EX188 Practice Test 2 — 25 Questions

Question 1

An operator wants to create a custom user-defined bridge network named 'app-net' with a specific subnet of '192.168.100.0/24' using Podman. Which command is correct?

Accepted Answer

podman network create --subnet 192.168.100.0/24 app-net. 'podman network create --subnet 192.168.100.0/24 app-net' is the correct syntax: the '--subnet' flag specifies the CIDR, and the network name follows as the positional argument. This creates a user-defined bridge network with the specified subnet.

Answer

podman bridge create app-net --subnet 192.168.100.0/24

Answer

podman create network --ip 192.168.100.0/24 app-net

Answer

podman network new --subnet=192.168.100.0/24 app-net

Question 2

You need to configure container DNS servers explicitly when running a container, overriding the host's /etc/resolv.conf settings. Which Podman flag do you use?

Accepted Answer

--dns 8.8.8.8. The '--dns' flag on 'podman run' explicitly sets the DNS server(s) inside the container's /etc/resolv.conf, overriding what would otherwise be inherited from the host. Passing '--dns 8.8.8.8' makes the container use Google's public resolver for name lookups, regardless of the host's resolver configuration.

Answer

--resolv-conf custom

Answer

--nameserver 8.8.8.8

Answer

--dns-search 8.8.8.8

Question 3

By default, podman build executes build instructions using the root user. You want to switch the execution context to a non-privileged user named 'appuser' for all subsequent RUN, CMD, and ENTRYPOINT instructions. Which instruction should you use?

Accepted Answer

USER. The USER instruction in a Containerfile sets the UID (and optionally GID) that subsequent RUN, CMD, and ENTRYPOINT instructions execute as, and it also sets the default user for the running container. Placing USER appuser before the relevant instructions switches the execution context to that non-privileged account.

Answer

LOGIN

Answer

SU

Answer

ACCOUNT

Question 4

An administrator needs to view all network ports exposed or mapped by a container named web_prod using a simplified summary command. Which command can be used?

Accepted Answer

podman port web_prod. podman port is the dedicated subcommand that prints the port mappings (published and exposed) for a container in a compact, human-readable summary format. It mirrors docker port and is the intended tool when you want a quick listing rather than the full JSON dump from podman inspect.

Answer

podman show-ports web_prod

Answer

podman network list-ports web_prod

Answer

podman inspect --ports web_prod

Question 5

How do you check the logs of all services managed by a Podman Compose file?

Accepted Answer

podman-compose logs. 'podman-compose logs' displays log output from all services defined in the compose file.

Answer

podman-compose monitor

Answer

podman-compose output

Answer

podman logs --compose

Question 6

What is the primary benefit of utilizing multi-stage builds in Containerfiles?

Accepted Answer

It allows you to produce a final production image containing only the application binary and runtime dependencies, significantly reducing image size and attack surface.. Multi-stage builds allow developers to use multiple FROM statements, leaving behind build tools and heavy SDKs in earlier stages and keeping production images small and secure.

Answer

It automatically encrypts environment variables stored in the image layers.

Answer

It bypasses the need for a container registry when sharing images.

Answer

It speeds up local DNS resolution during container execution.

Question 7

An administrator has created a systemd service file named container-web.service using podman generate systemd. Where should this file be placed for a rootless user to manage it as a user-level service?

Accepted Answer

~/.config/systemd/user/. For rootless Podman containers, systemd user services must reside in the user's systemd configuration directory, which is ~/.config/systemd/user/. This allows the user to manage the service with systemctl --user commands without requiring root privileges. Placing the unit file here ensures it is loaded when the user's systemd instance starts, typically at login.

Answer

~/.local/share/podman/systemd/

Answer

/etc/systemd/system/

Answer

/var/lib/containers/systemd/

Question 8

An administrator is configuring a systemd service using podman generate systemd and wants the generated service to stop and remove the container automatically when the service stops, and create a fresh container when it starts. Which flag should be added?

