EX188 Practice Test 20 — 15 Questions

Question 1

An administrator wants to export the filesystem of a container named golden_image into a tar archive file named container_fs.tar. Which command should be used?

Accepted Answer

podman export -o container_fs.tar golden_image. podman export exports a container's filesystem as a tar archive.

Answer

podman save -o container_fs.tar golden_image

Answer

podman backup golden_image --file container_fs.tar

Answer

podman archive golden_image container_fs.tar

Question 2

A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?

Accepted Answer

:z. The `:z` volume option tells Podman to relabel the host directory with the SELinux context expected by the container process (typically `container_file_t`), allowing the confined container to read and write the mount. Without it, the directory retains its host label (e.g., `user_home_t` or `default_t`), and SELinux denies the container's writes even though Unix permissions look fine.

Answer

:ro

Answer

:shared

Answer

:exec

Question 3

An administrator configures rootless Podman on RHEL 9. For container user namespace mapping to function correctly for a specific user account, entries must be present in which two system files?

Accepted Answer

/etc/subuid and /etc/subgid. Rootless user namespaces rely on /etc/subuid and /etc/subgid.

Answer

/etc/passwd and /etc/group

Answer

/etc/containers/namespace.conf and /etc/containers/users.conf

Answer

/etc/security/limits.conf and /etc/login.defs

Question 4

Which THREE commands are valid Podman subcommands for managing container networks? (Choose three)

Accepted Answer

podman network ls. Option A, 'podman network ls', is correct because it is the standard Podman subcommand that lists all configured container networks (equivalent to 'podman network list'), showing network names, IDs, drivers, and interfaces. Option B, 'podman network create', is correct because it creates a new container network, allowing options such as --driver, --subnet, and --gateway to define CNI or Netavark network configuration. Option E, 'podman network inspect', is correct because it outputs detailed JSON metadata about one or more named networks, including subnets, gateways, and connected containers. Options C and D are not valid Podman subcommands: 'podman network restart' does not exist (networks are not restarted like services; containers are reconnected instead), and 'podman network upgrade' is not a Podman command, as network stack upgrades are handled through package management or 'podman system migrate' rather than a network subcommand.

Answer

podman network restart

Answer

podman network upgrade

Question 5

An administrator needs to inspect low-level configuration, network settings, and state details of a running container named redis_cache in JSON format. Which command provides this?

Accepted Answer

podman inspect redis_cache. `podman inspect` is the canonical command for retrieving low-level metadata about a container, image, volume, or network. It outputs a comprehensive JSON document containing configuration, state, network settings, mounts, environment variables, and more. Since the question explicitly asks for JSON-format low-level details, `podman inspect redis_cache` is the correct choice.

Answer

podman show redis_cache

Answer

podman details redis_cache

Answer

podman query --json redis_cache

Question 6

When configuring an environment file for use with '--env-file', how are comment lines designated?

Accepted Answer

Using '#' at the beginning of the line. In an environment file used with --env-file, comment lines are designated with a '#' at the beginning of the line. Podman (and Docker) parse these files line by line, treating lines starting with # as comments and ignoring them. This matches common shell-style and .env file conventions.

Answer

Using '//' at the beginning of the line

Answer

Using ';' at the beginning of the line

Answer

Using '/* ... */' block syntax

Question 7

Which THREE features or characteristics distinguish the ADD instruction from the COPY instruction in a Containerfile? (Choose three.)

Accepted Answer

ADD can automatically extract local compressed tar archive files into the destination directory.. Option A is correct because ADD automatically unpacks recognized local compressed tar archives (e.g., .tar, .tar.gz, .tgz, .tar.bz2, .tar.xz) into the destination directory, whereas COPY just places the file as-is. Option D is correct because ADD can fetch files directly from remote HTTP/HTTPS URLs, a capability COPY does not have. Option E is correct because COPY is preferred for straightforward file copying since its behavior is explicit and predictable, avoiding ADD's implicit extraction and remote-fetch side effects. Option B is wrong because neither ADD nor COPY requires the source to be in a git repository. Option C is wrong because COPY does not support remote URLs natively; only ADD does.

Answer

ADD requires the source file to be located within a git repository, unlike COPY.

Answer

COPY supports remote URLs natively just like ADD.

Question 8

A user wants to save a locally stored container image to a tar archive file to transfer it across systems without a registry. Which command should they use?

Accepted Answer

podman save -o image.tar image_name. 'podman save -o image.tar image_name' exports a locally stored image to a tar archive, preserving all layers and metadata. This is the correct command for transferring images between systems without a registry.

