Vskills Certified OpenStack Professional — Questions and Answers

Question 1: In OpenStack Neutron, what is a 'port'?

A virtual network interface connection point on a network (Correct answer)
A TCP/UDP endpoint for API access
A VLAN tag assigned to a tenant network
A physical network interface on a compute node

Correct answer: A virtual network interface connection point on a network

A Neutron port is a virtual network interface connection point that can be attached to a VM or other network resource.

Question 2: What is the purpose of Nova's 'nova-conductor' service?

Coordinating storage attachment between Nova and Cinder
Providing a database access proxy to prevent compute nodes from directly accessing the Nova database (Correct answer)
Managing the lifecycle of Nova API workers
Conducting live performance monitoring of VM instances

Correct answer: Providing a database access proxy to prevent compute nodes from directly accessing the Nova database

nova-conductor acts as a database proxy layer, preventing compute nodes from having direct database access for improved security.

Question 3: What mechanism does OpenStack use to provide metadata to running instances?

A shared NFS mount at /etc/openstack
The nova-metadata API accessible at 169.254.169.254 (Correct answer)
Direct Keystone token passed via serial console
Environment variables injected at boot via cloud-init only

Correct answer: The nova-metadata API accessible at 169.254.169.254

The nova-metadata service exposes instance metadata at the link-local IP 169.254.169.254, mirroring the AWS EC2 metadata endpoint convention.

Question 4: What is OpenStack Swift used for?

Block storage for VM disks
Object storage for unstructured data like files and backups (Correct answer)
Ephemeral storage for running instances
File storage with NFS/CIFS protocols

Correct answer: Object storage for unstructured data like files and backups

Swift is OpenStack's Object Storage service for storing and retrieving unstructured data such as files, images, and backups.

Question 5: In Neutron, what is a 'router' used for?

Managing DNS resolution for tenant networks
Connecting two or more networks and providing gateway functionality (Correct answer)
Load balancing traffic between multiple VMs
Routing API requests between Neutron services

Correct answer: Connecting two or more networks and providing gateway functionality

A Neutron router connects multiple networks and provides gateway services, including NAT for floating IPs.

Question 6: What OpenStack command boots a new instance named 'web01' using a specific image and flavor?

openstack server create --image <id> --flavor <id> web01 (Correct answer)
nova create --image <id> --flavor <id> web01
openstack instance boot --image <id> --flavor <id> web01
nova boot --image <id> --flavor <id> web01

Correct answer: openstack server create --image <id> --flavor <id> web01

The modern OpenStack CLI uses 'openstack server create' with --image and --flavor flags to boot a new VM instance.

Question 7: In OpenStack Heat, what is a 'stack'?

A group of users in Keystone
A single VM instance
A network subnet
A collection of OpenStack resources created and managed as a single unit (Correct answer)

Correct answer: A collection of OpenStack resources created and managed as a single unit

A Heat stack is a set of OpenStack resources (VMs, networks, volumes, etc.) that are created, updated, and deleted together as one deployable unit.

Question 8: What is 'nova-placement' (Placement API) responsible for in OpenStack?

Managing geographic placement of data center regions
Tracking resource inventories and allocations across compute nodes for scheduling decisions (Correct answer)
Placing Glance images onto specific storage backends
Configuring VM placement groups for anti-affinity rules

Correct answer: Tracking resource inventories and allocations across compute nodes for scheduling decisions

The Placement API tracks resource inventories (CPU, RAM, disk, custom resources) and allocations to enable accurate Nova scheduling decisions.

Question 9: Which OpenStack service provides Identity, Authentication, and Authorization services?

Barbican
Glance
Keystone (Correct answer)
Nova

Correct answer: Keystone

Keystone is the OpenStack Identity service that provides authentication, authorization, and service catalog functionality.

Question 10: What does ML2 stand for in the context of Neutron's plugin architecture?

Modular Layer 2 (Correct answer)
Multi-Link 2
Multi-Layer 2
Managed Linux 2

Correct answer: Modular Layer 2

ML2 stands for Modular Layer 2, a framework that allows OpenStack Neutron to use multiple Layer 2 technologies simultaneously.

Question 11: What happens to an instance's ephemeral disk when a Nova instance is terminated?

