EX188 Practice Exam 1 — 20 Questions

Question 1

An administrator needs to pause all processes inside a running container named db_master without stopping it. Which command accomplishes this?

Accepted Answer

podman pause db_master. The `podman pause` command sends the SIGSTOP signal to all processes inside the specified container, freezing their execution without terminating the container or its processes. This allows the container to be resumed later with `podman unpause`, which sends SIGCONT. Unlike stopping, the container's state and memory are preserved.

Answer

podman suspend db_master

Answer

podman freeze db_master

Answer

podman hold db_master

Question 2

Which flag can be passed to 'podman run' to automatically remove the container and its anonymous volumes upon exit?

Accepted Answer

podman run --rm. The --rm flag in podman run tells Podman to automatically remove the container and its anonymous volumes when the container exits. This is equivalent to the --rm flag in Docker and is commonly used for ephemeral containers. It helps keep the system clean by removing stopped containers and their associated anonymous volumes.

Answer

podman run --delete-on-exit

Answer

podman run --clean

Answer

podman run --purge

Question 3

A container named 'metrics' has been running for several hours, and an engineer needs to inspect its current resource consumption (CPU, memory, and network I/O usage). Which Podman command provides a live-updating stream of resource usage statistics for running containers?

Accepted Answer

podman stats metrics. `podman stats` is the Podman equivalent of `docker stats` and provides a live, continuously updating stream of CPU, memory, network I/O, and block I/O statistics for one or more running containers. When a container name is passed (e.g., `podman stats metrics`), it filters the output to just that container and refreshes on an interval until interrupted.

Answer

podman inspect metrics

Answer

podman top metrics

Answer

podman system df metrics

Question 4

A user needs to log out from a private container registry to remove stored credentials from their local machine. Which command accomplishes this?

Accepted Answer

podman logout registry.example.com. 'podman logout' removes stored credentials for a registry.

Answer

podman rm auth registry.example.com

Answer

podman clear-credentials registry.example.com

Answer

podman disconnect registry.example.com

Question 5

A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?

Accepted Answer

Into the local GnuPG keyring using 'gpg --import'. For the dir:// transport, Podman verifies signatures using keys in the local GnuPG keyring, so the public key must be imported with 'gpg --import' into the user's keyring (or root's, depending on context). The signedBy field in policy.json references a key fingerprint that Podman looks up in that keyring during verification.

Answer

Into ~/.config/containers/policy.d/keys/

Answer

Into /etc/containers/certs.d/keys/

Answer

Into /var/lib/containers/sigstore/

Question 6

You are designing a container image that runs an executable web server. You want to provide default arguments to the executable that can be easily overridden by a user passing arguments directly to 'podman run'. Which instruction combination is best?

Accepted Answer

Use ENTRYPOINT for the binary and CMD for the default arguments.. Using ENTRYPOINT for the binary and CMD for the default arguments is the best practice. When a user runs 'podman run ', the arguments passed on the command line override the CMD instruction, while the ENTRYPOINT remains the executable. This allows the user to easily override default arguments without changing the binary.

Answer

Use ENV for the binary and WORKDIR for the arguments.

Answer

Use RUN for both the binary and the arguments.

Answer

Use CMD for the binary and ENTRYPOINT for the default arguments.

Question 7

A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?

Accepted Answer

It turns off SELinux separation and labeling for the container.. The '--security-opt label=disable' flag in Podman disables SELinux labeling for the container. This means that the container processes are not confined by SELinux policies, and the container can access files without SELinux context restrictions. This is often used when SELinux is causing permission issues, but it reduces security. The flag specifically turns off SELinux separation, not seccomp, user namespaces, or AppArmor.

Answer

It disables seccomp system call filtering.

Answer

It disables user namespace mapping.

Answer

It disables AppArmor enforcement.

Question 8

An administrator needs to create a persistent storage volume that Podman can manage independently of any specific container lifecycle. Which command accomplishes this?

Accepted Answer

podman volume create mydata. `podman volume create mydata` is the correct command to create a named volume that Podman manages independently of any container's lifecycle. Named volumes persist after containers are removed and can be mounted into multiple containers, making them ideal for persistent data. This is the direct Podman equivalent of `docker volume create`.

