EX188 Practice Exam 3 — 20 Questions

Question 1

An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

podman login registry.example.com. The correct command is `podman login registry.example.com` because it authenticates the user to the specified container registry, storing credentials in the local authentication file (typically `${XDG_RUNTIME_DIR}/containers/auth.json`). This step is required before any push operation to a private registry, as it establishes the necessary session and permissions. Without a successful login, `podman push` would fail with an authentication error.

Answer

podman push --auth registry.example.com

Answer

podman auth registry.example.com

Answer

podman connect registry.example.com

Question 2

In a Podman Compose file, how do you define a custom network and connect a service to it?

Accepted Answer

Define networks at the root level and reference them under each service configuration.. In a Podman Compose file, custom networks are declared under a top-level networks: block, and each service references the desired network(s) under its own networks: key. This two-part structure is required by the Compose specification: the root-level declaration defines the network (driver, options, external flag), and the service-level reference attaches the service to it. This is how Compose wires services into shared networks for name resolution and isolation.

Answer

Use the 'links:' directive inside the service block exclusively.

Answer

Add a 'network_mode' string directly pointing to an external shell script.

Answer

Configure networking exclusively via command-line environment variables.

Question 3

An administrator needs to copy a directory named /app/logs from a running container named prod_app to the local host directory /var/backups/. Which command accomplishes this?

Accepted Answer

podman cp prod_app:/app/logs /var/backups/. 'podman cp' copies files or directories between a container and the host, using the 'container:path' syntax to disambiguate the container side. 'podman cp prod_app:/app/logs /var/backups/' copies the directory from the running container to the host. It works on running containers and preserves the source path semantics.

Answer

podman export --path /app/logs prod_app /var/backups/

Answer

podman pull prod_app:/app/logs /var/backups/

Answer

podman download prod_app:/app/logs /var/backups/

Question 4

An administrator wants to run a one-off command (/bin/sh) interactively inside an existing running container named legacy_app. Which command should be used?

Accepted Answer

podman exec -it legacy_app /bin/sh. podman exec -it legacy_app /bin/sh runs a new process inside the already-running container with an interactive TTY, which is exactly what is needed for a one-off interactive shell. The -i keeps stdin open and -t allocates a pseudo-TTY.

Answer

podman run -it legacy_app /bin/sh

Answer

podman enter legacy_app /bin/sh

Answer

podman attach legacy_app --shell=/bin/sh

Question 5

An administrator needs to copy files between the host system and a running container. Which TWO syntax forms or commands are correct when using podman cp? (Choose TWO)

Accepted Answer

podman cp container_name:/app/file.txt host_file.txt. Option D is correct because podman cp follows the same source-then-destination syntax as docker cp, so copying a host file into a running container is expressed as `podman cp host_file.txt container_name:/app/file.txt`, where the container path is prefixed with the container name and a colon. Option C is correct because the reverse direction uses the same syntax with the container path as the source: `podman cp container_name:/app/file.txt host_file.txt` copies the file out of the container onto the host. The remaining options are invalid because podman cp does not support a `--target` flag (A), a `--direction` flag (B), or a `--from` flag (E); direction is determined solely by which operand contains the `container:` prefix.

Answer

podman cp --target=container_name host_file.txt /app/file.txt

Answer

podman cp --direction=to-container host_file.txt container_name:/app/

Answer

podman cp --from=container_name /app/file.txt host_file.txt

Question 6

An administrator is using Podman Quadlets to manage containers via systemd. Where must the Quadlet .container configuration file be placed for system-wide root containers?

Accepted Answer

/etc/containers/systemd/. For system-wide root containers managed by Quadlets, the .container file must be placed in /etc/containers/systemd/. This directory is monitored by the podman-system-generator, which converts Quadlet files into systemd unit files at boot or on daemon-reload.

Answer

/etc/systemd/system/containers/

Answer

/var/lib/containers/systemd/quadlets/

Answer

/etc/systemd/system/

Question 7

You want to remove a custom Podman network named 'testnet', but it currently has active containers attached to it. What happens?

Accepted Answer

The deletion fails until all connected containers are stopped and disconnected.. Podman refuses to remove a network that has active containers attached to it; the deletion fails with an error indicating the network is in use. The administrator must first stop and disconnect all containers (or use podman network disconnect) before the network can be removed. This prevents silently breaking container connectivity and orphaned interfaces.

Answer

The network is removed, and the containers lose their network interface silently.

Answer

The containers are automatically disconnected and moved to the default bridge network.

Answer

The containers are automatically terminated and the network is removed.

Question 8

An administrator needs to execute multiple commands in a single RUN instruction to minimize image layers. Which syntax is standard in a Containerfile?

