Reinforce EX188 concepts with active-recall study cards covering all 5 blueprint domains. Each card shows the question on the front and the correct answer with a full explanation on the back.
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For EX188 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the EX188 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your EX188 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real EX188 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass EX188.
Sample cards from the EX188 flashcard bank. Read the question, think of the answer, then read the explanation below.
When writing a Containerfile, which instruction specifies the base image to be used for the subsequent build steps?
FROM
Every Containerfile must start with a FROM instruction to define the base image.
An administrator runs a container with a SELinux-relabeled host directory mount using the Z option, but multiple containers need to share write access to this exact same volume. Which option should be used instead?
podman run -v /host/data:/data:z
The `:z` option applies a shared SELinux label to the volume, allowing multiple containers to access the same content. When multiple containers need write access to the same host directory, `:z` is the correct choice because it relabels the content with a shared MCS category rather than a private one.
A user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?
~/.config/containers/registries.conf
For rootless Podman, user-specific configuration files take precedence over system-wide ones. The correct location to define an insecure registry for a single user is ~/.config/containers/registries.conf, which is the per-user override for /etc/containers/registries.conf. Podman reads this file when running as a non-root user, allowing the user to specify registries as insecure without requiring root privileges. This is part of the containers/image configuration stack, and the user-level file is the proper place for such customizations.
An administrator creates a custom CNI network using 'podman network create mynet' and wants to assign a static IP address to a container upon creation. Which option achieves this?
podman run --network mynet --ip 192.168.100.50 -d myimage
The `--ip` flag combined with `--network mynet` is the correct way to assign a static IP to a container on a custom CNI network in Podman. The syntax `podman run --network mynet --ip 192.168.100.50 -d myimage` attaches the container to the named network and requests the specified IP from the network's IPAM range. The IP must fall within the subnet defined when the network was created.
An administrator wants to view real-time container lifecycle events across the entire Podman system, such as container creation, starting, and stopping. Which command should be executed?
podman events
The podman events command streams real-time container lifecycle events from the Podman system, including create, start, stop, die, and remove actions across all containers. It is the direct analog of docker events and is the correct tool for monitoring system-wide container activity.
An administrator needs to pause all processes inside a running container named db_master without stopping it. Which command accomplishes this?
podman pause db_master
The `podman pause` command sends the SIGSTOP signal to all processes inside the specified container, freezing their execution without terminating the container or its processes. This allows the container to be resumed later with `podman unpause`, which sends SIGCONT. Unlike stopping, the container's state and memory are preserved.
Which flag can be passed to 'podman run' to automatically remove the container and its anonymous volumes upon exit?
podman run --rm
The --rm flag in podman run tells Podman to automatically remove the container and its anonymous volumes when the container exits. This is equivalent to the --rm flag in Docker and is commonly used for ephemeral containers. It helps keep the system clean by removing stopped containers and their associated anonymous volumes.
A container named 'metrics' has been running for several hours, and an engineer needs to inspect its current resource consumption (CPU, memory, and network I/O usage). Which Podman command provides a live-updating stream of resource usage statistics for running containers?
podman stats metrics
`podman stats` is the Podman equivalent of `docker stats` and provides a live, continuously updating stream of CPU, memory, network I/O, and block I/O statistics for one or more running containers. When a container name is passed (e.g., `podman stats metrics`), it filters the output to just that container and refreshes on an interval until interrupted.
A user needs to log out from a private container registry to remove stored credentials from their local machine. Which command accomplishes this?
podman logout registry.example.com
'podman logout' removes stored credentials for a registry.
A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?
Into the local GnuPG keyring using 'gpg --import'
For the dir:// transport, Podman verifies signatures using keys in the local GnuPG keyring, so the public key must be imported with 'gpg --import' into the user's keyring (or root's, depending on context). The signedBy field in policy.json references a key fingerprint that Podman looks up in that keyring during verification.
You are designing a container image that runs an executable web server. You want to provide default arguments to the executable that can be easily overridden by a user passing arguments directly to 'podman run'. Which instruction combination is best?
Use ENTRYPOINT for the binary and CMD for the default arguments.
Using ENTRYPOINT for the binary and CMD for the default arguments is the best practice. When a user runs 'podman run <image> <args>', the arguments passed on the command line override the CMD instruction, while the ENTRYPOINT remains the executable. This allows the user to easily override default arguments without changing the binary.
A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?
It turns off SELinux separation and labeling for the container.
The '--security-opt label=disable' flag in Podman disables SELinux labeling for the container. This means that the container processes are not confined by SELinux policies, and the container can access files without SELinux context restrictions. This is often used when SELinux is causing permission issues, but it reduces security. The flag specifically turns off SELinux separation, not seccomp, user namespaces, or AppArmor.