Accepted Answer

--new. The --new flag in podman generate systemd creates a systemd unit that removes the existing container when the service stops and creates a fresh container when it starts. This ensures a clean state on each service start, which is useful for stateless or ephemeral workloads.

Answer

--ephemeral

Answer

--recreate

Answer

--auto-remove

Question 9

A developer wants to push a locally built container image named webapp:v1 to a private container registry located at registry.local:5000/myteam/. Which sequence of commands correctly tags and pushes the image?

Accepted Answer

podman tag localhost/webapp:v1 registry.local:5000/myteam/webapp:v1 followed by podman push registry.local:5000/myteam/webapp:v1. The correct workflow requires first creating a new tag that includes the full registry path (registry.local:5000/myteam/webapp:v1) pointing to the existing local image, then pushing that fully-qualified reference. The 'podman tag' command creates an additional name for the same image without copying layers, and 'podman push' uses the registry-qualified name to determine the destination. This two-step approach is required because podman push does not accept a separate --registry flag to redirect an existing local name.

Answer

podman push webapp:v1 --registry registry.local:5000/myteam/

Answer

podman commit webapp:v1 registry.local:5000/myteam/webapp:v1

Answer

podman export webapp:v1 > registry.local:5000/myteam/webapp:v1.tar

Question 10

An operator needs to troubleshoot a failing service inside a container named 'auth_api'. Which command should the operator run to view the standard output log stream generated by this container?

Accepted Answer

podman logs auth_api. The `podman logs` command retrieves the standard output (stdout) and standard error (stderr) logs from a container, exactly what the operator needs to troubleshoot the failing service. It works for both running and stopped containers, and supports options like `-f` to follow the stream in real time. This is the direct Podman equivalent of `docker logs`.

Answer

podman output auth_api

Answer

podman events auth_api

Answer

podman history auth_api

Question 11

An administrator needs to connect an already running container named 'web1' to an existing user-defined network named 'backend-net' without restarting the container. Which command accomplishes this?

Accepted Answer

podman network connect backend-net web1. The podman network connect command attaches a running container to an existing user-defined network without requiring a restart. Its syntax is 'podman network connect ', which matches option B. This is the supported way to add a live container to an additional network, and Podman updates the container's DNS and interfaces dynamically.

Answer

podman network attach backend-net web1

Answer

podman container modify --network backend-net web1

Answer

podman network join --container web1 backend-net

Question 12

An administrator needs to create a Podman secret from a file on disk named 'secret.txt'. Which command correctly performs this action?

Accepted Answer

podman secret create db_secret secret.txt. The correct syntax for creating a Podman secret from a file is `podman secret create `. Podman's secret subcommand mirrors Docker's `docker secret create` syntax, where the secret name comes first and the source file (or `-` for stdin) comes second. This command reads the file contents and stores them in Podman's secret store, making them available to containers via `--secret`.

Answer

podman secret import db_secret secret.txt

Answer

podman create secret db_secret secret.txt

Answer

podman secret add db_secret --file secret.txt

Question 13

An administrator needs to remove all stopped containers from the system to free up disk space in a single command. Which command should be used?

Accepted Answer

podman container prune. The podman container prune command removes all stopped containers in a single operation, freeing disk space and cleaning up the container runtime state. It is the purpose-built subcommand for this task and prompts for confirmation before deletion (unless --force is used). This is the correct and idiomatic Podman command for bulk removal of stopped containers.

Answer

podman rm stopped

Answer

podman system clean

Answer

podman rm --all

Question 14

An administrator wants to monitor real-time Podman system events, such as when containers are created, started, stopped, or removed, for auditing purposes. Which command should be executed?

Accepted Answer

podman events. The podman events command streams real-time events from the Podman service, including container create, start, stop, die, and remove actions, along with image and network events. It is the direct analog to 'docker events' and is the correct tool for auditing container lifecycle activity. Options like 'podman audit' and 'podman monitor' do not exist as Podman subcommands.