It is permanently deleted along with the instance (Correct answer)
It is stored as a Glance image for future use
It is automatically converted to a Cinder volume
It is moved to a quarantine zone for 30 days

Correct answer: It is permanently deleted along with the instance

When a Nova instance is terminated, its ephemeral disk is permanently deleted as ephemeral storage is tied to instance lifecycle.

Question 12: What is a Nova 'availability zone' used for?

Grouping services by API version compatibility
Setting timezone configurations for VM instances
Defining network availability for specific compute nodes
Logically partitioning compute resources to allow tenants to select specific infrastructure zones (Correct answer)

Correct answer: Logically partitioning compute resources to allow tenants to select specific infrastructure zones

Nova availability zones allow users to specify which logical partition of compute resources to deploy instances into.

Question 13: Which OpenStack service provides Networking-as-a-Service (NaaS) and is the primary networking component?

Neutron (Correct answer)
Cinder
Nova
Swift

Correct answer: Neutron

Neutron is the OpenStack Networking service that provides Networking-as-a-Service capabilities.

Question 14: What is the 'admin' role typically granted to do in OpenStack?

Manage only network resources in Neutron
Only manage VMs within a single project
Read-only access to all OpenStack resources
Perform cloud-wide administrative operations across all projects and services (Correct answer)

Correct answer: Perform cloud-wide administrative operations across all projects and services

The 'admin' role in OpenStack grants cloud-wide administrative privileges to manage resources across all projects.

Question 15: Which Cinder feature allows a volume to be attached to multiple instances simultaneously (read/write)?

Volume migration
Multi-attach (Correct answer)
Volume replication
Volume transfer

Correct answer: Multi-attach

Cinder multi-attach allows a single volume to be attached to multiple VM instances at the same time for shared access.

Question 16: What is a Nova 'flavor' in OpenStack?

A network configuration template applied to new VMs
A set of cloud-init scripts run at instance boot
A pre-installed software configuration for a VM image
A hardware profile defining vCPUs, RAM, and disk size for VM instances (Correct answer)

Correct answer: A hardware profile defining vCPUs, RAM, and disk size for VM instances

A Nova flavor defines the virtual hardware profile (vCPUs, RAM, disk) of a VM instance, analogous to an EC2 instance type.

Question 17: What is a 'security group' in Neutron?

A VLAN reserved for secure management traffic
A set of firewall rules applied to VM network interfaces (Correct answer)
A group of admin users with elevated network permissions
A pool of IP addresses for floating IP allocation

Correct answer: A set of firewall rules applied to VM network interfaces

Security groups are sets of IP filter rules (firewall rules) that are applied to a VM's network interface.

Question 18: What is Nova's scheduler responsible for?

Selecting the most appropriate compute host for a new VM based on filters and weights (Correct answer)
Managing the timeline of VM lifecycle state changes
Scheduling periodic Cron jobs on compute nodes
Distributing API requests across multiple Nova API endpoints

Correct answer: Selecting the most appropriate compute host for a new VM based on filters and weights

The Nova scheduler selects the best compute host for a new instance using configurable filters and weighers.

Question 19: What is 'image caching' in the context of Nova and Glance?

Storing copies of Glance images locally on compute nodes to speed up instance boot (Correct answer)
Caching Glance API responses in memcached
Pre-loading frequently used images into GPU memory
Caching Horizon dashboard templates for faster page rendering

Correct answer: Storing copies of Glance images locally on compute nodes to speed up instance boot

Nova image caching stores Glance images locally on compute nodes so subsequent boots of the same image are faster.

Question 20: Which authentication backend does Keystone use by default for storing user credentials?

Kerberos
LDAP
Active Directory
SQL (local database) (Correct answer)

Correct answer: SQL (local database)

By default, Keystone stores user credentials in a SQL database (typically MySQL or MariaDB).

Question 21: What does 'OS_AUTH_URL' in an OpenStack RC file point to?

The Horizon dashboard URL
The Swift object storage endpoint
The Keystone Identity API endpoint for authentication (Correct answer)
The Nova compute API endpoint

Correct answer: The Keystone Identity API endpoint for authentication

OS_AUTH_URL specifies the Keystone Identity API endpoint that OpenStack CLI and SDKs use for authentication.