Answer

podman export -o image.tar container_name

Answer

podman backup image_name

Answer

podman dump image_name

Question 9

A container named app_server is running and consuming excessive CPU. An administrator needs to gracefully stop this container with a 30-second timeout before forcing termination. Which command accomplishes this?

Accepted Answer

podman stop --time 30 app_server. `podman stop --time 30 app_server` is correct because `--time` (or `-t`) sets the number of seconds Podman waits after sending SIGTERM before escalating to SIGKILL. This is exactly the graceful-stop-with-30-second-timeout behavior required. The container's main process gets SIGTERM, and only if it does not exit within 30 seconds does Podman force-kill it.

Answer

podman kill --signal SIGTERM --timeout 30 app_server

Answer

podman halt -s 30 app_server

Answer

podman terminate --grace-period=30 app_server

Question 10

A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?

Accepted Answer

/etc/containers/policy.json. The default system-wide signature policy file for container image verification on RHEL 9 is located at /etc/containers/policy.json. This file defines the policy for validating image signatures using tools like podman and skopeo.

Answer

/etc/containers/signatures.yaml

Answer

~/.config/containers/policy.json

Answer

/etc/containers/registries.conf

Question 11

An administrator needs to restart a running container named app_v1 so that configuration changes take effect. Which command performs a container restart?

Accepted Answer

podman restart app_v1. The 'podman restart' command stops and then starts the specified container in a single operation, which re-reads the container's configuration and applies any changes that require a fresh process. It is the direct equivalent of 'docker restart' and is the correct verb for restarting a running container by name.

Answer

podman reload app_v1

Answer

podman cycle app_v1

Answer

podman refresh app_v1

Question 12

An administrator wants to bind mount a host file directly into a container as a configuration file. Is this supported in Podman?

Accepted Answer

Yes, Podman supports bind mounting individual files from the host.. Podman supports bind mounting individual files from the host into a container using the -v or --mount flag, e.g., `podman run -v /host/config.conf:/etc/config.conf:Z`. This is a standard OCI runtime feature and is fully supported.

Answer

No, bind mounts are restricted to named volumes only.

Answer

No, Podman only supports bind mounting entire directories.

Answer

Yes, but only if the file is located inside /var/lib/containers.

Question 13

A developer needs to pull a private image from quay.io. The registry requires authentication. Which command should the developer use to store credentials for quay.io so that subsequent `podman pull` operations succeed without prompting?

Accepted Answer

podman login quay.io. The podman login command authenticates to a registry and stores the credentials in the appropriate auth file. After a successful login, Podman uses those stored credentials for subsequent operations such as podman pull. This is the standard method for accessing private images without embedding credentials in each command.

Answer

podman pull --authfile ~/.docker/config.json quay.io/image

Answer

podman logout quay.io

Answer

podman run --login quay.io

Question 14

You are defining a Podman Compose file for a web application stack. You need to ensure that the 'app' service can communicate with the 'cache' service using the hostname 'cache', and that the 'cache' service is assigned a static IP address 10.89.0.10 on the custom network 'backend'. Which TWO configuration elements must be present in the Compose file? (Choose two.)

Accepted Answer

A top-level networks section that defines 'backend' with an ipam configuration specifying the subnet 10.89.0.0/24.. Static IP assignment in Podman Compose requires the target network to have a defined subnet via an ipam configuration, and the service must specify ipv4_address under its networks mapping. Together, these allow Podman to assign the exact address and register the service name for DNS. Other options either misconfigure DNS or do not provide the required subnet for static addressing.

Answer

A service-level extra_hosts entry for 'app' that maps 'cache' to 10.89.0.10.

Answer

A service-level dns entry for 'cache' that lists 10.89.0.10 as the nameserver.

Answer

A top-level networks section that defines 'backend' with driver: bridge and no ipam configuration.

Question 15

A developer runs a container with 'podman run -d --name web -p 8080:80 nginx' on a host that already has a service listening on port 8080. The container starts but clients cannot reach the containerized web server on that port. Which command most directly reveals why the port mapping failed?

Accepted Answer

ss -ltnp | grep 8080. A published port fails to bind when another process already holds the host port. The most direct diagnostic is to list listening sockets and their owning processes, which identifies the conflicting service on port 8080. Container-side tools such as logs, port, or inspect describe the container's configuration or output, not the host socket that is occupying the requested port.

Answer

podman logs web

Answer

podman port web

Answer

podman inspect web