Answer

podman audit

Answer

podman system stream

Answer

podman monitor

Question 15

An administrator wants to ensure that a bind-mounted directory allows propagation of mounts from the host into the container. Which mount option configures mount propagation mode?

Accepted Answer

podman run -v /host/dir:/container/dir:shared myapp. The :shared mount option on a bind mount configures mount propagation mode to shared, allowing mounts performed on the host to propagate into the container (and vice versa). The syntax is -v /host/dir:/container/dir:shared, where shared is the propagation mode keyword.

Answer

podman run -v /host/dir:/container/dir:mtype=shared myapp

Answer

podman run -v /host/dir:/container/dir:sync myapp

Answer

podman run -v /host/dir:/container/dir:propagate myapp

Question 16

An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?

Accepted Answer

podman login registry.example.com. The correct command is `podman login registry.example.com` because it authenticates the user to the specified container registry, storing credentials in the local authentication file (typically `${XDG_RUNTIME_DIR}/containers/auth.json`). This step is required before any push operation to a private registry, as it establishes the necessary session and permissions. Without a successful login, `podman push` would fail with an authentication error.

Answer

podman push --auth registry.example.com

Answer

podman auth registry.example.com

Answer

podman connect registry.example.com

Question 17

In a Podman Compose file, how do you define a custom network and connect a service to it?

Accepted Answer

Define networks at the root level and reference them under each service configuration.. In a Podman Compose file, custom networks are declared under a top-level networks: block, and each service references the desired network(s) under its own networks: key. This two-part structure is required by the Compose specification: the root-level declaration defines the network (driver, options, external flag), and the service-level reference attaches the service to it. This is how Compose wires services into shared networks for name resolution and isolation.

Answer

Use the 'links:' directive inside the service block exclusively.

Answer

Add a 'network_mode' string directly pointing to an external shell script.

Answer

Configure networking exclusively via command-line environment variables.

Question 18

An administrator needs to copy a directory named /app/logs from a running container named prod_app to the local host directory /var/backups/. Which command accomplishes this?

Accepted Answer

podman cp prod_app:/app/logs /var/backups/. 'podman cp' copies files or directories between a container and the host, using the 'container:path' syntax to disambiguate the container side. 'podman cp prod_app:/app/logs /var/backups/' copies the directory from the running container to the host. It works on running containers and preserves the source path semantics.

Answer

podman export --path /app/logs prod_app /var/backups/

Answer

podman pull prod_app:/app/logs /var/backups/

Answer

podman download prod_app:/app/logs /var/backups/

Question 19

An administrator wants to run a one-off command (/bin/sh) interactively inside an existing running container named legacy_app. Which command should be used?

Accepted Answer

podman exec -it legacy_app /bin/sh. podman exec -it legacy_app /bin/sh runs a new process inside the already-running container with an interactive TTY, which is exactly what is needed for a one-off interactive shell. The -i keeps stdin open and -t allocates a pseudo-TTY.

Answer

podman run -it legacy_app /bin/sh

Answer

podman enter legacy_app /bin/sh

Answer

podman attach legacy_app --shell=/bin/sh

Question 20

An administrator needs to copy files between the host system and a running container. Which TWO syntax forms or commands are correct when using podman cp? (Choose TWO)

Accepted Answer

podman cp container_name:/app/file.txt host_file.txt. Option D is correct because podman cp follows the same source-then-destination syntax as docker cp, so copying a host file into a running container is expressed as `podman cp host_file.txt container_name:/app/file.txt`, where the container path is prefixed with the container name and a colon. Option C is correct because the reverse direction uses the same syntax with the container path as the source: `podman cp container_name:/app/file.txt host_file.txt` copies the file out of the container onto the host. The remaining options are invalid because podman cp does not support a `--target` flag (A), a `--direction` flag (B), or a `--from` flag (E); direction is determined solely by which operand contains the `container:` prefix.

Answer

podman cp --target=container_name host_file.txt /app/file.txt

Answer

podman cp --direction=to-container host_file.txt container_name:/app/

Answer

podman cp --from=container_name /app/file.txt host_file.txt