EX188 Practice Exam 3 — 20 Questions

Question 1

An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/etc/containers/registries.conf using the unqualified-search-registries parameter. Unqualified search registries are configured in /etc/containers/registries.conf using the unqualified-search-registries array parameter.

Answer

/etc/sysconfig/podman using the SEARCH_REGISTRIES variable

Answer

/etc/containers/registries.d/default.yaml using the search-domains parameter

Answer

~/.config/containers/auth.json using the default-registry key

Question 2

An administrator needs to pause all processes inside a running container named db_master without stopping it. Which command accomplishes this?

Accepted Answer

podman pause db_master. podman pause suspends all processes in the specified container.

Answer

podman suspend db_master

Answer

podman freeze db_master

Answer

podman hold db_master

Question 3

You are optimizing a Containerfile using multi-stage builds to minimize image size. What is the key advantage of a multi-stage build in Podman?

Accepted Answer

It allows you to copy only finalized artifacts from a heavy build stage into a minimal production stage.. Multi-stage builds allow you to use multiple FROM instructions in a single Containerfile. Each FROM instruction starts a new stage with a different base, and you can copy artifacts from previous stages into the final stage, leaving behind build tools, compilers, and SDKs.

Answer

It automatically converts Dockerfiles into systemd service units.

Answer

It enables building container images concurrently across multiple remote container registries.

Answer

It eliminates the need for caching layers during the podman build process.

Question 4

When creating multi-architecture container images using podman build, how can you ensure that architecture-specific binaries are correctly handled when using instructions like COPY?

Accepted Answer

By running podman build separately for each architecture and combining them with podman manifest.. Podman supports building for multiple architectures using buildah/podman features, where TARGETPLATFORM, TARGETOS, and TARGETARCH build args are automatically available.

Answer

By setting the ARCH environment variable in the base image.

Answer

By manually editing the Containerfile to include architecture-specific IF/ELSE statements.

Question 5

A security team requires that all container processes run with a specific SELinux type instead of the default container_t. How can an administrator specify a custom SELinux type when launching a container with 'podman run'?

Accepted Answer

--security-opt label=type:custom_t. The '--security-opt' flag can be used to set custom SELinux labels (e.g., label=type:custom_t).

Answer

--selinux-type custom_t

Answer

--cap-add SELINUX

Answer

--env SELINUX_TYPE=custom_t

Question 6

Which TWO commands display information about container images present in local Podman storage? (Choose two.)

Accepted Answer

podman image inspect. 'podman images' and 'podman image inspect' display local image information.

Answer

podman container list

Answer

podman ps

Answer

podman volume ls

Question 7

An administrator needs to run a container that requires access to the host's network stack directly, bypassing network isolation. Which flag should be passed to 'podman run'?

Accepted Answer

--network host. Passing '--net=host' or '--network=host' disables network namespace isolation.

Answer

--share network

Answer

--privileged

Answer

--net bridge

Question 8

An administrator wants to immediately stop and remove a running container named temp_test in a single command. Which command should be used?

Accepted Answer

podman rm -f temp_test. The --rm flag with run automatically removes containers upon exit, but to remove an existing running container immediately, podman rm with -f can be used.

Answer

podman kill --remove temp_test

Answer

podman delete --force temp_test

Answer

podman stop --rm temp_test

Question 9

An administrator wants to view real-time container lifecycle events across the entire Podman system, such as container creation, starting, and stopping. Which command should be executed?

Accepted Answer

podman events. The podman events command monitors container events in real time.

Answer

podman monitor --stream

Answer

podman logs --follow --events

Answer

podman system trace

Question 10

An administrator needs to update the CPU shares (cpu-shares) of a running container named compute_job on the fly without stopping it. Which command should be used?

Accepted Answer

podman update --cpu-shares 512 compute_job. podman update modifies container configuration resources on a running container.

Answer

podman config compute_job cpu-shares=512

Answer

podman modify --cpu-shares 512 compute_job

Answer

podman set --shares=512 compute_job

Question 11

Which THREE actions occur when an administrator runs a container with an SELinux volume mount suffix ':Z'? (Choose three.)

