EX188 Practice Exam 4 — 20 Questions

Question 1

A user needs to download an image from Docker Hub named 'library/alpine' using its explicit transport prefix. Which command demonstrates the correct transport syntax?

Accepted Answer

podman pull docker://alpine:latest. Podman supports explicit transport prefixes like docker://.

Answer

podman pull registry://alpine:latest

Answer

podman pull remote://alpine:latest

Answer

podman pull OCI://alpine:latest

Question 2

You need to copy local application source code from your build context into the /app directory inside the container image, automatically unpacking it if it is a local tar archive. Which instruction should you select?

Accepted Answer

ADD. The ADD instruction copies new files, directories, or remote file URLs from and adds them to the filesystem of the container at the path . A key feature distinguishing ADD from COPY is its ability to automatically extract local tar archives.

Answer

FETCH

Answer

TRANSFER

Answer

COPY

Question 3

An administrator is integrating Podman containers with systemd using generated unit files. Which TWO statements are correct regarding podman generate systemd and its usage? (Choose TWO)

Accepted Answer

The --new flag ensures that the generated service creates a new container instance upon starting rather than requiring a pre-existing static container.. podman generate systemd creates systemd unit files, and the --new flag ensures unit files create fresh containers on startup rather than relying on existing static container names.

Answer

Running systemctl daemon-reload is unnecessary after generating a unit file because Podman reloads systemd automatically.

Answer

Generated systemd files for rootless users must always be placed in /etc/systemd/system/.

Answer

Generated systemd unit files are executed exclusively by Docker daemon integration.

Question 4

An administrator wants to monitor real-time Podman system events, such as when containers are created, started, stopped, or removed, for auditing purposes. Which command should be executed?

Accepted Answer

podman events. The 'podman events' command streams real-time events from the Podman system.

Answer

podman audit

Answer

podman system stream

Answer

podman monitor

Question 5

An organization enforces that all container images must be signed using a local GPG key before they can be deployed in production. Which command generates a signature for an image stored in local storage using a specific signing key?

Accepted Answer

podman image sign --sign-by <key_id> registry.example.com/app:latest. 'podman image sign' is used to sign images for verification policies.

Answer

podman push --sign-by <key_id> app:latest

Answer

podman gpg --sign app:latest

Answer

podman sign --key <key_id> app:latest

Question 6

When configuring a secure private registry that uses a self-signed TLS certificate, a user receives an x509 certificate signed by an unknown authority error when pulling images. Where should the CA certificate file be placed on a RHEL system for system-wide trust?

Accepted Answer

/etc/containers/certs.d/registry.example.com/ca.crt. Custom CA certificates for registries are placed in /etc/containers/certs.d/<registry-name>/ or /etc/docker/certs.d/.

Answer

/etc/pki/ca-trust/source/anchors/registry.crt

Answer

/usr/share/pki/trust/anchors/ca.crt

Answer

~/.config/containers/certs.d/ca.crt

Question 7

An administrator wants to prevent users from pulling images from any registry except 'registry.access.redhat.com'. Where should this restriction be configured?

Accepted Answer

/etc/containers/registries.conf under 'unqualified-search-registries' and blocked registries lists. Registry blocking is configured in /etc/containers/registries.conf using the unqualified-search-registries or blocked registries directives.

Answer

/etc/containers/policy.json under 'default' block rules

Answer

/etc/containers/storage.conf under 'block-pull'

Answer

~/.config/containers/access.conf

Question 8

An administrator wants to inspect the container storage configuration settings, such as graph root and storage driver, on a RHEL system. Which configuration file should they examine?

Accepted Answer

/etc/containers/storage.conf. Storage settings for containers are defined in /etc/containers/storage.conf.

Answer

/etc/containers/podman.conf

Answer

/etc/containers/registries.conf

Answer

/etc/sysconfig/docker

Question 9

An administrator wants to check container port mappings and process listings inside containers. Which TWO commands provide these insights? (Choose TWO)

Accepted Answer

podman port. podman port shows port mappings and podman top shows running processes.

Answer

podman ps-ports

Answer

podman processes

Answer

podman netstat

Question 10

You are designing a container image that runs an executable web server. You want to provide default arguments to the executable that can be easily overridden by a user passing arguments directly to 'podman run'. Which instruction combination is best?

Accepted Answer

Use ENTRYPOINT for the binary and CMD for the default arguments.. ENTRYPOINT should define the executable, and CMD should define the default parameters that can be overridden easily when running the container.

