EX188 Practice Test 19 — 15 Questions

Question 1

A container named 'worker' was configured with a health check command during build time, but an administrator needs to temporarily override or define a new health check command while running the container. Which flag should be passed to 'podman run' to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--health-cmd. The `--health-cmd` flag in `podman run` allows overriding the health check command defined in the image. It specifies a command to run inside the container to check its health. This is the correct flag to temporarily define or override a health check at runtime.

Answer

--check-command

Answer

--healthcheck-run

Answer

--health-test

Question 2

An organization mandates that all container images produced internally must be signed using local GPG keys before being pushed to the production registry. Which tool and configuration file must be used to enforce that Podman rejects unsigned images during a pull operation?

Accepted Answer

/etc/containers/policy.json. Signature enforcement for image pulls is controlled by /etc/containers/policy.json, which defines per-transport and per-registry requirements such as 'signedBy' with a GPG keyring. To reject unsigned images, the policy must specify a signedBy requirement (or 'reject') for the relevant registry scope, causing Podman to fail the pull if the signature is missing or invalid.

Answer

/etc/containers/registries.conf

Answer

/var/lib/shared/sigstore

Answer

~/.config/containers/auth.json

Question 3

Which TWO actions occur when a container is run with ephemeral storage (the default behavior without volume mounts)? (Choose TWO)

Accepted Answer

The container has its own writable scratchpad layer separate from the image. Option B is correct because when a container runs without any volume mounts, Docker (or a similar container runtime) creates a writable container layer on top of the read-only image layers, using a copy-on-write union filesystem such as overlay2; this scratchpad layer is where all runtime changes (new files, modified files, deleted files) are stored, keeping the underlying image immutable. Option D is correct because that writable layer is tied to the container's lifecycle: when the container is removed with docker rm (or docker run --rm), the layer and all data written to it are deleted, which is why ephemeral storage does not persist. Option A is wrong because image layers are read-only and are never written back to; changes go to the separate writable layer via copy-on-write. Option C is wrong because ephemeral container-layer data does not survive container deletion or host reboots unless a volume or bind mount is used. Option E is wrong because host files are not automatically synchronized into container storage; host access requires an explicit bind mount or volume.

Answer

All container changes are written directly back to the read-only image layer

Answer

Data persists automatically across host reboots and container deletions

Answer

Host files are automatically synchronized into the container storage

Question 4

A running Podman container named 'dbapp' is unresponsive, and a technician needs to immediately and forcefully terminate it without waiting for a graceful shutdown timeout. Which Podman command should be executed?

Accepted Answer

podman kill dbapp. The `podman kill` command sends a SIGKILL signal to the main process of the container by default, which immediately and forcefully terminates it without any graceful shutdown period. This matches the requirement to 'immediately and forcefully terminate' the unresponsive container. Unlike `podman stop`, which sends SIGTERM and waits for a timeout, `podman kill` does not wait and is the correct tool for this scenario.

Answer

podman stop --force dbapp

Answer

podman terminate dbapp

Answer

podman rm -f dbapp

Question 5

Which THREE actions occur when an administrator runs a container with an SELinux volume mount suffix ':Z'? (Choose three.)

Accepted Answer

The host path's SELinux context is altered to match the container's private category.. Option A is correct because the ':Z' suffix instructs the container runtime (e.g., podman/docker with SELinux) to relabel the host path's SELinux context, changing its type and adding a unique MCS category so it matches the container's private label. Option C is correct because ':Z' applies a private, unshared SELinux context (a unique category pair) to the mounted content, unlike ':z' which applies a shared label. Option E is correct because the private MCS category ensures that only the specific container launched with that flag can access the labeled files while SELinux is enforcing, preventing other containers from accessing them. Option B is incorrect because ':Z' does not change the host's SELinux enforcement mode to permissive; enforcement remains as configured. Option D is incorrect because ':Z' only relabels the content and does not make the host directory read-only across all namespaces.

Answer

The SELinux enforcement mode on the host is temporarily set to permissive.

Answer

The host directory becomes completely read-only across all namespaces.

Question 6

Which THREE practices should be followed to optimize container image size and build caching when writing Containerfiles? (Choose three.)

Accepted Answer

Order Containerfile instructions from least frequently changing to most frequently changing to maximize cache hits.. Caching and layer minimization depend on instruction order, cleanup in the same layer, and avoiding unnecessary tool installation.

Answer

Avoid using .containerignore files so that all host files are always cached by Podman.

Answer

Install all debugging tools and heavy development SDKs in the final production stage.

Question 7

Which THREE tasks can be performed using the 'podman system' command set? (Choose three.)

Accepted Answer

Displaying storage disk space usage statistics with 'podman system df'.. Option B is correct because 'podman system df' reports disk space usage statistics for Podman-managed storage, showing total, active, and reclaimable space for images, containers, and volumes. Option C is correct because 'podman system service' starts a background process that exposes the Podman REST API (Docker-compatible) on a socket, enabling remote clients to manage containers. Option E is correct because 'podman system prune' removes unused containers, images, networks, and optionally volumes, reclaiming storage. Option A is not part of the 'podman system' command set; sysctl parameters are configured via 'sysctl' or container runtime settings, not Podman. Option D is also not provided by 'podman system'; automatic updates of systemd container services are handled by tools like 'podman auto-update' or systemd timers, not the 'podman system' subcommands.

