific project or domain, limiting their authorization scope (Correct answer)
Tokens with a shorter expiration time for security

Correct answer: Tokens bound to a specific project or domain, limiting their authorization scope

Scoped tokens in Keystone v3 are bound to a specific project or domain, limiting the authorization context of the token.

Question 15: What is a Neutron 'provider network' in OpenStack?

A virtual private network for inter-tenant traffic
A network connected directly to the physical network infrastructure (Correct answer)
A network managed entirely by tenants
A network only used for floating IPs

Correct answer: A network connected directly to the physical network infrastructure

A provider network in Neutron is directly mapped to an existing physical network in the data center.

Question 16: What is the purpose of a 'floating IP' in OpenStack Neutron?

An IP that migrates with a VM during live migration
A secondary IP assigned to a VM's secondary NIC
An IP reserved for the router gateway interface
A publicly routable IP that can be dynamically associated with a VM (Correct answer)

Correct answer: A publicly routable IP that can be dynamically associated with a VM

A floating IP is a publicly routable IP address that can be dynamically associated with or disassociated from a VM instance.

Question 17: Which authentication backend does Keystone use by default for storing user credentials?

LDAP
Kerberos
SQL (local database) (Correct answer)
Active Directory

Correct answer: SQL (local database)

By default, Keystone stores user credentials in a SQL database (typically MySQL or MariaDB).

Question 18: What is the role of the Neutron metadata agent?

It manages Neutron database metadata records
It stores network topology metadata in Zookeeper
It relays instance metadata requests from VMs to the Nova metadata API (Correct answer)
It provides IPAM services to subnets

Correct answer: It relays instance metadata requests from VMs to the Nova metadata API

The neutron-metadata-agent proxies requests from VMs to the Nova metadata API, enabling instances to retrieve their configuration data.

Question 19: In OpenStack Heat, what file format is used to define infrastructure stacks?

XML
TOML
JSON only
YAML or JSON (HOT format) (Correct answer)

Correct answer: YAML or JSON (HOT format)

Heat Orchestration Templates (HOT) support both YAML and JSON formats to describe infrastructure as code.

Question 20: Which Neutron network type creates an isolated virtual network using encapsulation like VXLAN?

Overlay network (Correct answer)
Flat network
External network
VLAN network

Correct answer: Overlay network

Overlay networks (e.g., VXLAN, GRE) encapsulate tenant traffic to allow isolated multi-tenant networking.

Question 21: What OpenStack command boots a new instance named 'web01' using a specific image and flavor?

nova create --image <id> --flavor <id> web01
nova boot --image <id> --flavor <id> web01
openstack instance boot --image <id> --flavor <id> web01
openstack server create --image <id> --flavor <id> web01 (Correct answer)

Correct answer: openstack server create --image <id> --flavor <id> web01

The modern OpenStack CLI uses 'openstack server create' with --image and --flavor flags to boot a new VM instance.

Question 22: What happens to an instance's ephemeral disk when a Nova instance is terminated?

It is stored as a Glance image for future use
It is moved to a quarantine zone for 30 days
It is automatically converted to a Cinder volume
It is permanently deleted along with the instance (Correct answer)

Correct answer: It is permanently deleted along with the instance

When a Nova instance is terminated, its ephemeral disk is permanently deleted as ephemeral storage is tied to instance lifecycle.

Question 23: What does 'allowed address pairs' feature in Neutron enable?

Whitelisting specific tenant-to-tenant communication
Pairing two ports for redundant connectivity
Permitting additional MAC/IP addresses to pass traffic through a port beyond its assigned address (Correct answer)
Allowing dual-stack IPv4/IPv6 on a single port

Correct answer: Permitting additional MAC/IP addresses to pass traffic through a port beyond its assigned address

Allowed address pairs allow a port to send/receive traffic for additional IP/MAC addresses beyond its primary assignment.

Question 24: What is a Nova 'availability zone' used for?

Defining network availability for specific compute nodes
Grouping services by API version compatibility
Logically partitioning compute resources to allow tenants to select specific infrastructure zones (Correct answer)
Setting timezone configurations for VM instances

Correct answer: Logically partitioning compute resources to allow tenants to select specific infrastructure zones

Nova availability zones allow users to specify which logical partition of compute resources to deploy instances into.

Question 25: What is the purpose of Nova's 'nova-conductor' service?

Conducting live performance monitoring of VM instances
Coordinating storage attachment between Nova and Cinder
Managing the lifecycle of Nova API workers
Providing a database access proxy to prevent compute nodes from directly accessing the Nova database (Correct answer)

Correct answer: Providing a database access proxy to prevent compute nodes from directly accessing the Nova database

nova-conductor acts as a database proxy layer, preventing compute nodes from having direct database access for improved security.

Question 26: What does ML2 stand for in the context of Neutron's plugin architecture?

