EX188 Practice Test 3 — 25 Questions

Question 1

An administrator needs to execute a package update and install dependencies during the podman build process, ensuring these commands are committed as a new layer in the final image. Which instruction accomplishes this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RUN. `RUN` executes a command during the image build and commits the resulting filesystem changes as a new layer in the image. Using `RUN dnf update -y && dnf install -y <deps>` performs the package update and dependency install at build time, baking the results into the final image.

Answer

EXEC

Answer

START

Answer

CMD

Question 2

An administrator wants to monitor resource usage (CPU, memory, block I/O, network I/O) of all running containers in real-time. Which command provides this functionality?

Accepted Answer

podman stats. podman stats displays real-time resource usage statistics (CPU, memory, block I/O, network I/O, and PIDs) for running containers, similar to docker stats. It continuously refreshes and can be filtered to specific containers. This is the direct command for live resource monitoring.

Answer

podman monitor resources

Answer

podman top

Answer

podman system df

Question 3

A security team requires that all container processes run with a specific SELinux type instead of the default container_t. How can an administrator specify a custom SELinux type when launching a container with 'podman run'?

Accepted Answer

--security-opt label=type:custom_t. The `--security-opt label=type:custom_t` flag tells Podman to apply the specified SELinux type to the container's processes instead of the default container_t. This is the correct syntax for overriding SELinux labels at container launch. The label=type: prefix is part of Podman's security-opt grammar for SELinux process labeling.

Answer

--selinux-type custom_t

Answer

--cap-add SELINUX

Answer

--env SELINUX_TYPE=custom_t

Question 4

An administrator is troubleshooting a container that fails its health check repeatedly. The container definition needs a health check that runs curl -f http://localhost/ || exit 1 every 30s, with a 5s timeout and 3 retries, starting after a 10s grace period. Which flag combination implements this correctly in podman run?

Accepted Answer

podman run --health-cmd="curl -f http://localhost/ || exit 1" --health-interval=30s --health-timeout=5s --health-retries=3 --health-start-period=10s webapp. The correct flag combination uses Podman's health check flags: --health-cmd for the command, --health-interval for the period, --health-timeout for the timeout, --health-retries for retry count, and --health-start-period for the initial grace period. Option C matches all required parameters exactly, including the '|| exit 1' failure semantics. Podman's health check system mirrors Docker's HEALTHCHECK instruction and uses these specific flag names.

Answer

podman run --healthcheck="curl -f http://localhost/" --interval=30 --timeout=5 --retries=3 webapp

Answer

podman run --health-probe="curl -f http://localhost/" --health-delay=10s webapp

Answer

podman run --check-command="curl -f http://localhost/" --check-period=30s webapp

Question 5

Which TWO actions are required when configuring a secure container workflow to push a signed image to a registry using Podman? (Choose two.)

Accepted Answer

Generate a cryptographic key pair and ensure the private key is available to sign the image.. Option D is correct because signing a container image with Podman requires a cryptographic key pair (typically created with `skopeo generate-sigstore-key` or a GPG key), and the private key must be accessible to the signing tool so it can produce the signature that is pushed alongside the image. Option E is correct because `/etc/containers/registries.d/` YAML files define the signature storage and transport configuration (for example `docker:` with `sigstore-staging:` or `lookaside-storage:`), telling Podman/Skopeo where signatures are stored and how they are associated with the registry so verification works after the push. Option A is wrong because disabling SELinux globally is neither required nor advisable for signing images; SELinux confinement is orthogonal to image signing. Option B is wrong because embedding the private signing key in the image payload would expose the key and defeat the purpose of signing. Option C is wrong because the `vfs` storage driver is a slow, non-overlay fallback and has no bearing on the signing or push workflow.

Answer

Disable SELinux enforcement globally on the container host before generating signatures.

Answer

Store the private signing key inside the container image payload.

Answer

Set the container storage driver to vfs in storage.conf.

