EX188 Practice Test 15 — 15 Questions

Question 1

An administrator needs to inspect the configuration details, including subnet and gateway, of an existing custom network named 'my-net'. Which command should be executed?

Accepted Answer

podman network inspect my-net. The correct command is 'podman network inspect my-net'. The 'inspect' subcommand returns detailed JSON output about the network, including subnet, gateway, and connected containers. It is the standard way to view network configuration.

Answer

podman network show my-net

Answer

podman network details my-net

Answer

podman inspect network my-net

Question 2

How do you list all available Podman networks on your system?

Accepted Answer

podman network ls. 'podman network ls' is the correct command to list all Podman networks. The 'ls' subcommand is the standard Podman verb for listing resources, consistent with 'podman volume ls', 'podman image ls', and 'podman container ls'.

Answer

podman network list

Answer

podman network status

Answer

podman network show

Question 3

Which THREE practices are recommended when optimizing cache utilization during image builds with podman build?

Accepted Answer

Place instructions that change frequently, such as COPYing source code, near the end of the Containerfile.. Option C is correct because placing frequently changing instructions such as COPYing source code near the end of the Containerfile preserves the cache for earlier, stable layers; when source changes, only the final layers are rebuilt. Option D is correct because combining related package installation and cleanup into a single RUN instruction creates one cacheable layer and avoids leaving package-manager metadata or temporary files in intermediate layers, which also reduces image size. Option E is correct because ordering instructions from least frequently changed to most frequently changed maximizes cache hits: stable base and dependency layers stay cached while only the volatile trailing layers are invalidated. Option A is not recommended because --no-cache disables layer caching entirely, forcing full rebuilds and defeating cache optimization for routine builds. Option B is wrong because putting COPY . . at the top invalidates the cache for every subsequent instruction whenever any source file changes, so dependency installation and other expensive steps rerun unnecessarily.

Answer

Use the --no-cache flag on every routine build to ensure absolute freshness.

Answer

Always place COPY . . at the very top of the Containerfile before installing software dependencies.

Question 4

Which TWO statements are true regarding user-defined bridge networks in Podman? (Choose two)

Accepted Answer

They allow administrators to specify custom subnets and gateways during creation.. Option D is correct because when creating a user-defined bridge network with `podman network create`, administrators can pass flags such as `--subnet` and `--gateway` to define custom CIDR ranges and gateway addresses instead of relying on Podman's default allocations. Option E is correct because Podman runs an internal DNS server (aardvark-dns) on user-defined networks, allowing containers to resolve each other by container name or network alias rather than by IP address. Option A is wrong because user-defined bridge networks rely on normal netfilter/NAT rules and do not require disabling the host firewall. Option B is wrong because containers on separate user-defined bridge networks are isolated by default and cannot communicate without explicit routing or connecting a container to both networks. Option C is wrong because user-defined bridge networks still provide outbound connectivity to the internet via NAT/masquerading on the host.

Answer

They require the host firewall to be completely disabled to function.

Answer

Containers attached to different user-defined networks can communicate without explicit routing.

Answer

They prevent containers from communicating with the outside internet entirely.

Question 5

An administrator wants to configure Podman to pull images using a specific TLS client certificate for mutual TLS authentication against a secure private registry. Where should the client certificate and private key be placed?

Accepted Answer

/etc/containers/certs.d/registry.example.com/ (with client.cert and client.key). Podman (via containers/image) looks for registry-specific TLS client certificates in /etc/containers/certs.d/<registry-hostname>/, where files named client.cert and client.key provide the mutual TLS credentials. This is the documented location for per-registry TLS configuration.

Answer

~/.config/containers/tls/

Answer

/etc/pki/tls/private/

Answer

/etc/containers/auth.d/

Question 6

An administrator is troubleshooting a misbehaving container and needs to examine its output logs and event history. Which TWO commands are appropriate for this task? (Choose TWO)

Accepted Answer

podman logs. Option B, `podman logs`, is correct because it retrieves the stdout/stderr output of a container (or pod), which is exactly what the administrator needs to examine the container's output logs. Option C, `podman events`, is correct because it displays a stream of container-related events (such as create, start, stop, die, and health status changes) along with timestamps, providing the event history the administrator requires. Option A, `podman inspect-logs`, is not a valid Podman subcommand; log inspection is done with `podman logs`, while `podman inspect` returns container metadata, not logs. Option D, `podman history`, is incorrect because it shows the image layer history (used with `podman history <image>`), not container runtime logs or events. Option E, `podman trace`, is not a real Podman command; there is no such subcommand for tracing container output or events.

Answer

podman inspect-logs

Answer

podman history

Answer

podman trace

Question 7

An administrator wants to immediately stop and remove a running container named temp_test in a single command. Which command should be used?

