Cloud, Associate (JNCIA-CLOUD) Free Sample Questions

Keystone is the identity service for OpenStack. It provides API client authentication, service discovery, and distributed multi-tenant authorization by implementing OpenStack's Identity API. All other OpenStack services use Keystone to validate user requests and locate other services, making it central to security and auditability. Nova is the compute service, Neutron is the networking service, and Cinder is the block storage service.

EVPN (Ethernet VPN) uses BGP as a control plane to distribute Layer 2 MAC address and Layer 3 IP reachability information, which is ideal for large-scale overlay networks. When used with a VXLAN data plane, it provides a highly scalable and standards-based solution that avoids the need for flood-and-learn mechanisms. VLANs with STP are not an overlay technology and have scaling limitations. VXLAN with multicast relies on flooding, which is less scalable than a BGP control plane. GENEVE is a flexible encapsulation but does not define its own control plane.

Worker nodes (or compute nodes) are where standard application workloads run. The specially provisioned nodes for the builds would be a subset of worker nodes, often with specific labels.

Infrastructure nodes are designated to run parts of the OpenShift platform stack, like the registry, router, and monitoring components. By moving these services to dedicated infrastructure nodes, and scheduling heavy build pods there as well (via taints and tolerations), you can effectively isolate them from the general application workloads running on standard worker nodes.

The statement describes a traditional networking architecture. The fundamental principle of SDN is the separation of the control plane from the data plane. In SDN, the control plane is centralized in an SDN controller, which makes intelligent forwarding decisions for the entire network. The networking devices (data plane) simply execute the forwarding instructions received from the controller.

A PersistentVolumeClaim (PVC) is a request for storage by a user. The developer's pod manifest will reference a PVC. The PVC, in turn, specifies requirements like size and access mode, and can name a StorageClass to dynamically provision a PersistentVolume (PV) that satisfies the claim. The PV is the actual storage resource, typically managed by the administrator, while the PVC is the developer's request for that resource.

Platform as a Service (PaaS) is the ideal model because it abstracts away the underlying infrastructure, including servers, operating systems, and patching. The cloud provider manages the platform, allowing the development team to focus exclusively on their application code and data. IaaS would still require them to manage the OS and scaling, while SaaS involves consuming a finished software product, not deploying their own code.

Single Root I/O Virtualization (SR-IOV) is a specification that allows a single physical PCIe device, like a NIC, to appear as multiple separate physical devices. It enables the VNF's virtual function (VF) to be directly mapped to the physical function (PF) of the NIC, bypassing the hypervisor's networking stack (like vSwitch). This direct hardware access dramatically reduces latency and increases throughput, which is critical for performance-sensitive VNFs. VXLAN offloading helps with encapsulation but doesn't solve the hypervisor bypass issue. OVS and Linux bridge are virtual switches that the VNF would be bypassing.

GENEVE (Generic Network Virtualization Encapsulation) was specifically designed to be more flexible and extensible than VXLAN. Its key feature is a variable-length header that can carry flexible metadata using Type-Length-Value (TLV) options. This allows different vendors and applications to insert custom information into the overlay packet without requiring a new encapsulation protocol, making it ideal for the architect's requirements.

Bridge mode is the default networking mode in Docker, creating a private network for containers. The --publish (or -p) flag is used for port mapping in the format HOST_PORT:CONTAINER_PORT. To map port 8080 on the host to port 80 in the container, the correct flag is --publish 8080:80. Host mode would share the host's network namespace, causing a port conflict with the existing service on port 80.

Within the resources section of a Heat template, the get_resource intrinsic function is used to reference another resource defined within the same template. For example, the properties of an OS::Nova::Server resource would use { get_resource: my_network_port } to associate itself with an OS::Neutron::Port resource named my_network_port. This creates an implicit dependency, ensuring the port is created before the server instance.