EX188 Practice Test 18 — 15 Questions

Question 1

An administrator needs to update the CPU shares (cpu-shares) of a running container named compute_job on the fly without stopping it. Which command should be used?

Accepted Answer

podman update --cpu-shares 512 compute_job. The podman update command modifies resource limits of a running container without requiring a restart, and --cpu-shares is one of the supported tunables. Running podman update --cpu-shares 512 compute_job adjusts the relative CPU weight of the container on the fly, which is exactly what the administrator needs.

Answer

podman config compute_job cpu-shares=512

Answer

podman modify --cpu-shares 512 compute_job

Answer

podman set --shares=512 compute_job

Question 2

An administrator is troubleshooting container startup failures and wants to inspect the exact entrypoint and command arguments configured for a container named app_run before it starts. Which inspect format expression retrieves this?

Accepted Answer

podman inspect --format='{{.Config.Entrypoint}} {{.Config.Cmd}}' app_run. The correct inspect format expression uses '.Config.Entrypoint' and '.Config.Cmd' to retrieve the entrypoint and command arguments configured for the container. These fields are part of the container's configuration and reflect the image's defaults or overrides specified at runtime.

Answer

podman ps --format='{{.Command}}' app_run

Answer

podman inspect --format='{{.State.Command}}' app_run

Answer

podman inspect --format='{{.Args}}' app_run

Question 3

You wish to connect an already running container to an existing custom Podman network named 'mynet'. Which command should you use?

Accepted Answer

podman network connect mynet mycontainer. 'podman network connect' attaches a running or stopped container to a specified network.

Answer

podman network attach mynet mycontainer

Answer

podman container network-add mynet mycontainer

Answer

podman network join mynet mycontainer

Question 4

Which TWO commands allow a user to remove unwanted items from local Podman storage? (Choose two.)

Accepted Answer

podman rmi. Option B, `podman rmi`, is correct because it removes one or more images from local Podman storage, deleting the image layers and metadata from the local image store. Option D, `podman rm`, is correct because it removes one or more containers from local Podman storage, cleaning up stopped containers that are no longer wanted. Both commands directly target unwanted local objects (images and containers respectively) and are the standard Podman subcommands for deletion. Option A, `podman container clear`, is not a valid Podman subcommand, so it cannot remove anything. Option C, `podman prune-all`, is not a real Podman command; pruning is done via `podman system prune` or `podman image prune`/`podman container prune`. Option E, `podman image delete`, is not a valid Podman subcommand; image deletion is performed with `podman rmi` (or `podman image rm`).

Answer

podman container clear

Answer

podman prune-all

Answer

podman image delete

Question 5

When working with Podman Compose files, which TWO options are valid keys that can be specified under a service definition for port and networking configuration? (Choose two)

Accepted Answer

networks. Option B (networks) is correct because in a Compose service definition, the networks key attaches the service's containers to one or more named networks declared in the top-level networks section, controlling inter-service connectivity and DNS resolution. Option D (ports) is correct because the ports key publishes container ports to the host using mappings such as "8080:80", which is the standard Compose mechanism for exposing service ports. Option A (firewall) is not a valid Compose service key; firewall rules are handled by the host or container runtime, not by Compose file syntax. Option C (nat_mapping) is not a Compose key; NAT behavior is implicit in port publishing rather than configured via a nat_mapping field. Option E (ip_address) is not a valid service-level key in Compose files; static IPs are set under a network's ipv4_address within the service's networks configuration, not as a top-level service key.

Answer

firewall

Answer

nat_mapping

Answer

ip_address

Question 6

Which THREE practices should be observed when managing environment variables (ENV vs ARG) in Containerfiles for secure and efficient builds? (Choose three.)

Accepted Answer

Use 'ENV' for configuration parameters that the application needs to read during container runtime.. Option A is correct because ENV variables are baked into the image configuration and are available to the application at runtime, making them the right choice for runtime configuration parameters. Option B is correct because ARG values exist only during the build and, unlike ENV, are not persisted in the final image metadata, so build-only values should use ARG. Option D is correct because an ARG declared before the first FROM is in the global scope and can be referenced in FROM instructions (e.g., ARG BASE=alpine then FROM ${BASE}), enabling base image parameterization. Option C is not correct because ENV variables do not automatically carry over between separate stages in a multi-stage build; each stage starts from its own base and must re-declare or explicitly inherit values. Option E is not correct because ENV values are stored in plaintext in image layers and metadata, so they must never be used for secrets such as API tokens.

Answer

Ensure that 'ENV' variables defined in earlier stages automatically carry over into subsequent multi-stage build stages without re-declaration.

Answer

Use 'ENV' for passing secret API tokens so they are automatically encrypted in the image layers.

Question 7

An administrator has a container that failed to start correctly. They want to inspect the exit code and finished timestamp. Which inspect format string provides the finished time?

Accepted Answer

podman inspect --format='{{.State.FinishedAt}}' failed_app. Container lifecycle timestamps such as FinishedAt are stored under .State.

