JN0-214 Practice Questions

In OpenStack, network agents are responsible for managing networking tasks such as DHCP, routing,

and firewall rules. These agents run on specific nodes within the OpenStack environment. Let’s

analyze each option:

A . block storage

Incorrect: Block storage nodes host the Cinder service, which provides persistent storage volumes for

virtual machines. They do not run network agents.

B . controller

Incorrect: Controller nodes host core services like Keystone (identity), Horizon (dashboard), and

Glance (image service). While some networking services (e.g., Neutron server) may reside on the

controller node, the actual network agents typically do not run here.

C . object storage

Incorrect: Object storage nodes host the Swift service, which provides scalable object storage. They

are unrelated to running network agents.

D . compute

Correct: Compute nodes run the Nova compute service, which manages virtual machine instances.

Additionally, compute nodes host network agents (e.g., L3 agent, DHCP agent, and metadata agent)

to handle networking tasks for VMs running on the node.

Why Compute Nodes?

Proximity to VMs: Network agents run on compute nodes to ensure efficient communication with

VMs hosted on the same node.

Decentralized Architecture: By distributing network agents across compute nodes, OpenStack

achieves scalability and fault tolerance.

JNCIA Cloud Reference:

The JNCIA-Cloud certification covers OpenStack architecture, including the roles of compute nodes

and network agents. Understanding where network agents run is essential for managing OpenStack

networking effectively.

For example, Juniper Contrail integrates with OpenStack Neutron to provide advanced networking

features, leveraging network agents on compute nodes for traffic management.

Reference:

OpenStack Neutron Documentation: Network Agents

Juniper JNCIA-Cloud Study Guide: OpenStack Networking

Docker is a popular containerization platform that includes several components to manage the

lifecycle of containers. Let’s analyze each option:

A . dockerd

Correct: The Docker daemon (dockerd) is the core component responsible for building, running, and

distributing Docker containers. It manages Docker objects such as images, containers, networks, and

volumes, and handles requests from the Docker CLI or API.

B . docker registry

Incorrect: A Docker registry is a repository for storing and distributing Docker images. While it plays a

role in distributing containers, it does not build or run them.

C . docker cli

Incorrect: The Docker CLI (Command Line Interface) is a tool used to interact with the Docker

daemon (dockerd). It is not responsible for building, running, or distributing containers but rather

sends commands to the daemon.

D . container

Incorrect: A container is an instance of a running application created from a Docker image. It is not a

component of Docker but rather the result of the Docker daemon's operations.

Why dockerd?

Central Role: The Docker daemon (dockerd) is the backbone of the Docker platform, managing all

aspects of container lifecycle management.

Integration: It interacts with the host operating system and container runtime to execute tasks like

building images, starting containers, and managing resources.

JNCIA Cloud Reference:

The JNCIA-Cloud certification covers Docker as part of its containerization curriculum. Understanding

the role of the Docker daemon is essential for managing containerized applications in cloud

environments.

For example, Juniper Contrail integrates with Docker to provide advanced networking and security

features for containerized workloads, relying on the Docker daemon to manage containers.

Reference:

Docker Documentation: Docker Daemon

Juniper JNCIA-Cloud Study Guide: Containerization

OpenShift extends Kubernetes by introducing additional resources and abstractions to simplify

application development and deployment. Let’s analyze each option:

A . routes

Correct:

Routes are unique to OpenShift and provide a way to expose services externally by mapping a

hostname to a service. They are built on top of Kubernetes Ingress but offer additional features like

TLS termination and wildcard support.

B . build

Correct:

Builds are unique to OpenShift and represent the process of transforming source code into container

images. OpenShift provides build configurations and strategies (e.g., Docker, S2I) to automate this

process, which is not natively available in Kubernetes.

C . ingress

Incorrect:

Ingress is a standard Kubernetes resource used to manage external access to services. While

OpenShift uses Ingress as the foundation for its Routes, Ingress itself is not unique to OpenShift.

D . services

Incorrect:

Services are a core Kubernetes resource used to expose applications internally within the cluster.

They are not unique to OpenShift.

Why These Resources?

Routes: Extend Kubernetes Ingress to provide advanced external access capabilities, such as custom

domain mappings and TLS termination.

Builds: Simplify the process of building container images directly within the OpenShift platform,

enabling streamlined CI/CD workflows.

JNCIA Cloud Reference:

The JNCIA-Cloud certification covers OpenShift's unique resources as part of its curriculum on

container orchestration platforms. Understanding the differences between OpenShift and

Kubernetes resources is essential for leveraging OpenShift's full capabilities.

For example, Juniper Contrail integrates with OpenShift to provide advanced networking features,

ensuring secure and efficient traffic routing for Routes and Builds.

Reference:

OpenShift Documentation: Routes and Builds

Juniper JNCIA-Cloud Study Guide: OpenShift vs. Kubernetes

OpenShift is a Kubernetes-based container platform that supports both containerized and virtualized

workloads. Let’s analyze each option:

A . ESXi

Incorrect: ESXi is VMware’s hypervisor for running virtual machines. While it is widely used in

traditional virtualization environments, it is not integrated into OpenShift.

