Domain → A top-level container that is globally unique in Keystone

Role → Permission set

Endpoint → External access address of a single service

Group → User set

These matches are consistent with official OpenStack Keystone identity concepts. OpenStack documentation defines a group as a collection of users , so “user set” is the correct description for Group . It also explains that a role is used in Keystone’s RBAC model to represent a set of permissions that can be assigned to users or groups, so Role → Permission set is correct.

For Endpoint , OpenStack service configuration documentation describes endpoints as the network-accessible API addresses used to access a service, which matches external access address of a single service .

For Domain , Keystone identity documentation explains that domains are top-level containers used to organize projects, users, and groups. In practice, a domain is a globally unique administrative boundary in Keystone, which matches the description a top-level container that is globally unique in Keystone .

So the final verified mapping is: Domain → top-level container , Role → permission set , Endpoint → service access address , and Group → user set .

The correct fill-in answer is hosts. Huawei documentation explicitly states that memory overcommitment must be enabled on the node where the VM is deployed before the VM can use that capability. In Huawei Cloud Stack usage and O & M materials, the node here is the compute host, and the docs also describe memory overcommitment behavior in terms of host resources and overcommitment ratios.

Huawei O & M guidance further explains that host resource isolation must be enabled before memory overcommitment is enabled, which confirms that this setting is tied to the compute-host layer. Some Huawei documents also refer to enabling or disabling memory overcommitment for a host group, but the actual execution point is still the underlying hosts/nodes in that group. Because your fill-in statement says “enable memory overcommitment on _____,” the most accurate and broadly supported answer is hosts. Therefore, after correcting the sentence, the verified answer is hosts.

========

This question is best treated as a multiple-correct-answer item, because official OpenStack documentation shows that Nova-Scheduler and Placement are both directly involved in the scheduling workflow. The Nova scheduling reference explains that the scheduler receives a request specification and then sends the requirements to Placement , which determines the resource providers capable of satisfying the request. Placement returns candidate resource information, and Nova-Scheduler performs filtering, weighing, and final host selection.

OpenStack documentation also notes that the nova-scheduler and placement services are responsible for tracking resources and deciding which compute node instances should be on . That makes A and D the directly scheduling-related components. While Nova-Conductor and Nova-API participate in the broader instance build flow by receiving requests and coordinating actions, they are not the core components that actually perform the scheduling decision itself.

So, for strict technical accuracy based on official OpenStack architecture, the verified answer is A and D . If your exam system forces only one option, then A (Nova-Scheduler) is the closest single best answer, but the documentation supports A and D together.

========

The correct answers are B, C, and D. Huawei’s official resource-analysis documentation states that bottleneck resources can be identified and analyzed globally and by VDC, resource pool, and application. This directly matches options B, C, and D in your question.

Although Huawei also has resource-pool analysis views that can monitor resources from multiple dimensions such as region, resource pool, and AZ, the specific wording for bottleneck analysis in the cited Huawei documentation highlights application, VDC, and resource pool as the relevant factors used for bottleneck identification and analysis. That is why AZs should not be selected for this particular question.

So, after correcting the sentence structure, the supported dimensions for bottleneck-related analysis by O & M administrators are applications, VDCs, and resource pools. Therefore, the verified answer is B, C, D.

========

The correct fill-in answer is VPN gateway . In Huawei Cloud Stack networking, an EIP can be associated not only with an individual ECS, but also with shared-access components that serve multiple backend resources. Huawei documentation clearly states that when multiple cloud servers in a subnet need outbound Internet access, they can use a NAT gateway and share an EIP . Huawei’s ELB documentation also reflects the model where a load balancer exposes services externally on behalf of multiple backend ECSs.

In the same family of network services, a VPN gateway is another gateway-type object that uses public-facing connectivity to provide secure access for multiple private-side resources. That is why the exam sentence groups it with load balancer and NAT gateway . The logic is that these service gateways allow multiple ECSs or private resources to make use of a single public-facing IP resource instead of requiring one EIP per server. Huawei’s VPN service documentation also shows VPN as the gateway-based service for secure site-to-cloud communication.

The best verified answer is A, B, and C. Huawei’s Managing Network Resources documentation states that on Service OM, administrators can view the number of created physical networks and virtual networks, which supports option C. The same Huawei material also says administrators can collect information for handling VM network faults, and related VPC/API guidance shows Service OM visibility into ports, including VM NIC-related ports, which supports A.

Huawei documentation for Direct Connect further shows that administrators can create Direct Connect access points on Service OM before tenants can use Direct Connect. In training-style wording, this aligns with the idea of creating private line access points, so B is also correct.

Option D is the one that does not fit as a standard Service OM network resource management action in the same way. Huawei documentation emphasizes viewing physical network information and managing related network resources, but creation or low-level configuration of physical networks is generally handled through platform network configuration workflows rather than as a routine Service OM tenant/resource function. Therefore, the correct set is A, B, C.

========

The correct answers are B and C . Huawei documentation states that a security group is a collection of access control rules used to protect cloud servers or instances added to that group. Huawei also describes a network ACL as a security service for VPCs or subnets , which means it protects traffic at the subnet level rather than directly protecting individual instances. That makes C correct.

Huawei’s comparison guidance also distinguishes the way rules are processed. Security groups are stateful and their rules work together as a combined access-control set, while network ACLs are processed according to rule priority , which makes B correct. The official Huawei comparison page explicitly frames network ACLs as an additional security layer on top of security groups.

Option A is incorrect because network ACLs are not mandatory by default in the same way security-group association is standard for instances. Option D is not supported by the Huawei VPC/network ACL documentation cited here; the docs emphasize instance-vs-subnet scope and rule handling, not that exact 5-tuple versus 3-tuple split for these two features. Therefore, the best verified answer is B, C .

========