Managed Linux 2
Multi-Layer 2
Multi-Link 2
Modular Layer 2 (Correct answer)

Correct answer: Modular Layer 2

ML2 stands for Modular Layer 2, a framework that allows OpenStack Neutron to use multiple Layer 2 technologies simultaneously.

Question 27: Which Nova scheduler filter ensures that a VM is placed on a host with enough RAM?

CoreFilter
RamFilter (Correct answer)
ComputeFilter
DiskFilter

Correct answer: RamFilter

The RamFilter in the Nova scheduler eliminates compute hosts that do not have sufficient available RAM for the requested instance.

Question 28: What is the Keystone service catalog?

A database of registered cloud providers using OpenStack
A list of all OpenStack services and their API endpoints published to authenticated users (Correct answer)
An inventory of VM flavors and images available per region
A list of Keystone policies in YAML format

Correct answer: A list of all OpenStack services and their API endpoints published to authenticated users

The Keystone service catalog lists all available OpenStack services and their API endpoints, returned to clients upon authentication.

Question 29: In OpenStack Neutron, what is a 'port'?

A TCP/UDP endpoint for API access
A physical network interface on a compute node
A virtual network interface connection point on a network (Correct answer)
A VLAN tag assigned to a tenant network

Correct answer: A virtual network interface connection point on a network

A Neutron port is a virtual network interface connection point that can be attached to a VM or other network resource.

Question 30: In Neutron, what is a 'router' used for?

Load balancing traffic between multiple VMs
Managing DNS resolution for tenant networks
Connecting two or more networks and providing gateway functionality (Correct answer)
Routing API requests between Neutron services

Correct answer: Connecting two or more networks and providing gateway functionality

A Neutron router connects multiple networks and provides gateway services, including NAT for floating IPs.

Question 31: Which Keystone token format is the current default and does not require backend validation for each request?

PKI token
UUID token
SAML token
Fernet token (Correct answer)

Correct answer: Fernet token

Fernet tokens are the current default in OpenStack Keystone; they are lightweight, encrypted, and stateless (no persistence required).

Question 32: What hypervisor does Nova use by default in most production deployments?

VMware ESXi
Microsoft Hyper-V
KVM (Kernel-based Virtual Machine) (Correct answer)
Xen

Correct answer: KVM (Kernel-based Virtual Machine)

KVM is the most widely deployed hypervisor for OpenStack Nova in production environments due to its performance and Linux integration.

Question 33: Which Neutron feature provides load balancing capabilities as a service?

LBaaS (Octavia) (Correct answer)
VPNaaS
FWaaS
QoS

Correct answer: LBaaS (Octavia)

LBaaS (Load Balancer as a Service), now implemented via Octavia, provides load balancing functionality within OpenStack.

Question 34: What is 'live migration' in Nova?

Migrating a running VM instance from one compute host to another without downtime (Correct answer)
Moving a VM's persistent Cinder volume to a different storage backend
Changing a VM's flavor while the instance is active
Upgrading a VM's OS while it continues running

Correct answer: Migrating a running VM instance from one compute host to another without downtime

Live migration in Nova moves a running VM from one compute host to another with minimal or zero downtime.

Question 35: In OpenStack's RBAC model, what does a 'role assignment' bind together?

A tenant network and a security group
A user, a role, and a project/domain scope (Correct answer)
A policy rule and an API endpoint
A service account and a Keystone token

Correct answer: A user, a role, and a project/domain scope

A role assignment in Keystone links a user (or group) to a role within the scope of a specific project or domain.

Question 36: What constitutes the foundational element of OpenStack orchestration?

Keystone
Ironic
Heat (Correct answer)
Manila

Correct answer: Heat

Explanation: <br> Heat acts as an orchestration engine that deploys cloud resources and applications through templates.

Question 37: What is the role of 'oslo.messaging' in OpenStack?

Manages Keystone token messaging queues only
Provides email notification for alerts
Handles HTTP REST API routing
Provides an RPC and messaging abstraction layer used across OpenStack services (Correct answer)

Correct answer: Provides an RPC and messaging abstraction layer used across OpenStack services

oslo.messaging is a shared library providing a common RPC and notification messaging API over backends like RabbitMQ or Kafka.

Question 38: What is a Keystone 'token' used for?

A credential issued after authentication that authorizes API requests to OpenStack services (Correct answer)
Encrypting data stored in Swift containers
A license key for OpenStack commercial support
A network access control identifier for Neutron

Correct answer: A credential issued after authentication that authorizes API requests to OpenStack services

A Keystone token is a credential that proves a user's identity and authorizes them to make API calls to OpenStack services.

Question 39: What does 'keystoneauth1' provide in the OpenStack client ecosystem?

A CLI tool for managing Keystone users and policies
An automated tool for rotating Fernet encryption keys
A Python library providing authentication plugins and session management for OpenStack clients (Correct answer)
A Keystone middleware for validating tokens in API requests

Correct answer: A Python library providing authentication plugins and session management for OpenStack clients

keystoneauth1 is the Python library used by OpenStack clients and SDKs to handle authentication and maintain sessions with Keystone.