B . OpenStack

Incorrect: OpenStack is an open-source cloud computing platform used for managing infrastructure

resources (e.g., compute, storage, networking). It is unrelated to running VMs in an OpenShift

cluster.

C . Hyper-V

Incorrect: Hyper-V is Microsoft’s hypervisor for running virtual machines. Like ESXi, it is not

integrated into OpenShift.

D . KubeVirt

Correct: KubeVirt is the technology used to run virtual machines in an OpenShift cluster. It extends

Kubernetes to support VM workloads alongside containers, enabling hybrid workload management.

Why KubeVirt?

Integration with OpenShift: KubeVirt is specifically designed to run VMs in Kubernetes-based

environments like OpenShift.

Hybrid Workload Support: It allows organizations to manage both containers and VMs using the

same Kubernetes APIs and tools.

JNCIA Cloud Reference:

The JNCIA-Cloud certification covers OpenShift and its integration with Kubernetes extensions like

KubeVirt. Understanding how to run VMs in OpenShift is essential for managing hybrid workloads in

cloud-native environments.

For example, Juniper Contrail integrates with OpenShift and KubeVirt to provide networking and

security for hybrid workloads.

Reference:

KubeVirt Documentation

OpenShift Documentation: Virtualization

Juniper JNCIA-Cloud Study Guide: OpenShift and Kubernetes

Linux provides several mechanisms for isolating resources and ensuring security. Let’s analyze each

option:

A . ring protection

Incorrect: Ring protection refers to CPU privilege levels (e.g., Rings 0–3) that control access to system

resources. While important for security, it does not provide kernel-level isolation of global resources.

B . stack protector

Incorrect: Stack protector is a compiler feature that helps prevent buffer overflow attacks by adding

guard variables to function stacks. It is unrelated to resource isolation.

C . namespaces

Correct: Namespaces are a Linux kernel feature that provides kernel-level isolation of global

resources such as process IDs, network interfaces, mount points, and user IDs. Each namespace has

its own isolated view of these resources, enabling features like containerization.

D . shared libraries

Incorrect: Shared libraries allow multiple processes to use the same code, reducing memory usage.

They do not provide isolation or security.

Why Namespaces?

Resource Isolation: Namespaces isolate processes, networks, and other resources, ensuring that

changes in one namespace do not affect others.

Containerization Foundation: Namespaces are a core technology behind containerization platforms

like Docker and Kubernetes, enabling lightweight and secure environments.

JNCIA Cloud Reference:

The JNCIA-Cloud certification covers Linux fundamentals, including namespaces, as part of its

containerization curriculum. Understanding namespaces is essential for managing containerized

workloads in cloud environments.

For example, Juniper Contrail leverages namespaces to isolate network resources in containerized

environments, ensuring secure and efficient operation.

Reference:

Linux Kernel Documentation: Namespaces

Juniper JNCIA-Cloud Study Guide: Linux Features

Software-Defined Networking (SDN) is a revolutionary approach to network management that

separates the control plane from the data (forwarding) plane. Let’s analyze each option:

A . It must manage networks through the use of containers and repositories.

Incorrect: While containers and repositories are important in cloud-native environments, they are

not a requirement for SDN. SDN focuses on programmability and centralized control, not

containerization.

B . It manages networks by separating the data forwarding plane from the control plane.

Correct: SDN separates the control plane (decision-making) from the data forwarding plane (packet

forwarding). This separation enables centralized control, programmability, and dynamic network

management.

C . It applies security policies individually to each separate node.

Incorrect: SDN applies security policies centrally through the SDN controller, not individually to each

node. Centralized policy enforcement is one of the key advantages of SDN.

D . It manages networks by merging the data forwarding plane with the control plane.

Incorrect: Merging the forwarding and control planes contradicts the fundamental principle of SDN.

The separation of these planes is what enables SDN’s flexibility and programmability.

Why This Answer?

Separation of Planes: By decoupling the control plane from the forwarding plane, SDN enables

centralized control over network devices. This architecture simplifies network management,

improves scalability, and supports automation.

JNCIA Cloud Reference:

The JNCIA-Cloud certification covers SDN as a core concept in cloud networking. Understanding the

separation of the control and forwarding planes is essential for designing and managing modern

cloud environments.

For example, Juniper Contrail serves as an SDN controller, centralizing control over network devices

and enabling advanced features like network automation and segmentation.

Reference:

Open Networking Foundation (ONF) SDN Architecture

Juniper JNCIA-Cloud Study Guide: Software-Defined Networking

The UI shown in the exhibit is the OpenStack Horizon dashboard. Horizon is the web-based user

interface (UI) for OpenStack, providing administrators and users with a graphical interface to interact

with the cloud environment. Through Horizon, users can manage resources like instances, networks,

and storage, which is evident in the displayed metrics (Instances, VCPUs, RAM) for the project.

