EX188 Practice Test 16 — 15 Questions

Question 1

An administrator is configuring container health checks and wants to review health status or force immediate actions. Which TWO of the following statements or commands are accurate regarding Podman health checks? (Choose TWO)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

podman inspect --format='{{json .State.Health.Status}}' can be used to check container health status.. Option A is correct because `podman inspect --format='{{json .State.Health.Status}}'` queries the container's State.Health.Status field, which reports the current health state (healthy, unhealthy, starting) for a container that has a health check defined. Option B is correct because health checks are configured at container creation time with `podman run --health-cmd` (alongside related flags like --health-interval, --health-retries, and --health-timeout), which defines the command Podman executes to determine health. Option C is incorrect because Podman does not write health status to a host file such as /var/log/podman-health.log; health state is stored in the container's state metadata and viewed via inspect. Option D is incorrect because `podman stop` simply sends SIGTERM (then SIGKILL after a timeout) to the container and does not trigger a health check. Option E is incorrect because there is no top-level `podman health-check status` command; health checks are managed through run/create options and inspected via `podman inspect` or `podman healthcheck run`.

Answer

Container health statuses are automatically logged to /var/log/podman-health.log on the host.

Answer

podman stop automatically triggers a health check before shutting down.

Answer

podman health-check status is a valid built-in standalone top-level command.

Question 2

An administrator needs to inspect running containers and their resource consumption. Which TWO commands provide information about running container state or resource usage? (Choose TWO)

Accepted Answer

podman stats. Option B, `podman stats`, is correct because it displays live resource-usage statistics for running containers, including CPU percentage, memory usage/limit, network I/O, block I/O, and PIDs, which directly addresses the requirement to inspect resource consumption. Option C, `podman ps`, is correct because it lists containers and their current state (e.g., Up, Exited), so it provides the running-container state information the administrator needs. Option A, `podman storage`, is not correct because it reports storage-driver and layer/space information rather than per-container runtime state or resource usage. Option D, `podman images`, is not correct because it lists local image metadata (repository, tag, image ID, size), not running containers. Option E, `podman network ls`, is not correct because it lists configured container networks, not container state or resource consumption.

Answer

podman storage

Answer

podman images

Answer

podman network ls

Question 3

Which THREE mechanisms are part of Podman's image signature verification framework on RHEL 9? (Choose three.)

Accepted Answer

Signature storage backends (such as sigstore) where detached signatures are stored.. Podman's image signature verification framework on RHEL 9 relies on three core components. Option A is correct because signature storage backends (for example, the sigstore backend configured in registries.d YAML files) define where detached signatures are fetched from and stored during verification. Option D is correct because /etc/containers/policy.json is the policy configuration file that specifies which repositories or transports require signature verification and what type of verification (such as signedBy) must pass. Option E is correct because GnuPG public key rings (referenced via keyPath or keyData in policy.json) supply the cryptographic keys used to validate the detached image signatures. Option B is not part of this framework, since SELinux policy compilation is unrelated to image signature verification and is not triggered by image pulls. Option C is also incorrect because TLS client certificate authorities for registry handshakes belong to transport-level TLS authentication, not to Podman's signature verification framework.

Answer

Automatic kernel SELinux policy compilation during image pull.

Answer

Built-in TLS client certificate authorities for registry TCP handshakes.

Question 4

Which THREE statements accurately describe the differences between shell form and exec form for CMD and ENTRYPOINT instructions? (Choose three.)

Accepted Answer

Exec form ensures that Unix signals (such as SIGTERM) sent by Podman are received directly by the application process as PID 1.. Option C is correct because in exec form the specified executable is launched directly as PID 1, so signals like SIGTERM sent by Podman (or Docker) are delivered straight to the application, enabling proper graceful shutdown. Option D is correct because exec form uses JSON array syntax such as ["executable", "param"], which is the defining syntactic characteristic of exec form in CMD and ENTRYPOINT instructions. Option E is correct because shell form implicitly wraps the command with '/bin/sh -c', so the shell becomes PID 1 and the actual application runs as a child process, which can prevent it from receiving signals directly. Option A is incorrect because shell form is not mandatory in multi-stage builds; both shell and exec forms work in any build stage. Option B is incorrect because exec form does not perform shell variable expansion of things like $VAR unless you explicitly invoke a shell (e.g., ["/bin/sh", "-c", "echo $VAR"]); it is shell form that provides implicit variable expansion.

Answer

Shell form is mandatory when using multi-stage builds.

