EX188 Practice Test 3 — 25 Questions

Question 1

Which THREE actions occur when an administrator runs a container with an SELinux volume mount suffix ':Z'? (Choose three.)

Accepted Answer

The host path's SELinux context is altered to match the container's private category.. The ':Z' suffix labels the content with a private SELinux context, modifies the host file context if necessary, and ensures isolation from other containers.

Answer

The SELinux enforcement mode on the host is temporarily set to permissive.

Answer

The host directory becomes completely read-only across all namespaces.

Question 2

Which THREE characteristics describe Podman named volumes compared to bind mounts? (Choose THREE)

Accepted Answer

Stored within Podman's designated storage directory on the host. Named volumes are managed by Podman, stored in container storage areas, and persist independently of host path structures.

Answer

Must always point to pre-existing host directories

Answer

Require absolute paths on the host system during creation

Question 3

When using the '--mount' flag, what parameter specifies the type of mount being performed (e.g., bind, volume, tmpfs)?

Accepted Answer

type=. The 'type=' key specifies whether the mount is a bind, volume, or tmpfs mount.

Answer

kind=

Answer

method=

Answer

mount-type=

Question 4

When using the ADD instruction with a remote URL source, what is a recommended best practice regarding security and layer efficiency?

Accepted Answer

Avoid ADD for remote URLs; instead, use curl or wget within a RUN instruction to download, extract, and clean up in a single layer.. Downloading remote archives or files via ADD does not allow caching effectively, and it's generally recommended to use curl or wget inside a RUN instruction combined with cleanup to keep images lean and secure.

Answer

Always use ADD for remote URLs because it automatically verifies SSL/TLS certificates against the host system store.

Answer

ADD for remote URLs is deprecated and will cause podman build to abort with an error.

Answer

Use ADD for remote URLs because it creates a smaller layer than RUN.

Question 5

A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?

Accepted Answer

/etc/containers/policy.json. The signature verification policy is defined in /etc/containers/policy.json.

Answer

/etc/containers/signatures.yaml

Answer

~/.config/containers/policy.json

Answer

/etc/containers/registries.conf

Question 6

Which THREE methods or options can be used to authenticate or supply credentials when pulling images from a private registry that requires authentication? (Choose three.)

Accepted Answer

Running 'podman login' beforehand to store credentials in auth.json.. Authentication can occur via interactive 'podman login', passing credentials on the CLI, or referencing a stored auth file.

Answer

Setting the environment variable 'PODMAN_PASSWORD' without any login command.

Answer

Passing '--password-stdin' directly to 'podman pull'.

Question 7

An administrator wants to configure Podman to pull images using a specific TLS client certificate for mutual TLS authentication against a secure private registry. Where should the client certificate and private key be placed?

Accepted Answer

/etc/containers/certs.d/registry.example.com/ (with client.cert and client.key). Client certificates and keys are placed in /etc/containers/certs.d/<registry-name>/.

Answer

~/.config/containers/tls/

Answer

/etc/pki/tls/private/

Answer

/etc/containers/auth.d/

Question 8

An administrator needs to manage container lifecycles in Podman. Which TWO of the following commands can be used to start an existing, stopped container? (Choose TWO)

Accepted Answer

podman start. podman start and podman restart (which starts a stopped or running container) can be used to start stopped containers. podman run creates a new container, and podman exec runs commands in running containers.

Answer

podman exec

Answer

podman run

Answer

podman up

Question 9

A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?

Accepted Answer

It turns off SELinux separation and labeling for the container.. The '--security-opt label=disable' flag disables SELinux separation for that specific container.

Answer

It disables seccomp system call filtering.

Answer

It disables user namespace mapping.

Answer

It disables AppArmor enforcement.

Question 10

A container administrator needs to download an image named rhel9/httpd-24 from the Red Hat Ecosystem Catalog using Podman, but requires local authorization without interactive password prompts. Which file should the administrator configure to store these registry credentials in base64-encoded format?

Accepted Answer

~/.config/containers/auth.json. Podman uses the standard Docker-compatible auth configuration file located at $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json to store base64-encoded credentials for registry authentication.

Answer

~/.local/share/containers/storage/mounts

Answer

/etc/containers/registries.conf

Answer

/etc/sysconfig/podman

Question 11

A user needs to download an image from Docker Hub named 'library/alpine' using its explicit transport prefix. Which command demonstrates the correct transport syntax?