Accepted Answer

RUN dnf update -y && dnf install -y httpd. Combining commands using shell operators like && within a single RUN instruction reduces the total number of layers.

Answer

RUN ["dnf update -y", "dnf install -y httpd"]

Answer

RUN { dnf update -y; dnf install -y httpd; }

Answer

RUN dnf update -y 
 dnf install -y httpd

Question 9

Which environment file option can be used in a Podman Compose file to automatically load environment variables for service configuration?

Accepted Answer

env_file. In Podman Compose (and Docker Compose), the env_file key within a service definition specifies one or more files containing environment variables in KEY=VALUE format that are loaded into the container at runtime. This is the standard, documented way to inject environment variables from a file rather than listing them inline under environment:. Podman Compose implements this key for compatibility with the Compose specification.

Answer

environment_source

Answer

variables_file

Answer

load_env

Question 10

Which THREE statements correctly describe the differences between CMD and ENTRYPOINT in a Containerfile?

Accepted Answer

Combining ENTRYPOINT and CMD allows default arguments to be supplied while retaining override flexibility.. Option B is correct because when both ENTRYPOINT and CMD are used together, CMD supplies default arguments to the ENTRYPOINT executable, and those defaults can still be replaced by arguments passed at runtime to podman run. Option C is correct because ENTRYPOINT is specifically designed to set the image's main executable, making the container behave like a dedicated command such as /usr/bin/httpd or a custom application binary. Option D is correct because CMD provides defaults that are easily overridden: any arguments appended to podman run replace the CMD instruction entirely. Option A is incorrect because ENTRYPOINT can be overridden at runtime using podman run --entrypoint. Option E is incorrect because CMD and ENTRYPOINT serve different roles and have distinct syntax and behavior, especially regarding how runtime arguments interact with them.

Answer

ENTRYPOINT instructions cannot be overridden at runtime under any circumstances.

Answer

CMD and ENTRYPOINT perform identical functions with no syntactical differences.

Question 11

An administrator needs to execute a package update and install dependencies during the podman build process, ensuring these commands are committed as a new layer in the final image. Which instruction accomplishes this?

Accepted Answer

RUN. `RUN` executes a command during the image build and commits the resulting filesystem changes as a new layer in the image. Using `RUN dnf update -y && dnf install -y <deps>` performs the package update and dependency install at build time, baking the results into the final image.

Answer

EXEC

Answer

START

Answer

CMD

Question 12

An administrator wants to monitor resource usage (CPU, memory, block I/O, network I/O) of all running containers in real-time. Which command provides this functionality?

Accepted Answer

podman stats. podman stats displays real-time resource usage statistics (CPU, memory, block I/O, network I/O, and PIDs) for running containers, similar to docker stats. It continuously refreshes and can be filtered to specific containers. This is the direct command for live resource monitoring.

Answer

podman monitor resources

Answer

podman top

Answer

podman system df

Question 13

A security team requires that all container processes run with a specific SELinux type instead of the default container_t. How can an administrator specify a custom SELinux type when launching a container with 'podman run'?

Accepted Answer

--security-opt label=type:custom_t. The `--security-opt label=type:custom_t` flag tells Podman to apply the specified SELinux type to the container's processes instead of the default container_t. This is the correct syntax for overriding SELinux labels at container launch. The label=type: prefix is part of Podman's security-opt grammar for SELinux process labeling.

Answer

--selinux-type custom_t

Answer

--cap-add SELINUX

Answer

--env SELINUX_TYPE=custom_t

Question 14

An administrator is troubleshooting a container that fails its health check repeatedly. The container definition needs a health check that runs curl -f http://localhost/ || exit 1 every 30s, with a 5s timeout and 3 retries, starting after a 10s grace period. Which flag combination implements this correctly in podman run?

Accepted Answer

podman run --health-cmd="curl -f http://localhost/ || exit 1" --health-interval=30s --health-timeout=5s --health-retries=3 --health-start-period=10s webapp. The correct flag combination uses Podman's health check flags: --health-cmd for the command, --health-interval for the period, --health-timeout for the timeout, --health-retries for retry count, and --health-start-period for the initial grace period. Option C matches all required parameters exactly, including the '|| exit 1' failure semantics. Podman's health check system mirrors Docker's HEALTHCHECK instruction and uses these specific flag names.

Answer

podman run --healthcheck="curl -f http://localhost/" --interval=30 --timeout=5 --retries=3 webapp

Answer

podman run --health-probe="curl -f http://localhost/" --health-delay=10s webapp

Answer

podman run --check-command="curl -f http://localhost/" --check-period=30s webapp

Question 15

Which TWO actions are required when configuring a secure container workflow to push a signed image to a registry using Podman? (Choose two.)