Answer

podman volume init mydata

Answer

podman storage volume-add mydata

Answer

podman create volume --name mydata

Question 9

Which TWO files or backend network management utilities are heavily relied upon by Podman for container networking stack configuration on modern Linux distributions? (Choose two.)

Accepted Answer

aardvark-dns. Option E, netavark, is correct because it is the default OCI container network backend for Podman on modern Linux distributions, responsible for setting up container network interfaces, bridges, and firewall rules. Option A, aardvark-dns, is correct because it is the authoritative DNS server that Podman relies on to provide name resolution between containers on the same network, working alongside netavark. Together, netavark and aardvark-dns replaced the older CNI-based stack as Podman's default networking solution. Option B, libnetwork, is incorrect because it is Docker's networking library, not Podman's backend. Option C, docker-proxy, is incorrect because it is a Docker component for port forwarding, not used by Podman. Option D, iptables-nft, is incorrect because although Podman may interact with nftables through netavark, iptables-nft itself is not a Podman-specific networking utility relied upon for stack configuration.

Answer

libnetwork

Answer

docker-proxy

Answer

iptables-nft

Question 10

An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?

Accepted Answer

[[registry]]
prefix = "registry.example.com"
location = "internal-mirror.example.com". Podman's `/etc/containers/registries.conf` uses TOML, and a registry block is defined with `[[registry]]` (an array of tables). The `prefix` field specifies the registry hostname to match, and `location` specifies the mirror to use instead, so `[[registry]]` with `prefix` and `location` is the correct syntax.

Answer

registry:
  name: registry.example.com
  mirror: internal-mirror.example.com

Answer

SERVER=registry.example.com
MIRROR=internal-mirror.example.com

Answer

[registry "registry.example.com"]
mirror = "internal-mirror.example.com"

Question 11

An administrator needs to attach to the terminal of a currently running container named backend_app to view its active console output interactively. Which command should be used?

Accepted Answer

podman attach backend_app. `podman attach` connects the current terminal's STDIN/STDOUT/STDERR to a running container's main process (PID 1), letting the administrator view live console output and interact with it. This is the direct equivalent of `docker attach` and is the correct tool for viewing an active console interactively.

Answer

podman console backend_app

Answer

podman connect backend_app

Answer

podman join backend_app

Question 12

Which TWO types of storage mechanisms are natively supported by Podman for container data persistence? (Choose two.)

Accepted Answer

Host bind mounts referencing directories on the host filesystem. Option B is correct because Podman natively supports host bind mounts, where a directory or file on the host filesystem is mapped directly into the container using the -v or --mount flag (e.g., -v /host/path:/container/path), making it a first-class persistence mechanism. Option D is correct because Podman also natively supports managed named volumes, which are created and tracked in Podman's own storage graph (typically under /var/lib/containers/storage/volumes for root or ~/.local/share/containers/storage/volumes for rootless users) and persist independently of container lifecycle. Option A is not a native Podman storage mechanism; NFS exports would have to be mounted on the host first and then exposed via a bind mount, and shared memory block devices are not a Podman persistence type. Option C is incorrect because direct Fibre Channel LUN mapping is a host-level storage concern handled by the OS, not something Podman natively provides to containers. Option E is incorrect because HDFS is a distributed filesystem service external to Podman and is not a natively supported container storage driver.

Answer

Shared memory block devices via NFS exports

Answer

Direct Fibre Channel LUN mapping inside containers

Answer

Distributed HDFS cluster mounts

Question 13

When writing a Containerfile, which instruction specifies the base image to be used for the subsequent build steps?

Accepted Answer

FROM. Every Containerfile must start with a FROM instruction to define the base image.

Answer

BASE

Answer

INIT

Answer

PARENT

Question 14

You are optimizing image build times and notice that a specific RUN instruction fetching dependencies is re-running on every build, even though the requirements.txt file has not changed. What is causing this behavior?

Accepted Answer

The COPY requirements.txt instruction was placed after an instruction that introduces non-deterministic data or the build context files have modified timestamps.. Docker/Podman layer caching invalidates a RUN layer when any preceding instruction's layer changes. If COPY requirements.txt comes after an instruction that produces non-deterministic output (e.g., a RUN that fetches latest packages or writes timestamps) or if build-context files have changed mtimes, the cache key for the COPY layer changes, invalidating all subsequent RUN layers including the dependency install.

Answer

The Containerfile lacks an explicit CACHE instruction at the top.