An administrator needs to create a persistent storage volume that Podman can manage independently of any specific container lifecycle. Which command accomplishes this?
podman volume create mydata
`podman volume create mydata` is the correct command to create a named volume that Podman manages independently of any container's lifecycle. Named volumes persist after containers are removed and can be mounted into multiple containers, making them ideal for persistent data. This is the direct Podman equivalent of `docker volume create`.
An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?
[[registry]] prefix = "registry.example.com" location = "internal-mirror.example.com"
Podman's `/etc/containers/registries.conf` uses TOML, and a registry block is defined with `[[registry]]` (an array of tables). The `prefix` field specifies the registry hostname to match, and `location` specifies the mirror to use instead, so `[[registry]]` with `prefix` and `location` is the correct syntax.
An administrator needs to attach to the terminal of a currently running container named backend_app to view its active console output interactively. Which command should be used?
podman attach backend_app
`podman attach` connects the current terminal's STDIN/STDOUT/STDERR to a running container's main process (PID 1), letting the administrator view live console output and interact with it. This is the direct equivalent of `docker attach` and is the correct tool for viewing an active console interactively.
You are optimizing image build times and notice that a specific RUN instruction fetching dependencies is re-running on every build, even though the requirements.txt file has not changed. What is causing this behavior?
The COPY requirements.txt instruction was placed after an instruction that introduces non-deterministic data or the build context files have modified timestamps.
Docker/Podman layer caching invalidates a RUN layer when any preceding instruction's layer changes. If COPY requirements.txt comes after an instruction that produces non-deterministic output (e.g., a RUN that fetches latest packages or writes timestamps) or if build-context files have changed mtimes, the cache key for the COPY layer changes, invalidating all subsequent RUN layers including the dependency install.
An administrator wants to view a list of all running containers in a clean, tabular format without stopping containers or showing extra metadata. Which command should be used?
podman ps
podman ps lists running containers by default.
You have created a Podman pod and want to launch two containers inside this pod so they share the same network namespace. How do you specify this during container creation?
podman run --pod mypod -d myimage
The --pod flag on podman run attaches a new container to an existing pod, and all containers in the same pod share the pod's network namespace (and by default its IPC and UTS namespaces). So podman run --pod mypod -d myimage launches the container inside the pod with shared networking. This is the standard way to add containers to a pod after the pod is created.
A system administrator logs into a RHEL 9 server as a regular non-root user and executes 'podman ps'. The command succeeds, but no containers are displayed. What architecture feature enables this user to run containers without root privileges?
Linux user namespaces and subuid/subgid mapping
Rootless Podman relies on Linux user namespaces combined with subordinate UID/GID ranges defined in /etc/subuid and /etc/subgid. The user namespace maps the container's root (UID 0) to the unprivileged user's UID on the host, and additional container UIDs map into the allocated subuid/subgid ranges. This lets a non-root user run containers without any setuid daemon.
An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?
/etc/containers/registries.conf using the unqualified-search-registries parameter
The /etc/containers/registries.conf file contains the unqualified-search-registries parameter, which lists registries to search when a user pulls an image without specifying a registry. Adding registry.access.redhat.com to this list allows podman pull rhel9 to automatically expand to registry.access.redhat.com/rhel9.
A developer needs to optimize image size by removing build caches and temporary package manager cache files within the same RUN instruction. Why must this be done in a single RUN instruction?
Because file deletions in separate layers do not reduce the final image size due to the layered filesystem.
Container images are built as a stack of immutable layers, and each RUN instruction creates a new layer. If files are created in one RUN and deleted in a later RUN, the deletion only adds a whiteout marker in the new layer; the original files remain in the earlier layer and still contribute to the final image size. Performing installation and cleanup in a single RUN ensures the temporary files never persist in any committed layer.
You need to completely remove a custom user-defined bridge network named 'test-net' that has no active containers attached to it. Which command performs this action?
podman network rm test-net
'podman network rm test-net' removes the specified user-defined network. Since the network has no active containers attached, the removal succeeds immediately; if containers were attached, Podman would refuse unless forced. This is the direct, correct command for deleting a named network.
The EX188 flashcard bank covers all 5 official blueprint domains published by Red Hat. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Container Image Building
Storage And Configuration
Registry And Security
Networking And Compose
Container Operations And Lifecycle
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that EX188 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.EX188 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective EX188 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
Yes. Courseiva provides free EX188 flashcards across all official exam domains. Every card includes the correct answer and a full explanation of why it is right and why the distractors are wrong. The platform also includes topic-based practice, mock exams, and readiness tracking — no account required.
Courseiva has 264+ original EX188 flashcards across all 5 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are checked against the official Red Hat exam objectives, with editorial oversight from an experienced network and security engineer.
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official EX188 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included