Virtualization and Cloud Concepts
This domain tests the boundary between the machine and what runs on it: hypervisors versus container runtimes, image versus instance, and the cloud primitives that replace racking hardware. CTLA questions tend to be conceptual traps - "the container lost its data", "the instance is unreachable" - rather than deep vendor detail.
Virtualization models
Type 1 hypervisors run on bare metal (KVM, ESXi); Type 2 run on a host OS (VirtualBox). On Linux, KVM provides hardware acceleration, QEMU does device emulation, and libvirt manages both: virsh list --all, virsh define, virsh start, virt-install. Disks are usually qcow2 (thin, snapshot-capable). Performance comes from paravirtualized drivers and host bridging, not from raw emulation.
Containers
Containers share the host kernel and isolate with namespaces (PID, mount, network, user) while cgroups bound resource use. That makes them lighter than VMs but not a security boundary equivalent to one. An image is an immutable layered artifact; a container is a running instance of it; anything written inside is lost on removal unless stored in a volume or bind mount. Podman runs rootless without a daemon.
Cloud primitives
IaaS gives you instances; PaaS manages the runtime; SaaS is the finished application. An image (AMI or equivalent) plus an instance type plus a key pair plus network policy yields a running instance. Security groups are stateful (return traffic is automatically allowed); network ACLs are stateless and must permit both directions. Block storage is attached and formatted; object storage is addressed by API, not mounted by default. The instance metadata service at 169.254.169.254 supplies credentials and user data; modern environments require a session token (IMDSv2) and can disable the older unauthenticated path. cloud-init applies first-boot configuration such as users and SSH keys. IaC tools are declarative: you describe the end state and let the tool converge.
Worked example
A freshly launched instance responds to ping but SSH times out, and the key pair is confirmed correct.
Reasoning: ICMP succeeding shows the route and instance are alive, so this is policy, not the OS. Check the security group for an inbound rule on TCP 22 from your source; because groups are stateful, no outbound rule is needed for the reply. Then confirm the instance has a public address and that the subnet route table points to the internet gateway. Only after that is it worth reading /var/log/secure - a timeout (rather than a refusal or auth prompt) points at packet filtering, not sshd.
Traps
- Assuming container writes persist without a volume.
- Treating security groups and network ACLs as equivalent.
- Taking a VM snapshot and calling it an application backup - memory and disk are captured, but in-flight writes may be inconsistent.
- Forgetting that disabling IMDSv1 breaks older agents.
- Confusing an image with an instance.