Answer

Podman disables caching by default for all RUN instructions containing package managers.

Answer

The USER instruction was set to root, which disables layer caching.

Question 15

An administrator wants to view a list of all running containers in a clean, tabular format without stopping containers or showing extra metadata. Which command should be used?

Accepted Answer

podman ps. podman ps lists running containers by default.

Answer

podman show running

Answer

podman list

Answer

podman containers

Question 16

You have created a Podman pod and want to launch two containers inside this pod so they share the same network namespace. How do you specify this during container creation?

Accepted Answer

podman run --pod mypod -d myimage. The --pod flag on podman run attaches a new container to an existing pod, and all containers in the same pod share the pod's network namespace (and by default its IPC and UTS namespaces). So podman run --pod mypod -d myimage launches the container inside the pod with shared networking. This is the standard way to add containers to a pod after the pod is created.

Answer

podman run --share-namespace mypod -d myimage

Answer

podman pod connect mypod myimage

Answer

podman run --network pod:mypod -d myimage

Question 17

A system administrator logs into a RHEL 9 server as a regular non-root user and executes 'podman ps'. The command succeeds, but no containers are displayed. What architecture feature enables this user to run containers without root privileges?

Accepted Answer

Linux user namespaces and subuid/subgid mapping. Rootless Podman relies on Linux user namespaces combined with subordinate UID/GID ranges defined in /etc/subuid and /etc/subgid. The user namespace maps the container's root (UID 0) to the unprivileged user's UID on the host, and additional container UIDs map into the allocated subuid/subgid ranges. This lets a non-root user run containers without any setuid daemon.

Answer

The Docker daemon running as a system service in user space

Answer

The systemd-logind setuid binary wrapper

Answer

SELinux multi-category security (MCS) translation tables

Question 18

An administrator needs to manage multiple containers simultaneously using Podman. Which THREE actions can be performed directly using Podman commands? (Choose THREE)

Accepted Answer

Stop all running containers using 'podman stop $(podman ps -q)'.. Option A is correct because 'podman stop $(podman ps -q)' uses command substitution: 'podman ps -q' returns the IDs of all running containers, and 'podman stop' then stops each of them in one command, enabling bulk management. Option D is correct because 'podman container prune' is a built-in Podman command that removes all stopped containers, which is a standard bulk cleanup action. Option E is correct because 'podman restart <container_name>' is a valid Podman command that restarts the specified container by name or ID. Option B is not valid because Podman has no 'podman edit --tag' command to directly edit a running container's image tag; image tags are managed with commands like 'podman tag' or 'podman build', not by editing a running container. Option C is not valid because Podman has no 'podman migrate' command to instantly move a running container to a remote physical server; container migration/checkpointing is handled by tools such as CRIU with 'podman container checkpoint' and 'podman container restore', not a simple 'migrate' subcommand.

Answer

Directly edit a running container's image tag using 'podman edit --tag'.

Answer

Instantly migrate a running container to a remote physical server using 'podman migrate'.

Question 19

An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?

Accepted Answer

/etc/containers/registries.conf using the unqualified-search-registries parameter. The /etc/containers/registries.conf file contains the unqualified-search-registries parameter, which lists registries to search when a user pulls an image without specifying a registry. Adding registry.access.redhat.com to this list allows podman pull rhel9 to automatically expand to registry.access.redhat.com/rhel9.

Answer

/etc/sysconfig/podman using the SEARCH_REGISTRIES variable

Answer

/etc/containers/registries.d/default.yaml using the search-domains parameter

Answer

~/.config/containers/auth.json using the default-registry key

Question 20

A developer needs to optimize image size by removing build caches and temporary package manager cache files within the same RUN instruction. Why must this be done in a single RUN instruction?

Accepted Answer

Because file deletions in separate layers do not reduce the final image size due to the layered filesystem.. Container images are built as a stack of immutable layers, and each RUN instruction creates a new layer. If files are created in one RUN and deleted in a later RUN, the deletion only adds a whiteout marker in the new layer; the original files remain in the earlier layer and still contribute to the final image size. Performing installation and cleanup in a single RUN ensures the temporary files never persist in any committed layer.

Answer

Because package managers lock the database across different layers.

Answer

Because the container build engine will fail if cache cleanup happens in a separate layer.

Answer

To ensure environment variables persist between installation and cleanup.