Question 40: What is Nova's scheduler responsible for?

Managing the timeline of VM lifecycle state changes
Scheduling periodic Cron jobs on compute nodes
Selecting the most appropriate compute host for a new VM based on filters and weights (Correct answer)
Distributing API requests across multiple Nova API endpoints

Correct answer: Selecting the most appropriate compute host for a new VM based on filters and weights

The Nova scheduler selects the best compute host for a new instance using configurable filters and weighers.

Question 41: Which OpenStack service is responsible for providing block storage to virtual machines?

Swift
Cinder (Correct answer)
Neutron
Glance

Correct answer: Cinder

Cinder provides persistent block storage volumes that can be attached to Nova compute instances.

Question 42: Which OpenStack Heat component is responsible for executing template resource operations?

heat-engine (Correct answer)
heat-scheduler
heat-api
heat-conductor

Correct answer: heat-engine

heat-engine is the core service that processes templates, manages resource lifecycles, and orchestrates calls to other OpenStack services.

Question 43: Which OpenStack service provides Identity, Authentication, and Authorization services?

Nova
Keystone (Correct answer)
Barbican
Glance

Correct answer: Keystone

Keystone is the OpenStack Identity service that provides authentication, authorization, and service catalog functionality.

Question 44: Which Neutron agent handles DHCP requests for VMs on tenant networks?

neutron-l3-agent
neutron-metadata-agent
neutron-linuxbridge-agent
neutron-dhcp-agent (Correct answer)

Correct answer: neutron-dhcp-agent

The neutron-dhcp-agent provides DHCP services for tenant networks by managing dnsmasq processes.

Question 45: What is a Nova 'flavor' in OpenStack?

A hardware profile defining vCPUs, RAM, and disk size for VM instances (Correct answer)
A set of cloud-init scripts run at instance boot
A network configuration template applied to new VMs
A pre-installed software configuration for a VM image

Correct answer: A hardware profile defining vCPUs, RAM, and disk size for VM instances

A Nova flavor defines the virtual hardware profile (vCPUs, RAM, disk) of a VM instance, analogous to an EC2 instance type.

Question 46: In Neutron, what is a 'subnet' defined as?

A firewall zone separating tenant traffic
A block of IP addresses and associated configuration assigned to a network (Correct answer)
A virtual router connecting two networks
A physical NIC bond in the hypervisor

Correct answer: A block of IP addresses and associated configuration assigned to a network

A subnet in Neutron is a block of IP addresses (CIDR) with configuration like gateway and DNS assigned to a network.

Question 47: Which network type in Neutron uses 802.1Q VLAN tagging to isolate tenant networks?

vlan (Correct answer)
gre
vxlan
flat

Correct answer: vlan

The 'vlan' network type uses 802.1Q VLAN tags to provide network isolation between tenants.

Question 48: What is the Swift 'ring' responsible for?

Managing replication between Swift regions
Routing HTTP requests to the correct proxy server
Determining the placement of objects, containers, and accounts across storage nodes (Correct answer)
Authenticating API requests to the object store

Correct answer: Determining the placement of objects, containers, and accounts across storage nodes

The Swift ring is a data structure that maps partition names to physical storage devices/nodes for data placement.

Question 49: What does the Nova metadata service at 169.254.169.254 provide to instances?

Instance metadata like hostname, public keys, and user-data scripts (Correct answer)
Real-time CPU and memory performance metrics
OpenStack API credentials for the running instance
Network routing tables for the instance's subnets

Correct answer: Instance metadata like hostname, public keys, and user-data scripts

The Nova metadata service provides instance-specific data like SSH keys, user-data, and instance attributes accessible from within the VM.

Question 50: What is 'instance shelving' in OpenStack Nova?

Moving a VM to a spare compute host during maintenance
Creating a snapshot of a running instance before patching
Stopping a VM and freeing its compute resources while preserving its configuration for later restoration (Correct answer)
Permanently archiving a VM's disk image to Swift for long-term storage

Correct answer: Stopping a VM and freeing its compute resources while preserving its configuration for later restoration

Shelving a Nova instance stops it, snapshots its disk to Glance, and frees the compute resources while preserving the instance record.

Question 51: Which configuration file controls Nova's scheduler behavior, including filters and weights?

/etc/nova/scheduler.conf
/etc/nova/policy.yaml
/etc/nova/api.conf
/etc/nova/nova.conf (Correct answer)

Correct answer: /etc/nova/nova.conf

nova.conf contains all Nova service configuration including scheduler_driver, enabled_filters, and weight settings under [filter_scheduler].

Vskills Certified OpenStack Professional

The Vskills OpenStack certification validates knowledge of OpenStack cloud infrastructure services including Compute (Nova), Networking (Neutron), Identity (Keystone), Image (Glance), and Dashboard (Horizon). It is designed for cloud administrators and engineers managing private and public cloud environments.

Questions

60 min

Time Limit

50%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds