Cheat sheet & self-check

Pick an answer to see if you got it, and why.

1. Q1. Which service is responsible for identity, tokens and the service catalog?

   1. ANova
   2. BKeystone
   3. CNeutron
   4. DGlance
   Show answer

   B. Every request starts with a Keystone token; clients find other services' endpoints in Keystone's catalog.

   From lesson 01 · OpenStack architecture

2. Q2. What do OpenStack services use RabbitMQ for?

   1. AStoring images
   2. BInternal RPC and notifications between components of a service (e.g. nova-api → nova-conductor → nova-compute)
   3. CUser logins
   4. DLoad balancing
   Show answer

   B. APIs talk to users over HTTP; components talk to each other over the message queue. A sick RabbitMQ makes the whole cloud sluggish or stuck.

   From lesson 01 · OpenStack architecture

3. Q3. Where do instances actually run?

   1. AOn controller nodes
   2. BOn compute nodes, via nova-compute driving a hypervisor (usually libvirt/KVM)
   3. CIn Keystone
   4. DIn RabbitMQ
   Show answer

   B. Controllers run APIs, schedulers, databases and queues; compute nodes run workloads.

   From lesson 01 · OpenStack architecture

4. Q4. In Keystone, what is a project?

   1. AA Git repository
   2. BThe unit of ownership and quota for resources (servers, networks, volumes); users get roles on projects
   3. CA physical host
   4. DA region
   Show answer

   B. Resources belong to projects. Role assignments on a project decide what users or groups can do with its resources.

   From lesson 02 · Keystone: identity & projects

5. Q5. Why use application credentials for CI instead of a user's password?

   1. AThey're faster
   2. BThey're scoped to one project and chosen roles, can expire, and can be revoked without changing the user's password
   3. CPasswords don't work in CI
   4. DThey bypass policy
   Show answer

   B. Least privilege and independent lifecycle: rotate or revoke automation access without affecting people.

   From lesson 02 · Keystone: identity & projects

6. Q6. What's in the service catalog?

   1. AUser passwords
   2. BThe list of services and their endpoints (public, internal, admin) per region
   3. CInstance images
   4. DBilling data
   Show answer

   B. Clients discover where Nova, Neutron and others live from the catalog returned with the token.

   From lesson 02 · Keystone: identity & projects

7. Q7. An instance fails with 'No valid host was found'. What does it usually mean?

   1. AThe image is corrupt
   2. BScheduling found no host meeting the request: not enough capacity in Placement, or filters (AZ, aggregates, extra specs) excluded every host
   3. CKeystone is down
   4. DThe network is missing
   Show answer

   B. Check the scheduler logs for which filter eliminated hosts, and Placement for available capacity.

   From lesson 03 · Nova: compute & scheduling

8. Q8. What does Placement track?

   1. AUser logins
   2. BResource providers (hosts, pools), their inventories (VCPU, MEMORY_MB, DISK_GB…), traits, and allocations by consumers
   3. CNetwork routes
   4. DImages
   Show answer

   B. The scheduler asks Placement for candidates with enough free resources, then applies filters and weighers.

   From lesson 03 · Nova: compute & scheduling

9. Q9. What's required for live migration without shared storage?

   1. ANothing
   2. BBlock live migration: copying the disk over the network during the move (slower), unless storage is shared (e.g. Ceph)
   3. CStopping the instance
   4. DA new flavor
   Show answer

   B. With Ceph-backed disks, only memory state moves. With local disks, the disk must be copied too.

   From lesson 03 · Nova: compute & scheduling

10. Q10. What's the difference between a provider network and a self-service network?

    1. ANone
    2. BProvider networks map directly to physical networks (VLAN/flat) set up by admins; self-service networks are tenant-created overlays (VXLAN/Geneve) connected via routers
    3. CProvider networks are faster only
    4. DSelf-service networks need no DHCP
    Show answer

    B. Provider networks attach VMs straight to the data-centre network; self-service networks give tenants private, isolated networks.

    From lesson 04 · Neutron: networking

11. Q11. How does an instance on a self-service network reach the internet by default?

    1. ADirectly
    2. BThrough its router's gateway on the external network, with SNAT; inbound access needs a floating IP (DNAT)
    3. CVia the compute node's public IP
    4. DIt can't
    Show answer

    B. Routers SNAT outbound traffic; floating IPs add a 1:1 NAT mapping for inbound.

    From lesson 04 · Neutron: networking

12. Q12. An instance boots but has no IP address. Where do you look first?

    1. ANova flavor
    2. BDHCP for its network (DHCP agent namespace, or OVN's native DHCP) and whether the port is ACTIVE/bound
    3. CGlance
    4. DKeystone
    Show answer

    B. Check the port status and binding, then the DHCP service for that network, and the security group (DHCP traffic must be allowed).

    From lesson 04 · Neutron: networking

13. Q13. With Ceph as the backend for both Glance and Nova/Cinder, why store images in raw format?

    1. ARaw is smaller
    2. BRBD can then clone instance disks from the image instantly with copy-on-write; qcow2 images must be converted on every boot
    3. Cqcow2 isn't supported
    4. DRaw images are encrypted
    Show answer

    B. Copy-on-write clones make boots near-instant and save space. qcow2 forces a full download and conversion.

    From lesson 05 · Storage: Glance, Cinder & Ceph

14. Q14. What's the difference between a Cinder snapshot and a Cinder backup?

    1. ANo difference
    2. BSnapshots live on the same backend (fast, same failure domain); backups are copied to a separate target (e.g. object storage or another Ceph cluster)
    3. CBackups are faster
    4. DSnapshots are encrypted
    Show answer

    B. Like in Kubernetes: snapshots for quick rollback, backups for surviving the loss of the storage system.

    From lesson 05 · Storage: Glance, Cinder & Ceph

15. Q15. What does 'boot from volume' change?

    1. ANothing
    2. BThe instance's root disk is a Cinder volume, which survives instance deletion (if configured) and can be moved, snapshotted and backed up like any volume
    3. CIt makes boots slower always
    4. DIt disables live migration
    Show answer

    B. Volume-backed instances decouple the disk's lifecycle from the instance, which is useful for stateful VMs.

    From lesson 05 · Storage: Glance, Cinder & Ceph

16. Q16. What is a Heat stack?

    1. AA list of images
    2. BA set of resources (servers, networks, volumes…) created and managed together from one template
    3. CA RabbitMQ queue
    4. DA Keystone domain
    Show answer

    B. Stacks are Heat's unit of lifecycle: create, update and delete as a whole.

    From lesson 06 · Orchestration

17. Q17. Why might a team choose Terraform over Heat for OpenStack?

    1. AHeat can't create servers
    2. BOne tool and workflow across OpenStack, public clouds, DNS, Kubernetes and more, with plans, modules and state
    3. CTerraform is built into OpenStack
    4. DHeat is removed
    Show answer

    B. Heat is native and needs no extra state, but Terraform covers multi-provider estates with a single, familiar workflow.

    From lesson 06 · Orchestration

18. Q18. A Heat stack is CREATE_FAILED. Where is the reason?

    1. ANowhere
    2. BIn openstack stack event list / stack show (resource status reasons), then the failing service's logs
    3. CIn Glance
    4. DIn Horizon only
    Show answer

    B. Stack events record each resource's status transitions and the error message from the underlying service.

    From lesson 06 · Orchestration

19. Q19. What does Kolla-Ansible deploy?

    1. AVirtual machines only
    2. BEach OpenStack service (and its dependencies like MariaDB, RabbitMQ, HAProxy) as containers on the hosts, configured by Ansible
    3. CA Kubernetes cluster
    4. DOnly Horizon
    Show answer

    B. Kolla builds the container images; Kolla-Ansible places, configures and runs them.

    From lesson 07 · Deploying with Kolla-Ansible

20. Q20. How should you change a setting in nova.conf in a Kolla-Ansible cloud?

    1. AEdit the file inside the running container
    2. BPut an override in /etc/kolla/config/nova.conf (or a per-service/host file) and run reconfigure
    3. CRebuild the images
    4. DEdit it on one host by hand
    Show answer

    B. Hand edits are overwritten on the next deploy. Overrides live in the config directory, in Git, and are applied consistently.