Accepted Answer

podman pull docker://alpine:latest. Podman supports explicit transport prefixes like docker://.

Answer

podman pull registry://alpine:latest

Answer

podman pull remote://alpine:latest

Answer

podman pull OCI://alpine:latest

Question 12

You need to copy local application source code from your build context into the /app directory inside the container image, automatically unpacking it if it is a local tar archive. Which instruction should you select?

Accepted Answer

ADD. The ADD instruction copies new files, directories, or remote file URLs from and adds them to the filesystem of the container at the path . A key feature distinguishing ADD from COPY is its ability to automatically extract local tar archives.

Answer

FETCH

Answer

TRANSFER

Answer

COPY

Question 13

An administrator is integrating Podman containers with systemd using generated unit files. Which TWO statements are correct regarding podman generate systemd and its usage? (Choose TWO)

Accepted Answer

The --new flag ensures that the generated service creates a new container instance upon starting rather than requiring a pre-existing static container.. podman generate systemd creates systemd unit files, and the --new flag ensures unit files create fresh containers on startup rather than relying on existing static container names.

Answer

Running systemctl daemon-reload is unnecessary after generating a unit file because Podman reloads systemd automatically.

Answer

Generated systemd files for rootless users must always be placed in /etc/systemd/system/.

Answer

Generated systemd unit files are executed exclusively by Docker daemon integration.

Question 14

An administrator wants to monitor real-time Podman system events, such as when containers are created, started, stopped, or removed, for auditing purposes. Which command should be executed?

Accepted Answer

podman events. The 'podman events' command streams real-time events from the Podman system.

Answer

podman audit

Answer

podman system stream

Answer

podman monitor

Question 15

An organization enforces that all container images must be signed using a local GPG key before they can be deployed in production. Which command generates a signature for an image stored in local storage using a specific signing key?

Accepted Answer

podman image sign --sign-by <key_id> registry.example.com/app:latest. 'podman image sign' is used to sign images for verification policies.

Answer

podman push --sign-by <key_id> app:latest

Answer

podman gpg --sign app:latest

Answer

podman sign --key <key_id> app:latest

Question 16

When configuring a secure private registry that uses a self-signed TLS certificate, a user receives an x509 certificate signed by an unknown authority error when pulling images. Where should the CA certificate file be placed on a RHEL system for system-wide trust?

Accepted Answer

/etc/containers/certs.d/registry.example.com/ca.crt. Custom CA certificates for registries are placed in /etc/containers/certs.d/<registry-name>/ or /etc/docker/certs.d/.

Answer

/etc/pki/ca-trust/source/anchors/registry.crt

Answer

/usr/share/pki/trust/anchors/ca.crt

Answer

~/.config/containers/certs.d/ca.crt

Question 17

An administrator wants to prevent users from pulling images from any registry except 'registry.access.redhat.com'. Where should this restriction be configured?

Accepted Answer

/etc/containers/registries.conf under 'unqualified-search-registries' and blocked registries lists. Registry blocking is configured in /etc/containers/registries.conf using the unqualified-search-registries or blocked registries directives.

Answer

/etc/containers/policy.json under 'default' block rules

Answer

/etc/containers/storage.conf under 'block-pull'

Answer

~/.config/containers/access.conf

Question 18

An administrator wants to inspect the container storage configuration settings, such as graph root and storage driver, on a RHEL system. Which configuration file should they examine?

Accepted Answer

/etc/containers/storage.conf. Storage settings for containers are defined in /etc/containers/storage.conf.

Answer

/etc/containers/podman.conf

Answer

/etc/containers/registries.conf

Answer

/etc/sysconfig/docker

Question 19

An administrator wants to check container port mappings and process listings inside containers. Which TWO commands provide these insights? (Choose TWO)

Accepted Answer

podman port. podman port shows port mappings and podman top shows running processes.

Answer

podman ps-ports

Answer

podman processes

Answer

podman netstat

Question 20

You are designing a container image that runs an executable web server. You want to provide default arguments to the executable that can be easily overridden by a user passing arguments directly to 'podman run'. Which instruction combination is best?

Accepted Answer

Use ENTRYPOINT for the binary and CMD for the default arguments.. ENTRYPOINT should define the executable, and CMD should define the default parameters that can be overridden easily when running the container.

Answer

Use ENV for the binary and WORKDIR for the arguments.

Answer

Use RUN for both the binary and the arguments.

Answer

Use CMD for the binary and ENTRYPOINT for the default arguments.