Question 6

When publishing container ports using the Podman CLI, which THREE methods or syntaxes are valid for the -p / --publish flag? (Choose three)

Accepted Answer

-p 8080:80. Option A, `-p 8080:80`, is valid because the standard Podman/Docker publish syntax is `hostPort:containerPort`, mapping host port 8080 to container port 80 over the default TCP protocol. Option B, `-p 127.0.0.1:8080:80`, is valid because the full syntax `ip:hostPort:containerPort` binds the published port to a specific host interface (127.0.0.1) rather than all interfaces. Option E, `-p 8080:80/udp`, is valid because appending `/udp` (or `/tcp`) after the container port specifies the protocol for the published port. Option C is invalid because Podman does not accept the key=value form `container=80,host=8080` for `--publish`. Option D is invalid because the protocol must be appended with a slash (e.g., `8080:80/tcp`) and cannot be followed by an extra `:bind` field in that position.

Answer

-p container=80,host=8080

Answer

-p 80:8080:tcp:bind

Question 7

You want to create a Podman network with a specific subnet and gateway. Which command correctly specifies these parameters?

Accepted Answer

podman network create --subnet 192.168.200.0/24 --gateway 192.168.200.1 customnet. The `podman network create` command accepts `--subnet` to define the CIDR block and `--gateway` to set the gateway IP for the new network, with the network name as the positional argument at the end. Option A uses both flags correctly with valid syntax, creating a network named `customnet` on 192.168.200.0/24 with gateway 192.168.200.1. This is the canonical form documented in podman-network-create(1).

Answer

podman network create --ip-range 192.168.200.0/24 customnet

Answer

podman network new --subnet=192.168.200.0/24 customnet

Answer

podman network create customnet --network 192.168.200.0/24

Question 8

A user running rootless Podman wants to check the disk space consumed by images and containers in local storage. Which command provides this storage usage summary?

Accepted Answer

podman system df. podman system df reports disk usage for images, containers, volumes, and the build cache, similar to docker system df. It shows total, active, and reclaimable space, making it the correct command for a storage usage summary in rootless Podman. The output helps identify what can be pruned with podman system prune.

Answer

df -h podman

Answer

podman storage status

Answer

podman disk usage

Question 9

Which TWO methods can a user employ to verify that an image has been successfully downloaded to their local machine? (Choose two.)

Accepted Answer

Running 'podman image inspect ' to view its configuration metadata.. Option B is correct because 'podman image inspect ' returns the image's configuration metadata (such as its ID, layers, and creation details) from the local image store, which only succeeds if the image was actually downloaded and is present locally. Option E is correct because 'podman images' lists all images in local storage with their repository, tag, image ID, and size, so seeing the expected name and tag confirms the download completed. Option A is wrong because 'podman network ls' lists configured networks, not images, and has nothing to do with verifying a downloaded image. Option C is wrong because 'podman ps -a' lists containers (running and stopped), not image layers, so it cannot confirm an image download. Option D is wrong because 'podman volume inspect' reports on volumes, not image storage paths or downloaded images.

Answer

Running 'podman network ls' to verify image network attachment.

Answer

Running 'podman ps -a' to see the downloaded image layers.

Answer

Running 'podman volume inspect' to check image storage paths.

Question 10

An administrator needs to list all created Podman secrets on the system. Which command should they execute?

Accepted Answer

podman secret ls. The correct command to list all created Podman secrets is `podman secret ls`. Podman follows the same subcommand naming conventions as Docker, where `ls` is the standard alias for listing resources. The `podman secret` command group includes `create`, `inspect`, `ls`, and `rm`, so `podman secret ls` is the valid syntax to display all secrets stored in the system.

Answer

podman secret list

Answer

podman secrets ls

Answer

podman system secrets

Question 11

How can an administrator remove an existing Podman secret named 'old_secret'?

Accepted Answer

podman secret rm old_secret. The correct Podman command to remove a secret is 'podman secret rm <name>'. Podman's secret subcommand follows the same verb pattern as other resource subcommands (rm for remove), so 'podman secret rm old_secret' deletes the named secret from Podman's secret store.

Answer

podman rm secret old_secret

Answer

podman secret delete old_secret

Answer

podman secret remove old_secret

Question 12

An auditor reviewing your Containerfile notices an EXPOSE instruction for port 80. What is the primary function of the EXPOSE instruction?