    From lesson 07 · Deploying with Kolla-Ansible

21. Q21. Before an OpenStack upgrade with Kolla-Ansible, what matters most?

    1. ANothing, it's automatic
    2. BRead the release notes, back up the databases, test the upgrade on a staging cloud, pre-pull images, and upgrade one release at a time as supported
    3. CDelete all instances
    4. DUpgrade compute nodes first by hand
    Show answer

    B. Upgrades run database migrations. A tested path and a database backup are what make rollback possible.

    From lesson 07 · Deploying with Kolla-Ansible

22. Q22. A user reports an API error. What's the fastest way to find the cause across services?

    1. ARestart everything
    2. BGet the request ID (req-…) from the error or API response, and search for it across service logs on the controllers and the relevant compute node
    3. CRead all logs from the start
    4. DAsk the user to retry
    Show answer

    B. Request IDs are logged by every service that handled the call, which threads the story together.

    From lesson 08 · Operations & troubleshooting

23. Q23. A volume is stuck in 'detaching'. What should you do before resetting its state?

    1. AReset immediately
    2. BCheck reality: is it still attached on the hypervisor (virsh domblklist), is the RBD/iSCSI connection still present, what do the cinder-volume and nova-compute logs say?
    3. CDelete the volume
    4. DReboot the controller
    Show answer

    B. Resetting the database state without fixing reality can leave a disk attached to two instances or orphaned, risking data corruption.

    From lesson 08 · Operations & troubleshooting

24. Q24. Many operations hang, and RabbitMQ queues are growing with no consumers. Likely cause?

    1. AA Glance bug
    2. BThe services that consume those queues are down or disconnected (or RabbitMQ is partitioned); fix the consumers/cluster, and the backlog drains
    3. CToo many flavors
    4. DKeystone tokens expired
    Show answer

    B. OpenStack services talk via RPC over RabbitMQ; stalled consumers or a partition stop work across the cloud.

    From lesson 08 · Operations & troubleshooting

25. Q25. What does the OpenStack cloud controller manager provide to a Kubernetes cluster?

    1. APod networking
    2. BIntegration with OpenStack: node addresses and lifecycle, and Services of type LoadBalancer backed by Octavia
    3. Cetcd backups
    4. DContainer images
    Show answer

    B. Like cloud controllers on AWS or GCP, it connects Kubernetes objects to the cloud's APIs. Storage comes separately via the Cinder CSI driver.

    From lesson 09 · OpenStack, Kubernetes & public cloud

26. Q26. Which is a good reason to run a workload on a private OpenStack cloud rather than public cloud?

    1. AIt's always cheaper
    2. BData locality/sovereignty, steady high utilisation at scale, special hardware or network needs (e.g. telecom), or regulatory constraints
    3. CIt needs no operations team
    4. DIt has more managed services
    Show answer

    B. Private clouds pay off with scale, steady load and special requirements, but carry real operating costs and fewer managed services.

    From lesson 09 · OpenStack, Kubernetes & public cloud

27. Q27. What is CAPO?

    1. AA Neutron plugin
    2. BThe Cluster API infrastructure provider for OpenStack, which creates Kubernetes clusters declaratively on OpenStack
    3. CA Ceph pool
    4. DA Horizon theme
    Show answer

    B. Cluster API manages clusters as Kubernetes resources; CAPO creates the OpenStack networks, servers and load balancers for them.

    From lesson 09 · OpenStack, Kubernetes & public cloud