Question 22: What is Cinder 'volume type' used for?

Identifying volumes created by specific tenants
Defining storage characteristics (e.g., SSD, replicated, encrypted) for volume creation (Correct answer)
Specifying the OS format (ext4, xfs) of the volume
Setting the maximum IOPS for all volumes globally

Correct answer: Defining storage characteristics (e.g., SSD, replicated, encrypted) for volume creation

Cinder volume types define storage quality-of-service characteristics like performance tier, replication level, or encryption.

Question 23: Which Neutron agent is responsible for applying security group rules on compute nodes?

neutron-l3-agent
neutron-openvswitch-agent (Correct answer)
neutron-metadata-agent
neutron-dhcp-agent

Correct answer: neutron-openvswitch-agent

The neutron-openvswitch-agent (or linuxbridge-agent) runs on compute nodes and enforces security group rules via iptables or OVS flows.

Question 24: What is the role of the Neutron metadata agent?

It manages Neutron database metadata records
It provides IPAM services to subnets
It stores network topology metadata in Zookeeper
It relays instance metadata requests from VMs to the Nova metadata API (Correct answer)

Correct answer: It relays instance metadata requests from VMs to the Nova metadata API

The neutron-metadata-agent proxies requests from VMs to the Nova metadata API, enabling instances to retrieve their configuration data.

Question 25: What is a Neutron 'provider network' in OpenStack?

A network connected directly to the physical network infrastructure (Correct answer)
A virtual private network for inter-tenant traffic
A network managed entirely by tenants
A network only used for floating IPs

Correct answer: A network connected directly to the physical network infrastructure

A provider network in Neutron is directly mapped to an existing physical network in the data center.

Question 26: What is VXLAN in the context of OpenStack Neutron overlay networks?

A tunneling protocol that encapsulates L2 frames in UDP to extend networks over L3 (Correct answer)
A VLAN tagging extension for more than 4096 networks
A Neutron API extension for external network access
A storage network protocol used by Cinder

Correct answer: A tunneling protocol that encapsulates L2 frames in UDP to extend networks over L3

VXLAN (Virtual Extensible LAN) encapsulates Layer 2 Ethernet frames within UDP packets, enabling large-scale overlay networks.

Question 27: What does 'keystoneauth1' provide in the OpenStack client ecosystem?

A Python library providing authentication plugins and session management for OpenStack clients (Correct answer)
A Keystone middleware for validating tokens in API requests
An automated tool for rotating Fernet encryption keys
A CLI tool for managing Keystone users and policies

Correct answer: A Python library providing authentication plugins and session management for OpenStack clients

keystoneauth1 is the Python library used by OpenStack clients and SDKs to handle authentication and maintain sessions with Keystone.

Question 28: Which OpenStack CLI command lists all Neutron networks visible to your project?

openstack subnet list
openstack network list (Correct answer)
openstack server list
openstack router list

Correct answer: openstack network list

The 'openstack network list' command displays all networks accessible to the current project.

Question 29: Which Nova scheduler filter ensures that a VM is placed on a host with enough RAM?

RamFilter (Correct answer)
DiskFilter
CoreFilter
ComputeFilter

Correct answer: RamFilter

The RamFilter in the Nova scheduler eliminates compute hosts that do not have sufficient available RAM for the requested instance.

Question 30: What is the Keystone service catalog?

A database of registered cloud providers using OpenStack
An inventory of VM flavors and images available per region
A list of Keystone policies in YAML format
A list of all OpenStack services and their API endpoints published to authenticated users (Correct answer)

Correct answer: A list of all OpenStack services and their API endpoints published to authenticated users

The Keystone service catalog lists all available OpenStack services and their API endpoints, returned to clients upon authentication.

Question 31: What OpenStack CLI command is used to list all Keystone projects visible to your user?

openstack tenant list
keystone project-list
openstack project list (Correct answer)
openstack domain list

Correct answer: openstack project list

The 'openstack project list' command displays all projects the authenticated user can access.

Question 32: What is 'live migration' in Nova?