Answer

Exec form allows shell variable expansion (like $VAR) directly without needing explicit shell invocation.

Question 5

Which TWO commands are used to transfer container images via archive files without interacting with a network registry? (Choose two.)

Accepted Answer

podman save. Option A, `podman save`, is correct because it serializes one or more local container images into an archive file (e.g., a tarball) on disk, which can then be moved to another host without contacting a registry. Option D, `podman load`, is correct because it reads such an image archive produced by `podman save` and restores the image(s) into the local container storage, again with no network registry involved. Together, `podman save` and `podman load` form the standard offline image transfer pair. Option B, `podman import`, is not correct here because it creates an image from a filesystem tarball (often produced by `podman export`), not from a saved image archive. Option C, `podman export`, is not correct because it exports a running or existing container's filesystem to a tar file, not a container image. Option E, `podman transfer`, is not a valid Podman command for this purpose.

Answer

podman import

Answer

podman export

Answer

podman transfer

Question 6

An administrator needs to clean up stopped containers and unused data to reclaim disk space. Which TWO commands can be used to remove containers? (Choose TWO)

Accepted Answer

podman rm. Option C, 'podman rm', is correct because it removes one or more specified containers by name or ID, which is the standard way to delete stopped containers and free their writable layer space. Option E, 'podman container prune', is correct because it bulk-removes all stopped containers in a single operation, directly reclaiming disk space from containers that are no longer running. Option A, 'podman image prune', is wrong because it removes unused images, not containers. Option B, 'podman rmi', is wrong because it removes images rather than containers. Option D, 'podman system clean', is wrong because there is no such Podman subcommand; the actual command for reclaiming multiple resource types is 'podman system prune'.

Answer

podman image prune

Answer

podman rmi

Answer

podman system clean

Question 7

You are running a rootless Podman container that serves a web application on port 8080. You want users on other machines in the 192.168.1.0/24 subnet to reach the service by connecting to the host's IP address on port 8080. The host's firewall allows the traffic. Which command correctly publishes the container port?

Accepted Answer

podman run -d -p 8080:8080 myapp. To publish a container port to all host interfaces, the -p flag must be used with the host-port:container-port syntax and no host IP. Podman then binds the host port on every interface, allowing subnet clients to connect via the host's 192.168.1.x address. Using a CIDR as a host IP is invalid, --publish-all assigns random ports, and --expose does not publish anything.

Answer

podman run -d -p 192.168.1.0/24:8080:8080 myapp

Answer

podman run -d --publish-all myapp

Answer

podman run -d --expose 8080 myapp

Question 8

You are optimizing a Containerfile for a Python application. The build currently uses a single RUN instruction that installs dependencies, runs tests, and cleans up temporary files. You want to leverage build caching to speed up rebuilds when only application code changes, while ensuring that dependency installation is cached separately. Which approach best achieves this?

Accepted Answer

Split the RUN instruction into multiple RUN instructions, placing the dependency installation before the COPY of application code.. To optimize caching, dependencies should be installed in a layer that remains unchanged when application code changes. Placing dependency installation in a RUN instruction before COPYing the application code ensures that the dependency layer is cached and reused. Subsequent code changes only invalidate the COPY and later layers, not the dependency installation. This minimizes rebuild time and is a common pattern in Containerfile optimization.

Answer

Add a .containerignore file to exclude application code from the build context.

Answer

Use a multi-stage build where the first stage installs dependencies and the second stage copies them.

Answer

Keep the single RUN instruction but add a cache mount for the package manager.

Question 9

A security-conscious administrator runs a rootless Podman container that must bind-mount a directory from the host. The container process is denied access to the files even though the directory has world-readable permissions, and SELinux is enforcing. Which TWO steps will resolve the denial while keeping SELinux enforcing? (Choose two.)

Accepted Answer

Change the host directory's SELinux type to container_file_t with semanage fcontext and restorecon.. SELinux denials for bind mounts occur because the host directory retains a type that the container process is not allowed to access. Relabeling the path with :Z for a private container label, or persistently setting the path's type to container_file_t and applying it, aligns the SELinux context with the container's policy. Both solutions preserve enforcing mode and avoid disabling confinement.

Answer

Run the container with --security-opt label=disable to remove SELinux confinement from the container.

Answer

Set the container to run with --privileged so it bypasses SELinux checks on the mounted files.

Answer

Use a bind mount with the :ro option so SELinux treats the mount as read-only and permits access.

Question 10

A developer needs to push a locally built image to a private registry that requires authentication. The registry uses a self-signed certificate, and the developer wants Podman to trust that certificate for this registry only. Which action should be taken?