Accepted Answer

podman rm -f temp_test. The podman rm -f command force-removes a running container by sending SIGKILL to its processes and then deleting the container in a single operation. The -f (or --force) flag is what allows removal of a running container without a prior podman stop. This is the canonical one-step command for the scenario described.

Answer

podman kill --remove temp_test

Answer

podman delete --force temp_test

Answer

podman stop --rm temp_test

Question 8

Which instruction should be used in a Containerfile to copy local files from the host machine into the container filesystem?

Accepted Answer

COPY. The `COPY` instruction in a Containerfile is used to copy files from the build context (host machine) into the container filesystem. It is the standard and recommended instruction for this purpose.

Answer

TRANSFER

Answer

ADD

Answer

MOVE

Question 9

Two containers running on the same custom user-defined bridge network need to communicate with each other. What built-in mechanism allows them to resolve each other by container name?

Accepted Answer

Automatic DNS resolution provided by the CNI/Netavark network backend. When containers are attached to the same user-defined bridge network in Podman, the Netavark (or CNI) network backend runs an embedded DNS resolver that registers each container's name and aliases. This allows containers to resolve each other by name without any manual configuration, similar to Docker's user-defined bridge behavior. The default bridge network does not provide this; only custom user-defined networks do.

Answer

Static ARP table broadcasting managed by the kernel

Answer

Multicast DNS (mDNS) running inside every container image by default

Answer

Automatic editing of the host's /etc/hosts file by the Podman daemon

Question 10

You have a Kubernetes YAML manifest file named 'app.yaml' that defines a Pod with network settings. You want to deploy this directly as a Podman container/pod on your local system. Which command should you use?

Accepted Answer

podman play kube app.yaml. 'podman play kube' reads a Kubernetes YAML manifest and creates the corresponding Podman pods and containers locally. It supports Pod, Deployment, and ConfigMap kinds, translating Kubernetes constructs into Podman equivalents. This is the correct command to deploy a Kubernetes manifest directly with Podman.

Answer

podman-compose up --file app.yaml

Answer

podman run --kube app.yaml

Answer

podman apply -f app.yaml

Question 11

You are troubleshooting a container that should have no network access whatsoever for security isolation. Which networking option should you apply?

Accepted Answer

--network none. `--network none` is the Podman option that places the container in an isolated network namespace containing only the loopback interface, providing complete network isolation. This is exactly what is required when a container must have no network access whatsoever for security reasons. It removes all external interfaces and prevents any inbound or outbound traffic beyond the container itself.

Answer

--network isolated

Answer

--network bridge

Answer

--network host

Question 12

You want to build an image that has a build-time argument named 'VERSION'. How do you declare this variable inside the Containerfile so it can be used during the build steps?

Accepted Answer

ARG VERSION. ARG is the Containerfile instruction that declares a build-time variable, which can be populated with --build-arg at build time and referenced in subsequent RUN, COPY, or other instructions. It exists only during the build and is not persisted in the final image's runtime environment, which is exactly the semantics required for a build-time VERSION variable.

Answer

DEFINE VERSION

Answer

ENV VERSION=1.0

Answer

VAR VERSION

Question 13

A developer wants to pass a secret API key during the container build process without leaving the secret exposed in image layers or history. Which Podman feature should be used?

Accepted Answer

podman build --secret id=mysecret,src=/path/to/key.txt . with RUN --mount=type=secret,id=mysecret .... Podman supports build-time secrets using the --secret flag and the --mount=type=secret directive in the Containerfile.

Answer

ARG API_KEY=secret_value

Answer

ENV API_KEY=secret_value

Answer

ADD /path/to/key.txt /app/key.txt followed by RUN rm /app/key.txt

Question 14

You are writing a Containerfile to build a custom application image using podman build. Which instruction should you use as the mandatory first non-comment instruction to define the base image?

Accepted Answer

FROM. The FROM instruction is the mandatory first non-comment instruction in a Containerfile (or Dockerfile) because it specifies the base image upon which subsequent instructions operate. Without FROM, the build cannot determine the starting filesystem and will fail. It sets the stage for all following layers, such as RUN, COPY, and CMD.

Answer

IMPORT

Answer

BASE

Answer

INIT

Question 15

An administrator is troubleshooting process execution and live configuration updates on a running container. Which TWO commands allow interacting with processes or updating resource limits on the fly? (Choose TWO)

Accepted Answer

podman update. Option C, `podman update`, is correct because it allows an administrator to change resource limits (such as CPU, memory, and pids limits) on an already-running container without restarting it, which directly satisfies the requirement for live configuration updates. Option E, `podman top`, is correct because it displays the running processes inside a container (similar to the Linux `top` command), letting the administrator inspect process execution in real time. The other options do not exist as valid Podman subcommands: `podman exec-top` (A) is not a real command, `podman adjust` (B) is not a real command, and `podman modify` (D) is not a real command, so none of them can be used for this scenario.

Answer

podman exec-top

Answer

podman adjust

Answer

podman modify