Migrating a running VM instance from one compute host to another without downtime (Correct answer)
Upgrading a VM's OS while it continues running
Moving a VM's persistent Cinder volume to a different storage backend
Changing a VM's flavor while the instance is active

Correct answer: Migrating a running VM instance from one compute host to another without downtime

Live migration in Nova moves a running VM from one compute host to another with minimal or zero downtime.

Question 33: What is a Keystone 'token' used for?

A credential issued after authentication that authorizes API requests to OpenStack services (Correct answer)
A license key for OpenStack commercial support
A network access control identifier for Neutron
Encrypting data stored in Swift containers

Correct answer: A credential issued after authentication that authorizes API requests to OpenStack services

A Keystone token is a credential that proves a user's identity and authorizes them to make API calls to OpenStack services.

Question 34: Which three parts of OpenStack are required for Nova to work?

Neutron, Horizon and Glance
Keystone, Glance and Neutron (Correct answer)
Cinder, Swift and Kolla
Glance, Keystone and Horizon

Correct answer: Keystone, Glance and Neutron

Explanation: <br> Nova gives enterprises a way to provision resources, such as VMs, bare-metal servers and containers. To perform its basic functions, Nova requires the Keystone, Glance and Neutron components.

Question 35: What is the purpose of the 'application credentials' feature in Keystone?

Generating OAuth tokens for mobile applications
Managing certificates for TLS service endpoints
Creating service accounts for OpenStack internal services
Providing API access for applications without embedding user passwords in config files (Correct answer)

Correct answer: Providing API access for applications without embedding user passwords in config files

Application credentials allow applications to authenticate to OpenStack using dedicated credentials without exposing user passwords.

Question 36: Which OpenStack service is used for DNS-as-a-Service?

Aodh
Panko
Barbican
Designate (Correct answer)

Correct answer: Designate

Designate is the OpenStack DNS service that manages DNS zones and records, integrating with backends like BIND and PowerDNS.

Question 37: What is a Nova 'host aggregate' used for?

Aggregating CPU capacity statistics across all compute nodes
Grouping compute nodes with specific hardware characteristics for targeted scheduling (Correct answer)
Aggregating network bandwidth across bonded NICs on compute hosts
Combining multiple physical servers into a single virtual compute node

Correct answer: Grouping compute nodes with specific hardware characteristics for targeted scheduling

Host aggregates group compute nodes by hardware properties (e.g., GPU, SSD) and use metadata to guide Nova scheduler placement.

Question 38: Which Heat resource type is used to create a Nova compute instance?

OS::Compute::Instance
OS::Nova::Instance
OS::Nova::Server (Correct answer)
OS::Heat::Server

Correct answer: OS::Nova::Server

OS::Nova::Server is the Heat resource type used to provision a Nova compute instance within a template.

Question 39: Which Keystone token format is the current default and does not require backend validation for each request?

PKI token
UUID token
SAML token
Fernet token (Correct answer)

Correct answer: Fernet token

Fernet tokens are the current default in OpenStack Keystone; they are lightweight, encrypted, and stateless (no persistence required).

Question 40: How does Horizon authenticate users when they log in to the dashboard?

It uses a local Django user database separate from OpenStack
It passes credentials to Keystone and receives a token to manage the session (Correct answer)
It uses Kerberos tickets from the corporate Active Directory
It validates credentials against the Nova compute API

Correct answer: It passes credentials to Keystone and receives a token to manage the session

Horizon authenticates users by submitting their credentials to Keystone and storing the returned token in the user's session.

Question 41: What is the purpose of Nova's 'resize' operation?

Expanding the root disk partition of a running VM
Reducing a Cinder volume attached to a VM
Changing a VM's flavor to one with different vCPU/RAM/disk specifications (Correct answer)
Modifying the network bandwidth allocation of an instance

Correct answer: Changing a VM's flavor to one with different vCPU/RAM/disk specifications

Nova resize allows changing a VM's flavor (compute resources like vCPUs and RAM) by migrating it to a host that can accommodate the new flavor.

Question 42: Which Neutron feature provides load balancing capabilities as a service?

VPNaaS
FWaaS
LBaaS (Octavia) (Correct answer)
QoS

Correct answer: LBaaS (Octavia)

LBaaS (Load Balancer as a Service), now implemented via Octavia, provides load balancing functionality within OpenStack.

Question 43: A cloud computing system uses the Internet rather than the computer's hard disk to store and manipulate data and programs.

