EX188 Practice Exam 4 — 20 Questions

Question 1

How can an administrator remove an existing Podman secret named 'old_secret'?

Accepted Answer

podman secret rm old_secret. The correct Podman command to remove a secret is 'podman secret rm <name>'. Podman's secret subcommand follows the same verb pattern as other resource subcommands (rm for remove), so 'podman secret rm old_secret' deletes the named secret from Podman's secret store.

Answer

podman rm secret old_secret

Answer

podman secret delete old_secret

Answer

podman secret remove old_secret

Question 2

An auditor reviewing your Containerfile notices an EXPOSE instruction for port 80. What is the primary function of the EXPOSE instruction?

Accepted Answer

It documents which ports the container listens on at runtime.. The EXPOSE instruction in a Containerfile is purely metadata — it documents the port the containerized application listens on, so tools like podman and image consumers know which port to publish. It does not actually open, publish, or firewall the port; the operator must still use -p or -P at runtime to map it to a host port.

Answer

It opens firewall ports on the underlying RHEL host system permanently.

Answer

It encrypts network traffic entering the specified container port.

Answer

It automatically publishes all exposed ports to random host ports without flags.

Question 3

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

Accepted Answer

podman load -i app.tar. The podman load command reads a container image from a tar archive and imports it into local container storage. The -i flag specifies the input file, so podman load -i app.tar loads the image from app.tar. This is the standard way to restore an image previously saved with podman save.

Answer

podman import app.tar

Answer

podman restore -i app.tar

Answer

podman read app.tar

Question 4

A user needs to remove a local container image that is no longer needed. Which command should be used?

Accepted Answer

podman rmi image_name. `podman rmi` is the dedicated image-removal subcommand; it accepts an image name or ID and deletes the local image from container storage. It is the Podman equivalent of `docker rmi` and is the canonical command documented for removing images.

Answer

podman image delete image_name

Answer

podman rm image_name

Answer

podman delete image_name

Question 5

A developer has written a Containerfile with multiple COPY instructions for static configuration files that change frequently, placed near the top of the Containerfile before the application code installation. Why is this considered a bad practice for build caching?

Accepted Answer

It invalidates the build cache for all subsequent instructions whenever those configuration files change, slowing down builds.. Changing a file earlier in the Containerfile invalidates the cache for all subsequent instructions, forcing unnecessary rebuilds of heavy steps.

Answer

It violates OCI container image specification limits on COPY counts.

Answer

It causes the ENTRYPOINT instruction to fail at runtime.

Answer

It causes Podman to store duplicate layers in local storage, exhausting disk space.

Question 6

Which TWO Containerfile instructions are used to bring files or data from outside the container into the build context or image? (Choose two.)

Accepted Answer

COPY. COPY is correct because it copies files or directories from the build context (or from a stage in a multi-stage build via --from) into the image filesystem, and it does not perform any remote URL fetching or automatic archive extraction. ADD is correct because it also brings files into the image, and additionally supports fetching remote URLs and auto-extracting recognized local tar archives into the destination. GET, FETCH, and IMPORT are not valid Containerfile/Dockerfile instructions, so they cannot be used to bring files or data into the build context or image.

Answer

GET

Answer

FETCH

Answer

IMPORT

Question 7

An administrator needs to create a persistent storage area managed completely by Podman that does not rely on a specific host directory path. Which command should be used?

Accepted Answer

podman volume create my_data. podman volume create my_data creates a named volume managed by Podman's volume driver, which stores data in a Podman-controlled location (e.g., ~/.local/share/containers/storage/volumes for rootless) rather than a user-specified host path. This is exactly what the question asks for: persistent storage managed by Podman without relying on a specific host directory.

Answer

podman volume bind my_data

Answer

podman run -v /my_data

Answer

podman create volume my_data

Question 8

Which THREE commands are valid when inspecting or managing Podman storage volumes? (Choose THREE)

Accepted Answer

podman volume inspect. Option B, `podman volume inspect`, is correct because it is the standard subcommand for retrieving detailed JSON metadata about a named volume, including its mountpoint, driver, labels, and options. Option C, `podman volume rm`, is correct because it removes one or more volumes from Podman storage, optionally with `--force` to remove volumes in use. Option D, `podman volume create`, is correct because it is the canonical command for creating a new named volume, supporting flags such as `--driver`, `--label`, and `--opt`. Option A, `podman volume modify`, is not a valid Podman subcommand (unlike `podman volume` operations such as `ls`, `prune`, or `exists`), and Option E, `podman volume edit`, also does not exist; Podman has no built-in volume editing command, so volume attributes must be changed by recreating the volume or using supported flags at creation time.