Answer

Use ENV for the binary and WORKDIR for the arguments.

Answer

Use RUN for both the binary and the arguments.

Answer

Use CMD for the binary and ENTRYPOINT for the default arguments.

Question 11

An application container requires multiple configuration variables defined in a local file named 'app.env'. Which flag loads these variables into the container environment?

Accepted Answer

podman run --env-file app.env myapp. The --env-file flag reads environment variables line by line from the specified file and passes them into the container.

Answer

podman run --config-file app.env myapp

Answer

podman run -e @app.env myapp

Answer

podman run --load-env app.env myapp

Question 12

Which TWO settings or files are critical when configuring rootless Podman environments on RHEL 9? (Choose two.)

Accepted Answer

/etc/subuid and /etc/subgid for user namespace allocations.. Rootless Podman relies on subordinate UIDs/GIDs in /etc/subuid and /etc/subgid, and user configurations in ~/.config/containers/.

Answer

/etc/selinux/config for enforcing SELinux mode.

Answer

/etc/sudoers for root privileges.

Answer

/etc/shadow for root password hashes.

Question 13

A containerized web service must be accessible from the host system on TCP port 8080, while the application inside the container listens on port 80. Which flag correctly configures this port mapping?

Accepted Answer

-p 8080:80. The format for the --publish or -p flag is host_port:container_port. Thus, -p 8080:80 maps host port 8080 to container port 80.

Answer

--expose 8080:80

Answer

-p 80:8080

Answer

--port-map 8080=80

Question 14

A developer wants to search for all available container images matching the term 'rhel9' across configured registries using Podman. Which command should they run?

Accepted Answer

podman search rhel9. 'podman search' queries configured registries for matching images.

Answer

podman find rhel9

Answer

podman query rhel9

Answer

podman lookup rhel9

Question 15

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

Accepted Answer

:Z. The ':Z' suffix assigns a private unshared SELinux label to the volume.

Answer

:z

Answer

:private

Answer

:seclabel

Question 16

Which TWO conditions are typically required for rootless container users to successfully map UIDs and GIDs from host accounts to container accounts? (Choose two.)

Accepted Answer

The user account must have assigned ranges in /etc/subuid and /etc/subgid.. Rootless UID/GID mapping requires entries in /etc/subuid and /etc/subgid, and support from user namespaces.

Answer

The user must have root privileges via sudo on the host system.

Answer

The storage driver must be set to vfs exclusively.

Answer

SELinux must be set to disabled mode globally.

Question 17

An administrator runs a container with a SELinux-relabeled host directory mount using the Z option, but multiple containers need to share write access to this exact same volume. Which option should be used instead?

Accepted Answer

podman run -v /host/data:/data:z. The z option (lowercase z) shares SELinux content among multiple containers, whereas Z (uppercase Z) treats the content as private and unshared.

Answer

podman run -v /host/data:/data:O

Answer

podman run -v /host/data:/data:Z

Answer

podman run -v /host/data:/data:shared

Question 18

When inspecting the networking of a container using 'podman inspect', where is the IP address of the container located in the output JSON structure?

Accepted Answer

NetworkSettings.IPAddress. The NetworkSettings.IPAddress field contains the IPv4 address assigned to the container on its default network.

Answer

HostConfig.PortBindings.IP

Answer

Config.Network.IP

Answer

State.Networking.Address

Question 19

A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?

Accepted Answer

Rootless containers cannot use the :Z or :z SELinux volume options because rootless Podman runs inside a user namespace where process MCS labeling is restricted.. In rootless mode, the underlying user namespace maps the user to a UID/GID range on the host, but the SELinux sandbox limitations in older kernels or certain rootless configurations prevent standard multi-category security (MCS) label translation for shared volumes unless configured correctly. Specifically, the correct SELinux handling for rootless containers using shared volumes often requires relying on the user's process label or using the ':disable' suffix if SELinux is not enforcing within the namespace.

Answer

Rootless containers automatically disable SELinux enforcement for all mounted volumes, bypassing container isolation.

Answer

The SELinux policy enforcement level must be set to permissive globally across the entire RHEL host.

Answer

The host directory must be owned by the root user before mounting into a rootless container.

Question 20

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

Accepted Answer

podman load -i app.tar. 'podman load' imports an image from a tar archive.

Answer

podman import app.tar

Answer

podman restore -i app.tar

Answer

podman read app.tar