Cloud service models define how services are delivered and managed in a cloud environment. The

three primary models are:

Infrastructure as a Service (IaaS): Provides virtualized computing resources such as servers, storage,

networking, and virtualization over the internet. Customers manage their own operating systems,

applications, and data, while the cloud provider manages the underlying infrastructure.

Platform as a Service (PaaS): Provides a platform for developers to build, deploy, and manage

applications without worrying about the underlying infrastructure. Examples include Google App

Engine and Microsoft Azure App Services.

Software as a Service (SaaS): Delivers fully functional applications over the internet, eliminating the

need for users to install or maintain software locally. Examples include Salesforce CRM, Google

Workspace, and Microsoft Office 365.

Database as a Service (DaaS): A specialized subset of PaaS that provides managed database services.

In this question, the focus is on access to networking, storage, servers, and virtualization , which are

the core components of IaaS . IaaS allows customers to rent infrastructure on-demand and build their

own environments without investing in physical hardware.

Why IaaS?

Flexibility: Customers have full control over the operating systems, applications, and configurations.

Scalability: Resources can be scaled up or down based on demand.

Cost Efficiency: Pay-as-you-go pricing eliminates upfront hardware costs.

JNCIA Cloud Reference:

The JNCIA-Cloud certification emphasizes understanding the different cloud service models and their

use cases. IaaS is particularly relevant for organizations that want to leverage cloud infrastructure

while maintaining control over their applications and data.

For example, Juniper Contrail integrates with IaaS platforms like OpenStack to provide advanced

networking and security features for virtualized environments.

Reference:

NIST Cloud Computing Reference Architecture

Juniper JNCIA-Cloud Study Guide: Cloud Service Models

Containers are a lightweight form of virtualization that enable the deployment of applications in

isolated environments. Let’s analyze each statement:

A . Containers contain executables, libraries, configuration files, and an operating system.

Incorrect: Containers do not include a full operating system. Instead, they share the host system's

kernel and only include the application and its dependencies (e.g., libraries, binaries, and

configuration files).

B . Containers package the entire runtime environment of an application, including its dependencies.

Correct: Containers bundle the application code, runtime, libraries, and configuration files into a

single package. This ensures consistency across different environments and eliminates issues caused

by differences in dependencies.

C . Containers can only run on a system with a Type 2 hypervisor.

Incorrect: Containers do not require a hypervisor. They run directly on the host operating system and

share the kernel. Hypervisors (Type 1 or Type 2) are used for virtual machines, not containers.

D . Containers share the use of the underlying system’s kernel.

Correct: Containers leverage the host operating system's kernel, which allows them to be lightweight

and efficient. Each container has its own isolated user space but shares the kernel with other

containers.

Why These Statements?

Runtime Environment Packaging: Containers ensure portability and consistency by packaging

everything an application needs to run.

Kernel Sharing: By sharing the host kernel, containers consume fewer resources compared to virtual

machines, which require separate operating systems.

JNCIA Cloud Reference:

The JNCIA-Cloud certification emphasizes understanding containerization technologies, including

Docker and Kubernetes. Containers are a fundamental component of modern cloud-native

architectures.

For example, Juniper Contrail integrates with Kubernetes to manage containerized workloads,

leveraging the lightweight and portable nature of containers.

Reference:

Docker Documentation: Container Basics

Juniper JNCIA-Cloud Study Guide: Containerization

OpenStack is an open-source cloud computing platform that provides various services for managing

compute, storage, and networking resources. To provision a bare-metal server in OpenStack, the

Ironic service is required. Let’s analyze each option:

A . Ironic

Correct: OpenStack Ironic is a bare-metal provisioning service that allows you to manage and

provision physical servers as if they were virtual machines. It automates tasks such as hardware

discovery, configuration, and deployment of operating systems on bare-metal servers.

B . Zun

Incorrect: OpenStack Zun is a container service that manages the lifecycle of containers. It is

unrelated to bare-metal provisioning.

C . Trove

Incorrect: OpenStack Trove is a Database as a Service (DBaaS) solution that provides managed

database instances. It does not handle bare-metal provisioning.

D . Magnum

Incorrect: OpenStack Magnum is a container orchestration service that supports Kubernetes, Docker

Swarm, and other container orchestration engines. It is focused on containerized workloads, not

bare-metal servers.

Why Ironic?

Purpose-Built for Bare-Metal: Ironic is specifically designed to provision and manage bare-metal

servers, making it the correct choice for this requirement.

Automation: Ironic automates the entire bare-metal provisioning process, including hardware

discovery, configuration, and OS deployment.

JNCIA Cloud Reference:

The JNCIA-Cloud certification covers OpenStack as part of its cloud infrastructure curriculum.

Understanding OpenStack services like Ironic is essential for managing bare-metal and virtualized

environments in cloud deployments.

For example, Juniper Contrail integrates with OpenStack to provide networking and security for both

virtualized and bare-metal workloads. Proficiency with OpenStack services ensures efficient

management of diverse cloud resources.

Reference:

OpenStack Documentation: Ironic Bare-Metal Provisioning

Juniper JNCIA-Cloud Study Guide: OpenStack Services