Answer

podman volume modify

Answer

podman volume edit

Question 9

Which TWO actions can be performed using the podman volume management command suite? (Choose two.)

Accepted Answer

Display detailed low-level configuration of a volume using podman volume inspect. Option B is correct because `podman volume inspect` is a real subcommand of the `podman volume` suite that outputs detailed low-level JSON configuration for a named volume, including its mountpoint, driver, labels, and options. Option E is correct because `podman volume prune` is a valid subcommand that removes all volumes not currently referenced by any container, freeing unused storage. Option A is incorrect because there is no `podman volume resize` subcommand; volume size limits are not managed that way in Podman. Option C is incorrect because `podman volume encrypt` does not exist; Podman does not provide a volume-encryption subcommand in its volume suite. Option D is incorrect because `podman volume convert` is not a real subcommand and bind mounts cannot be converted into named volumes via the volume management suite.

Answer

Modify the size limit of an existing volume using podman volume resize

Answer

Encrypt a managed volume at rest using podman volume encrypt

Answer

Convert a bind mount to a named volume using podman volume convert

Question 10

An administrator wants to temporarily pause a running container's processes and later resume them. Which TWO commands should be used? (Choose TWO)

Accepted Answer

podman unpause. Option B, podman pause, is correct because it suspends all processes in a running container by sending SIGSTOP via the freezer cgroup, leaving the container intact so it can be resumed later. Option A, podman unpause, is correct because it reverses that state by sending SIGCONT through the freezer cgroup, allowing the previously paused processes to continue running. Together these two commands implement the temporary pause-and-resume workflow the administrator needs. Option C, podman freeze, is not a valid Podman command for this purpose, and option D, podman resume, is likewise not a real Podman subcommand. Option E, podman stop, is incorrect because it terminates the container's processes rather than temporarily suspending them, so the container could not simply be resumed.

Answer

podman freeze

Answer

podman resume

Answer

podman stop

Question 11

Which TWO commands are used to manage Podman secrets? (Choose TWO)

Accepted Answer

podman secret create. Option A, `podman secret create`, is correct because it is the command used to create a new secret in Podman's secret store, reading the secret value from a file or stdin and registering it under a given name for later use by containers. Option D, `podman secret ls`, is correct because it lists all secrets currently stored in the Podman secret store, allowing administrators to verify which secrets exist. The other options are not valid Podman subcommands: `podman secret compile`, `podman secret update`, and `podman secret modify` do not exist in Podman's CLI, so they cannot be used to manage secrets.

Answer

podman secret compile

Answer

podman secret update

Answer

podman secret modify

Question 12

An administrator is troubleshooting container exit codes and low-level state details. Which TWO of the following inspect format expressions correctly extract container state attributes? (Choose TWO)

Accepted Answer

podman inspect --format='{{.State.StartedAt}}' container_name. Option B is correct because podman inspect exposes the container's low-level state under the .State object, and .State.StartedAt is the valid field holding the container start timestamp. Option E is correct because the container exit code is stored at .State.ExitCode in the inspect JSON, so this Go-template expression properly extracts the exit status the administrator is troubleshooting. Option A is wrong because .Metadata.ExitCode does not exist in podman inspect output; exit codes live under .State, not .Metadata. Option C is wrong because .Status.Running is not a valid path — running state is reported via .State.Running. Option D is wrong because there is no top-level .Exit field; the exit code must be referenced as .State.ExitCode.

Answer

podman inspect --format='{{.Metadata.ExitCode}}' container_name

Answer

podman inspect --format='{{.Status.Running}}' container_name

Answer

podman inspect --format='{{.Exit}}' container_name

Question 13

Which THREE of the following are valid options or flags when working with Podman secrets? (Choose THREE)

Accepted Answer

podman secret rm. Option B, `podman secret rm`, is a valid Podman subcommand used to remove one or more existing secrets from Podman's secret store, so it correctly belongs to the `podman secret` command family. Option C, `podman secret ls`, is also valid because it lists all secrets currently managed by Podman, optionally with formatting or filtering flags. Option E, `podman secret create`, is valid as the primary command for creating a new secret from a file or standard input, which is the core operation for Podman secrets. The unmarked options do not belong: `podman secret extract` (A) is not a Podman secret subcommand, and `podman secret compile` (D) is likewise not a recognized Podman secret operation.