Accepted Answer

Generate a cryptographic key pair and ensure the private key is available to sign the image.. Option D is correct because signing a container image with Podman requires a cryptographic key pair (typically created with `skopeo generate-sigstore-key` or a GPG key), and the private key must be accessible to the signing tool so it can produce the signature that is pushed alongside the image. Option E is correct because `/etc/containers/registries.d/` YAML files define the signature storage and transport configuration (for example `docker:` with `sigstore-staging:` or `lookaside-storage:`), telling Podman/Skopeo where signatures are stored and how they are associated with the registry so verification works after the push. Option A is wrong because disabling SELinux globally is neither required nor advisable for signing images; SELinux confinement is orthogonal to image signing. Option B is wrong because embedding the private signing key in the image payload would expose the key and defeat the purpose of signing. Option C is wrong because the `vfs` storage driver is a slow, non-overlay fallback and has no bearing on the signing or push workflow.

Answer

Disable SELinux enforcement globally on the container host before generating signatures.

Answer

Store the private signing key inside the container image payload.

Answer

Set the container storage driver to vfs in storage.conf.

Question 16

When publishing container ports using the Podman CLI, which THREE methods or syntaxes are valid for the -p / --publish flag? (Choose three)

Accepted Answer

-p 8080:80. Option A, `-p 8080:80`, is valid because the standard Podman/Docker publish syntax is `hostPort:containerPort`, mapping host port 8080 to container port 80 over the default TCP protocol. Option B, `-p 127.0.0.1:8080:80`, is valid because the full syntax `ip:hostPort:containerPort` binds the published port to a specific host interface (127.0.0.1) rather than all interfaces. Option E, `-p 8080:80/udp`, is valid because appending `/udp` (or `/tcp`) after the container port specifies the protocol for the published port. Option C is invalid because Podman does not accept the key=value form `container=80,host=8080` for `--publish`. Option D is invalid because the protocol must be appended with a slash (e.g., `8080:80/tcp`) and cannot be followed by an extra `:bind` field in that position.

Answer

-p container=80,host=8080

Answer

-p 80:8080:tcp:bind

Question 17

You want to create a Podman network with a specific subnet and gateway. Which command correctly specifies these parameters?

Accepted Answer

podman network create --subnet 192.168.200.0/24 --gateway 192.168.200.1 customnet. The `podman network create` command accepts `--subnet` to define the CIDR block and `--gateway` to set the gateway IP for the new network, with the network name as the positional argument at the end. Option A uses both flags correctly with valid syntax, creating a network named `customnet` on 192.168.200.0/24 with gateway 192.168.200.1. This is the canonical form documented in podman-network-create(1).

Answer

podman network create --ip-range 192.168.200.0/24 customnet

Answer

podman network new --subnet=192.168.200.0/24 customnet

Answer

podman network create customnet --network 192.168.200.0/24

Question 18

A user running rootless Podman wants to check the disk space consumed by images and containers in local storage. Which command provides this storage usage summary?

Accepted Answer

podman system df. podman system df reports disk usage for images, containers, volumes, and the build cache, similar to docker system df. It shows total, active, and reclaimable space, making it the correct command for a storage usage summary in rootless Podman. The output helps identify what can be pruned with podman system prune.

Answer

df -h podman

Answer

podman storage status

Answer

podman disk usage

Question 19

Which TWO methods can a user employ to verify that an image has been successfully downloaded to their local machine? (Choose two.)

Accepted Answer

Running 'podman image inspect ' to view its configuration metadata.. Option B is correct because 'podman image inspect ' returns the image's configuration metadata (such as its ID, layers, and creation details) from the local image store, which only succeeds if the image was actually downloaded and is present locally. Option E is correct because 'podman images' lists all images in local storage with their repository, tag, image ID, and size, so seeing the expected name and tag confirms the download completed. Option A is wrong because 'podman network ls' lists configured networks, not images, and has nothing to do with verifying a downloaded image. Option C is wrong because 'podman ps -a' lists containers (running and stopped), not image layers, so it cannot confirm an image download. Option D is wrong because 'podman volume inspect' reports on volumes, not image storage paths or downloaded images.

Answer

Running 'podman network ls' to verify image network attachment.

Answer

Running 'podman ps -a' to see the downloaded image layers.

Answer

Running 'podman volume inspect' to check image storage paths.

Question 20

An administrator needs to list all created Podman secrets on the system. Which command should they execute?

Accepted Answer

podman secret ls. The correct command to list all created Podman secrets is `podman secret ls`. Podman follows the same subcommand naming conventions as Docker, where `ls` is the standard alias for listing resources. The `podman secret` command group includes `create`, `inspect`, `ls`, and `rm`, so `podman secret ls` is the valid syntax to display all secrets stored in the system.

Answer

podman secret list

Answer

podman secrets ls

Answer

podman system secrets