File
Internet (Correct answer)
Browser
Website

Correct answer: Internet

Explanation: <br> A cloud computing system stores and manipulates data and programs over the internet rather than on the computer's hard drive.

Question 44: Which Neutron plug-in mechanism uses software-defined networking (SDN) with virtual switches?

SR-IOV driver
LinuxBridge ML2 driver
MACVLAN driver
Open vSwitch (OVS) ML2 driver (Correct answer)

Correct answer: Open vSwitch (OVS) ML2 driver

The Open vSwitch (OVS) ML2 driver is a widely used Neutron mechanism driver that leverages OVS for virtual switching.

Question 45: What does the Nova 'nova-compute' service run on?

Each individual compute (hypervisor) node (Correct answer)
The network node running Neutron agents
The storage node alongside Cinder services
The OpenStack controller node only

Correct answer: Each individual compute (hypervisor) node

nova-compute runs on every compute/hypervisor node and manages the local hypervisor to create and manage VMs.

Question 46: In OpenStack, what does 'live migration' allow an operator to do?

Move a volume between storage backends without downtime
Transfer a running VM from one compute host to another with minimal interruption (Correct answer)
Replicate a tenant network to a second region
Promote a snapshot to a base image without stopping the instance

Correct answer: Transfer a running VM from one compute host to another with minimal interruption

Live migration moves a running instance between compute hosts while it continues to serve traffic, useful for host maintenance.

Question 47: What does 'allowed address pairs' feature in Neutron enable?

Pairing two ports for redundant connectivity
Permitting additional MAC/IP addresses to pass traffic through a port beyond its assigned address (Correct answer)
Allowing dual-stack IPv4/IPv6 on a single port
Whitelisting specific tenant-to-tenant communication

Correct answer: Permitting additional MAC/IP addresses to pass traffic through a port beyond its assigned address

Allowed address pairs allow a port to send/receive traffic for additional IP/MAC addresses beyond its primary assignment.

Question 48: Which Neutron component acts as the L3 routing agent responsible for routing traffic between subnets?

neutron-l3-agent (Correct answer)
neutron-dhcp-agent
neutron-openvswitch-agent
neutron-metadata-agent

Correct answer: neutron-l3-agent

The neutron-l3-agent handles Layer 3 routing, including routing between subnets and managing floating IPs.

Question 49: What is the purpose of Swift's 'container' in the storage hierarchy?

A logical namespace for grouping objects, similar to a bucket in S3 (Correct answer)
A proxy server handling API requests
A storage node that holds a portion of the ring
A Docker container running Swift services

Correct answer: A logical namespace for grouping objects, similar to a bucket in S3

A Swift container is a namespace for storing objects, analogous to a bucket in Amazon S3 or a directory.

Question 50: What is 'NUMA topology' awareness in Nova compute scheduling?

Scheduling VM vCPUs and memory to align with physical NUMA nodes to improve performance (Correct answer)
Placing VMs in different network segments for topology optimization
Distributing Nova API requests across multiple controller nodes
Managing the order of VM boot sequences on a compute host

Correct answer: Scheduling VM vCPUs and memory to align with physical NUMA nodes to improve performance

NUMA-aware scheduling in Nova pins VM vCPUs and RAM to specific physical NUMA nodes to minimize cross-NUMA memory access latency.

Question 51: Which Glance API feature allows sharing an image with specific OpenStack projects?

Image members (Correct answer)
Image mirroring
Image tagging
Image export

Correct answer: Image members

Glance image members allow a private image owner to share the image with specific projects by adding them as image members.

Vskills Certified OpenStack Professional

The Vskills OpenStack certification validates knowledge of OpenStack cloud infrastructure services including Compute (Nova), Networking (Neutron), Identity (Keystone), Image (Glance), and Dashboard (Horizon). It is designed for cloud administrators and engineers managing private and public cloud environments.

Questions

60 min

Time Limit

50%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

openstack.org — Test delivery, score release, test dates, score validity, exam information · verified Oct 2026
training.mirantis.com — Eligibility · verified Oct 2026
object-storage-ca-ymq-1.vexxhost.net — Fees, renewal, retake fee, retake policy, time limit · verified Oct 2026