Answer

Configuring system-wide kernel sysctl parameters for container networking.

Answer

Automatically updating all running systemd container services.

Question 8

Which command displays disk space usage statistics for Podman storage, including volumes and containers?

Accepted Answer

podman system df. The correct command is `podman system df`. This command provides a summary of disk space usage for Podman's storage, including images, containers, and volumes. It is analogous to `docker system df` and is the standard way to inspect storage consumption in Podman.

Answer

podman disk status

Answer

podman volume df

Answer

podman storage usage

Question 9

When configuring container mounts using the --mount flag, which THREE key-value pairs are valid parameters in the option string? (Choose three.)

Accepted Answer

destination. The --mount flag accepts a comma-separated list of key=value pairs, and the three valid keys among the choices are type, source, and destination. Option E (type) is correct because it specifies the mount type, such as type=bind, type=volume, or type=tmpfs, which determines how the mount is handled. Option B (source) is correct because it identifies the source of the mount, such as a host path for a bind mount or a named volume for a volume mount. Option A (destination) is correct because it sets the path inside the container where the filesystem is mounted, for example destination=/app/data. Option C (permission) is not a valid --mount key; read/write control is expressed with the read-only or ro key (or --read-only), not permission. Option D (owner) is also not a valid --mount key, since ownership is determined by the underlying filesystem and container user, not by a mount option string parameter.

Answer

permission

Answer

owner

Question 10

An administrator needs to run a container named 'web01' using Podman in the background using the image registry.access.redhat.com/ubi8/httpd-24:latest. Which command correctly starts this container in detached mode and maps port 8080 on the host to port 80 in the container?

Accepted Answer

podman run -d --name web01 -p 8080:80 registry.access.redhat.com/ubi8/httpd-24:latest. 'podman run' is the command that creates and starts a container in one step, and -d puts it in detached (background) mode. The -p 8080:80 flag maps host port 8080 to container port 80 in the correct host:container order, and --name web01 assigns the required container name. This is the canonical Podman invocation for starting a named, detached, port-mapped container.

Answer

podman start -d --name web01 -p 8080:80 registry.access.redhat.com/ubi8/httpd-24:latest

Answer

podman container create -d --name web01 -p 8080:80 registry.access.redhat.com/ubi8/httpd-24:latest

Answer

podman run -b --name web01 -p 80:8080 registry.access.redhat.com/ubi8/httpd-24:latest

Question 11

An operator runs a Podman container and needs to inspect its assigned IP address directly from the container's runtime inspection output. Which command filters the JSON output to show only the IP address?

Accepted Answer

podman inspect --format='{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' container_name. Podman stores container runtime metadata in a JSON structure accessible via 'podman inspect'. The Go template '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' iterates over the Networks map and prints only the IPAddress field, which is exactly the filtering behavior required. This avoids dumping the full JSON and isolates the assigned IP.

Answer

podman show-ip container_name

Answer

podman network ip container_name

Answer

podman inspect --ip container_name

Question 12

After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?

Accepted Answer

podman tag myapp:v1 registry.example.com/myteam/myapp:latest. The podman tag command creates a new tag that points to the same image ID as an existing local image. Running podman tag myapp:v1 registry.example.com/myteam/myapp:latest adds the fully qualified registry tag to the local image, preparing it for a push to that registry.

Answer

podman rename myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman commit myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman push myapp:v1 --target registry.example.com/myteam/myapp:latest

Question 13

An administrator needs to pass a single environment variable directly on the command line when starting a container. Which flag accomplishes this?

Accepted Answer

podman run -e DB_HOST=localhost myapp. The -e flag (or --env) in podman run sets an environment variable inside the container. The syntax podman run -e DB_HOST=localhost myapp passes DB_HOST=localhost to the container's environment. This is the standard and correct way to inject a single environment variable on the command line.

Answer

podman run --set-env DB_HOST=localhost myapp

Answer

podman run -v DB_HOST=localhost myapp

Answer

podman run --variable DB_HOST=localhost myapp

Question 14

Which user instruction changes the user name or UID and group name or GID to use when running subsequent instructions in the Containerfile?

Accepted Answer

USER. The USER instruction sets the user name or UID to use for running the image and for any RUN, CMD and ENTRYPOINT instructions that follow it.

Answer

LOGIN

Answer

IDENTITY

Answer

ACCOUNT

Question 15

An administrator wants to rename an existing stopped container from old_name to new_name. Which command should be used?

Accepted Answer

podman rename old_name new_name. 'podman rename old_name new_name' is the dedicated command for renaming a container, and it works on stopped containers. It updates the container's name in Podman's storage without altering its ID, configuration, or state. This is the direct, purpose-built solution for the task.

Answer

podman update --name new_name old_name

Answer

podman mv old_name new_name

Answer

podman modify --name new_name old_name