Accepted Answer

The host path's SELinux context is altered to match the container's private category.. The ':Z' suffix labels the content with a private SELinux context, modifies the host file context if necessary, and ensures isolation from other containers.

Answer

The SELinux enforcement mode on the host is temporarily set to permissive.

Answer

The host directory becomes completely read-only across all namespaces.

Question 12

Which THREE characteristics describe Podman named volumes compared to bind mounts? (Choose THREE)

Accepted Answer

Stored within Podman's designated storage directory on the host. Named volumes are managed by Podman, stored in container storage areas, and persist independently of host path structures.

Answer

Must always point to pre-existing host directories

Answer

Require absolute paths on the host system during creation

Question 13

When using the '--mount' flag, what parameter specifies the type of mount being performed (e.g., bind, volume, tmpfs)?

Accepted Answer

type=. The 'type=' key specifies whether the mount is a bind, volume, or tmpfs mount.

Answer

kind=

Answer

method=

Answer

mount-type=

Question 14

When using the ADD instruction with a remote URL source, what is a recommended best practice regarding security and layer efficiency?

Accepted Answer

Avoid ADD for remote URLs; instead, use curl or wget within a RUN instruction to download, extract, and clean up in a single layer.. Downloading remote archives or files via ADD does not allow caching effectively, and it's generally recommended to use curl or wget inside a RUN instruction combined with cleanup to keep images lean and secure.

Answer

Always use ADD for remote URLs because it automatically verifies SSL/TLS certificates against the host system store.

Answer

ADD for remote URLs is deprecated and will cause podman build to abort with an error.

Answer

Use ADD for remote URLs because it creates a smaller layer than RUN.

Question 15

A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?

Accepted Answer

/etc/containers/policy.json. The signature verification policy is defined in /etc/containers/policy.json.

Answer

/etc/containers/signatures.yaml

Answer

~/.config/containers/policy.json

Answer

/etc/containers/registries.conf

Question 16

Which THREE methods or options can be used to authenticate or supply credentials when pulling images from a private registry that requires authentication? (Choose three.)

Accepted Answer

Running 'podman login' beforehand to store credentials in auth.json.. Authentication can occur via interactive 'podman login', passing credentials on the CLI, or referencing a stored auth file.

Answer

Setting the environment variable 'PODMAN_PASSWORD' without any login command.

Answer

Passing '--password-stdin' directly to 'podman pull'.

Question 17

An administrator wants to configure Podman to pull images using a specific TLS client certificate for mutual TLS authentication against a secure private registry. Where should the client certificate and private key be placed?

Accepted Answer

/etc/containers/certs.d/registry.example.com/ (with client.cert and client.key). Client certificates and keys are placed in /etc/containers/certs.d/<registry-name>/.

Answer

~/.config/containers/tls/

Answer

/etc/pki/tls/private/

Answer

/etc/containers/auth.d/

Question 18

An administrator needs to manage container lifecycles in Podman. Which TWO of the following commands can be used to start an existing, stopped container? (Choose TWO)

Accepted Answer

podman start. podman start and podman restart (which starts a stopped or running container) can be used to start stopped containers. podman run creates a new container, and podman exec runs commands in running containers.

Answer

podman exec

Answer

podman run

Answer

podman up

Question 19

A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?

Accepted Answer

It turns off SELinux separation and labeling for the container.. The '--security-opt label=disable' flag disables SELinux separation for that specific container.

Answer

It disables seccomp system call filtering.

Answer

It disables user namespace mapping.

Answer

It disables AppArmor enforcement.

Question 20

A container administrator needs to download an image named rhel9/httpd-24 from the Red Hat Ecosystem Catalog using Podman, but requires local authorization without interactive password prompts. Which file should the administrator configure to store these registry credentials in base64-encoded format?

Accepted Answer

~/.config/containers/auth.json. Podman uses the standard Docker-compatible auth configuration file located at $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json to store base64-encoded credentials for registry authentication.

Answer

~/.local/share/containers/storage/mounts

Answer

/etc/containers/registries.conf

Answer

/etc/sysconfig/podman