Accepted Answer

Copy the registry's CA certificate into /etc/containers/certs.d/:/ and run podman login again.. Podman supports per-registry certificate directories under /etc/containers/certs.d. Placing the CA certificate in a directory named for the registry host and port allows Podman to trust the self-signed certificate for that registry alone. This avoids disabling TLS verification and avoids modifying the system-wide trust store, keeping the configuration scoped and secure.

Answer

Import the certificate with update-ca-trust and restart the podman.socket service.

Answer

Set tls-verify=false in the [[registry]] section for that registry in /etc/containers/registries.conf.

Answer

Add the registry to the unqualified-search-registries list in /etc/containers/registries.conf.

Question 11

An administrator needs to pass a configuration file located at /etc/myapp/config.yml on the host into a container at the same path. The container should read the file but not modify it. Which Podman run option accomplishes this with minimal risk of accidental modification?

Accepted Answer

podman run -v /etc/myapp/config.yml:/etc/myapp/config.yml:ro myapp:latest. Using -v with :ro mounts the specific host file as read-only inside the container, satisfying the read-only requirement. The other options either allow write access, mount a directory instead of a file, or omit read-only protection. The :ro flag is essential to prevent accidental modification.

Answer

podman run -v /etc/myapp:/etc/myapp:ro myapp:latest

Answer

podman run --mount type=bind,source=/etc/myapp/config.yml,target=/etc/myapp/config.yml myapp:latest

Answer

podman run --volume /etc/myapp/config.yml:/etc/myapp/config.yml:rw myapp:latest

Question 12

An administrator is troubleshooting a rootless Podman container named payment_svc that fails to start with a permission-related error. The administrator wants to inspect the container's low-level configuration, including its mount points, namespace settings, and the exact command that was configured, without starting the container. Which command provides this information?

Accepted Answer

podman inspect payment_svc. podman inspect exposes the full stored configuration of a container as JSON, including mounts, namespace modes, environment, and the configured entrypoint and command, and it works whether the container is running or stopped. The other commands report runtime output, running processes, or live resource usage, all of which are unavailable or irrelevant for a container that never starts.

Answer

podman logs payment_svc

Answer

podman top payment_svc

Answer

podman stats payment_svc

Question 13

A developer needs to pass several environment variables to a container from a file named web.env. The file contains lines such as DB_HOST=localhost and DB_PORT=5432. Which Podman run flag should be used to load these variables into the container?

Accepted Answer

--env-file web.env. The --env-file flag is designed to read environment variables from a file, with each line in KEY=VALUE format. This matches the scenario where web.env contains multiple variables. The other options either use incorrect flag names or misinterpret how environment variables are passed to containers.

Answer

--config web.env

Answer

--environment-file web.env

Answer

--env web.env

Question 14

You are building an image with a multi-stage Containerfile. The final stage uses `FROM registry.access.redhat.com/ubi9/ubi-minimal` and you want to copy only the compiled binary from a builder stage named `builder` into `/usr/local/bin/app`. Which Containerfile line correctly copies that artifact?

Accepted Answer

COPY --from=builder /src/app /usr/local/bin/app. Multi-stage builds let you copy artifacts from a named or indexed earlier stage using COPY --from=<stage>. Because the scenario names the stage `builder`, the correct line references that name. This transfers only the compiled binary into the minimal final image, keeping the runtime image small and free of build tooling.

Answer

RUN cp --from=builder /src/app /usr/local/bin/app

Answer

COPY --from=0 /src/app /usr/local/bin/app

Answer

ADD --stage=builder /src/app /usr/local/bin/app

Question 15

You want a Podman Compose service to accept connections from other containers on the same Compose network but not from the host, and you do not want the host to be able to reach the service's port. Which Compose configuration achieves this while keeping the service reachable by name within the network?

Accepted Answer

Use 'expose:' to declare the container port without a 'ports:' mapping, and attach the service to the Compose network.. Declaring the container port with 'expose' while attaching the service to the Compose network lets other containers on that network reach the service by name, because no host-side listener is created. Publishing the port, even on loopback, would still make it reachable from the host, and disabling networking entirely would break intra-network connectivity. The internal-only requirement is met by exposing rather than publishing.

Answer

Add 'internal: true' to the service definition and map the port normally with 'ports:'.

Answer

Set 'network_mode: none' on the service and rely on the Compose network for name resolution.

Answer

Use 'ports:' with the host IP set to 127.0.0.1, for example '127.0.0.1:5432:5432'.