Answer

podman secret extract

Answer

podman secret compile

Question 14

Which THREE storage-related items can be inspected using 'podman system df'? (Choose THREE)

Accepted Answer

Images. The 'podman system df' command reports disk usage for the storage-related resources that Podman manages, and its output lists Images (B), Containers (C), and Volumes (D) with their total, active, and reclaimable sizes. Images (B) are included because Podman tracks the space consumed by locally stored image layers and their shared parents. Containers (C) are included because each container's writable layer occupies storage on disk. Volumes (D) are included because named volumes persist data outside the container layer and their disk consumption is reported. Networks (A) and Secrets (E) are not storage-usage items reported by 'podman system df'; networks are runtime/network configuration and secrets are managed credential objects, neither of which appears in this command's output.

Answer

Networks

Answer

Secrets

Question 15

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

Accepted Answer

:Z. The `:Z` suffix applies a private, unshared SELinux label to the volume mount, meaning the content is exclusively accessible by that single container. This is appropriate when the host directory should not be shared with other containers, as it relabels the content with a unique MCS category.

Answer

:z

Answer

:private

Answer

:seclabel

Question 16

You need to copy local application source code from your build context into the /app directory inside the container image, automatically unpacking it if it is a local tar archive. Which instruction should you select?

Accepted Answer

ADD. The ADD instruction in a Containerfile (Dockerfile) copies files from the build context into the image, and it has the additional feature of automatically unpacking local tar archives and fetching remote URLs. The COPY instruction only copies files and directories without unpacking or fetching. Therefore, ADD is the correct choice when you need to unpack a local tar archive into the image.

Answer

FETCH

Answer

TRANSFER

Answer

COPY

Question 17

A developer wants to build a container image using podman build, but the Containerfile is named 'Customfile' and located in a subdirectory named 'dockerfiles'. Which command accomplishes this?

Accepted Answer

podman build -f dockerfiles/Customfile .. The `podman build` command uses the `-f` or `--file` flag to specify an alternative Containerfile. The correct syntax is `podman build -f dockerfiles/Customfile .`, where the path to the Containerfile is given relative to the current directory, and the build context is the current directory (`.`).

Answer

podman build --file-path dockerfiles/Customfile .

Answer

podman build -p dockerfiles/Customfile .

Answer

podman build --config dockerfiles/Customfile .

Question 18

When writing a Containerfile, what is the difference between shell form and exec form for the CMD instruction?

Accepted Answer

Exec form runs the executable directly without invoking a shell, making it receive Unix signals (like SIGTERM) properly as PID 1.. Exec form (JSON array syntax, e.g., CMD ["executable","arg1"]) runs the executable directly without a shell, so the process becomes PID 1 and receives Unix signals such as SIGTERM directly, enabling graceful shutdown. Shell form (CMD command arg1) wraps the command in /bin/sh -c, so the shell becomes PID 1 and may not forward signals to the child process. This distinction is critical for container lifecycle management.

Answer

There is no functional difference; they are syntactic aliases.

Answer

Shell form is required for multi-stage builds, while exec form is for single-stage builds.

Answer

Shell form runs the command as PID 1, while exec form spawns a bash shell wrapper.

Question 19

An administrator is managing rootless containers and wants to enable systemd linger for their user account so that user-level container services continue running after the user logs out. Which command should be run?

Accepted Answer

loginctl enable-linger. The loginctl enable-linger command (optionally with a username) enables systemd linger for a user, which keeps that user's systemd instance and its user services running after the user logs out. This is essential for rootless Podman containers managed as systemd user services (via podman generate systemd or Quadlet) to survive logout and start at boot. Running loginctl enable-linger $USER is the canonical way to enable this.

Answer

systemctl enable --user --linger

Answer

podman system linger enable

Answer

usermod --linger=true $USER

Question 20

An administrator needs to inspect container health check logs to determine why recent health checks failed for a container named app_prod. Which command displays the container's health check log history?

Accepted Answer

podman inspect --format='{{json .State.Health.Log}}' app_prod. inspecting State.Health.Log within podman inspect shows recent health check execution details and error outputs.

Answer

podman logs --health app_prod

Answer

podman health-log app_prod

Answer

podman events --health app_prod