Answer

podman inspect --format='{{.Time.Ended}}' failed_app

Answer

podman inspect --format='{{.Finished}}' failed_app

Answer

podman ps --format='{{.FinishedAt}}' failed_app

Question 8

An administrator needs to export container contents or create new images from containers. Which TWO commands accomplish these actions? (Choose TWO)

Accepted Answer

podman commit. Option C, podman commit, is correct because it creates a new image from a container's current state (including its filesystem and specified configuration), which directly satisfies the requirement to create new images from containers. Option D, podman export, is correct because it exports a container's filesystem as a tar archive, which directly satisfies the requirement to export container contents. Option A, podman extract, is not a valid Podman command for this purpose, so it does not belong. Option B, podman push-container, is not a valid Podman command; pushing is done with podman push for images, not containers. Option E, podman save, saves an existing image to an archive rather than exporting container contents or creating a new image from a container, so it does not meet the scenario.

Answer

podman extract

Answer

podman push-container

Answer

podman save

Question 9

What type of storage pattern is used by default when a container writes logs and temporary application state directly to its writable layer without any volumes attached?

Accepted Answer

Ephemeral container storage. When a container writes logs or temporary state to its writable layer without any volume attached, that data is stored in the container's ephemeral writable layer. This storage is tied to the container's lifecycle and is lost when the container is removed, making it ephemeral. It is not persistent, not a bind mount, and not replicated block storage.

Answer

Persistent named storage

Answer

Bind mount storage

Answer

Block storage replication

Question 10

Which TWO statements are true regarding Podman bind mounts? (Choose TWO)

Accepted Answer

They link a specific host path directly into the container filesystem. Option D is correct because a Podman bind mount maps an explicit host directory or file path directly into a container path (e.g., -v /host/dir:/container/dir), unlike named volumes that Podman manages under its storage root. Option E is correct because bind mounts expose the host filesystem's ownership, mode bits, and SELinux labels to the container, so permission denials or SELinux AVC denials on the host path directly affect container access (often requiring :z/:Z relabeling or correct UID/GID mapping). Option A is wrong because bind mounts are host paths that persist after the container is removed; only anonymous volumes may be cleaned up. Option B is wrong because bind mounts can be mounted read-only using the :ro (or :ro,Z) mount option. Option C is wrong because that describes Podman-managed named volumes stored in Podman's volume database, not bind mounts, which reference host paths directly.

Answer

They are automatically deleted when the container is removed

Answer

They cannot be mounted in read-only mode

Answer

They are managed entirely inside Podman's internal volume database without host paths

Question 11

Which TWO instructions are used to define variables or set environment values within a Containerfile? (Choose two.)

Accepted Answer

ARG. ARG and ENV are used for defining build arguments and environment variables respectively.

Answer

DEFINE

Answer

VAR

Answer

SET

Question 12

An administrator needs to run a container that shares the host's network namespace directly so it can listen on privileged ports without port forwarding. Which Podman command flag achieves this network mode?

Accepted Answer

--network host. The `--network host` flag runs the container in the host's network namespace, meaning it shares the host's IP address and can bind to privileged ports (e.g., port 80) without port forwarding. This is the correct flag for the described requirement.

Answer

--network bridge

Answer

--publish-all

Answer

--net=none

Question 13

You need to ensure that a container image built with Podman includes reproducible timestamps for files to improve security and supply chain verification. Which flag or environment variable controls this?

Accepted Answer

SOURCE_DATE_EPOCH. SOURCE_DATE_EPOCH is the standardized environment variable (from the reproducible-builds.org specification) that sets a fixed timestamp for files created during a build, enabling bit-for-bit reproducible images. Podman and Buildah honor it during podman build, so setting it produces deterministic file timestamps. This supports supply chain verification because identical inputs yield identical image digests.

Answer

PODMAN_REPRODUCIBLE_BUILD=true

Answer

TIMESTAMP=0 in the Containerfile ENV

Answer

--reproducible flag in podman build

Question 14

An engineer needs to inspect the low-level configuration details, mount points, and driver options of a named volume named 'app_vol'. Which command provides this information in JSON format?

Accepted Answer

podman volume inspect app_vol. 'podman volume inspect app_vol' returns detailed JSON output including the volume's mount point, driver, labels, and options. This is the canonical command for retrieving low-level volume metadata in a machine-readable format.

Answer

podman volume show app_vol

Answer

podman volume status app_vol

Answer

podman inspect volume app_vol

Question 15

Which THREE methods or options can be used to authenticate or supply credentials when pulling images from a private registry that requires authentication? (Choose three.)

Accepted Answer

Running 'podman login' beforehand to store credentials in auth.json.. Option A is correct because 'podman login' stores the registry credentials in the auth.json file (typically under $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json), and subsequent 'podman pull' operations automatically read those stored credentials. Option D is correct because the '--authfile' flag lets you point 'podman pull' at a custom credentials file in the same JSON format, which is useful for non-default credential locations or automation. Option E is correct because 'podman pull --creds username:password' supplies the credentials inline for that single command, authenticating directly against the private registry without a prior login. Option B is not a valid mechanism: Podman does not read a 'PODMAN_PASSWORD' environment variable to authenticate pulls, so setting it alone has no effect. Option C is not valid because '--password-stdin' is an option of 'podman login' (to read the password from standard input), not of 'podman pull', so it cannot be passed directly to the pull command.

Answer

Setting the environment variable 'PODMAN_PASSWORD' without any login command.

Answer

Passing '--password-stdin' directly to 'podman pull'.