What is the purpose of the Kubernetes Container Runtime Interface (CRI)?

To provide a plugin interface that allows Kubernetes to use different container runtimes.

To provide a CLI for managing containers.

To define the format of container images.

To enforce security policies on containers.

What is the purpose of the OCI Runtime Specification?

To define the security policies for containers.

To define a standard for how container runtimes should create and run containers.

To define the API for container orchestration.

To define the format of container images.

A security team is hardening a container that runs a web server. The container needs to bind to port 443, read files from a mounted volume, and write logs to stdout. The team wants to minimize the attack surface. Which combination of security measures should be applied?

Grant all capabilities and use a permissive AppArmor profile

Run the container with `--privileged` and disable seccomp

Grant CAP_NET_BIND_SERVICE, use a seccomp profile that allows only necessary syscalls, and apply an AppArmor profile that restricts file access

Use only SELinux with a permissive policy

A developer is explaining how Docker achieves isolation to a new team member. Which combination of kernel features does Docker use to provide container isolation and resource limiting?

cgroups for isolation, capabilities for resource limiting, and namespaces for privilege reduction

SELinux for isolation, AppArmor for resource limiting, and namespaces for privilege reduction

Namespaces for isolation, cgroups for resource limiting, and capabilities for privilege reduction

Namespaces for resource limiting, cgroups for isolation, and seccomp for privilege reduction

LPIC-3 Virtualization and Containerization

Domain 2Objective 1

352.1 Container Virtualization Concepts (weight: 7) LPIC-3-VIRTUALIZATION Practice Questions (Page 5)

Part of the Topic 352: Container Virtualization domain, which makes up ~32% of our current practice bank. Linux Professional Institute does not publish an official question count, but from its 90-minute exam (~35–60 total, ~11–19 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

16concepts

Questions 21–25

21foundation · easy
Which tool can be used to decode and display the capabilities of a binary file?
Select an answer first
22foundation · easy
What is the purpose of the Kubernetes Container Runtime Interface (CRI)?
Select an answer first
23foundation · easy
What is the purpose of the OCI Runtime Specification?
Select an answer first
24expert · hard
A security team is hardening a container that runs a web server. The container needs to bind to port 443, read files from a mounted volume, and write logs to stdout. The team wants to minimize the attack surface. Which combination of security measures should be applied?
Select an answer first
25application · medium
A developer is explaining how Docker achieves isolation to a new team member. Which combination of kernel features does Docker use to provide container isolation and resource limiting?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to LPIC-3-VIRTUALIZATION

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Linux Professional Institute. “LPIC-3-VIRTUALIZATION” is a trademark of its owner, used for identification only.