Accepted Answer

It documents which ports the container listens on at runtime.. The EXPOSE instruction in a Containerfile is purely metadata — it documents the port the containerized application listens on, so tools like podman and image consumers know which port to publish. It does not actually open, publish, or firewall the port; the operator must still use -p or -P at runtime to map it to a host port.

Answer

It opens firewall ports on the underlying RHEL host system permanently.

Answer

It encrypts network traffic entering the specified container port.

Answer

It automatically publishes all exposed ports to random host ports without flags.

Question 13

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

Accepted Answer

podman load -i app.tar. The podman load command reads a container image from a tar archive and imports it into local container storage. The -i flag specifies the input file, so podman load -i app.tar loads the image from app.tar. This is the standard way to restore an image previously saved with podman save.

Answer

podman import app.tar

Answer

podman restore -i app.tar

Answer

podman read app.tar

Question 14

A user needs to remove a local container image that is no longer needed. Which command should be used?

Accepted Answer

podman rmi image_name. `podman rmi` is the dedicated image-removal subcommand; it accepts an image name or ID and deletes the local image from container storage. It is the Podman equivalent of `docker rmi` and is the canonical command documented for removing images.

Answer

podman image delete image_name

Answer

podman rm image_name

Answer

podman delete image_name

Question 15

A developer has written a Containerfile with multiple COPY instructions for static configuration files that change frequently, placed near the top of the Containerfile before the application code installation. Why is this considered a bad practice for build caching?

Accepted Answer

It invalidates the build cache for all subsequent instructions whenever those configuration files change, slowing down builds.. Changing a file earlier in the Containerfile invalidates the cache for all subsequent instructions, forcing unnecessary rebuilds of heavy steps.

Answer

It violates OCI container image specification limits on COPY counts.

Answer

It causes the ENTRYPOINT instruction to fail at runtime.

Answer

It causes Podman to store duplicate layers in local storage, exhausting disk space.

Question 16

Which TWO Containerfile instructions are used to bring files or data from outside the container into the build context or image? (Choose two.)

Accepted Answer

COPY. COPY is correct because it copies files or directories from the build context (or from a stage in a multi-stage build via --from) into the image filesystem, and it does not perform any remote URL fetching or automatic archive extraction. ADD is correct because it also brings files into the image, and additionally supports fetching remote URLs and auto-extracting recognized local tar archives into the destination. GET, FETCH, and IMPORT are not valid Containerfile/Dockerfile instructions, so they cannot be used to bring files or data into the build context or image.

Answer

GET

Answer

FETCH

Answer

IMPORT

Question 17

An administrator needs to create a persistent storage area managed completely by Podman that does not rely on a specific host directory path. Which command should be used?

Accepted Answer

podman volume create my_data. podman volume create my_data creates a named volume managed by Podman's volume driver, which stores data in a Podman-controlled location (e.g., ~/.local/share/containers/storage/volumes for rootless) rather than a user-specified host path. This is exactly what the question asks for: persistent storage managed by Podman without relying on a specific host directory.

Answer

podman volume bind my_data

Answer

podman run -v /my_data

Answer

podman create volume my_data

Question 18

Which THREE commands are valid when inspecting or managing Podman storage volumes? (Choose THREE)

Accepted Answer

podman volume inspect. Option B, `podman volume inspect`, is correct because it is the standard subcommand for retrieving detailed JSON metadata about a named volume, including its mountpoint, driver, labels, and options. Option C, `podman volume rm`, is correct because it removes one or more volumes from Podman storage, optionally with `--force` to remove volumes in use. Option D, `podman volume create`, is correct because it is the canonical command for creating a new named volume, supporting flags such as `--driver`, `--label`, and `--opt`. Option A, `podman volume modify`, is not a valid Podman subcommand (unlike `podman volume` operations such as `ls`, `prune`, or `exists`), and Option E, `podman volume edit`, also does not exist; Podman has no built-in volume editing command, so volume attributes must be changed by recreating the volume or using supported flags at creation time.

Answer

podman volume modify

Answer

podman volume edit

Question 19

Which TWO actions can be performed using the podman volume management command suite? (Choose two.)

Accepted Answer

Display detailed low-level configuration of a volume using podman volume inspect. Option B is correct because `podman volume inspect` is a real subcommand of the `podman volume` suite that outputs detailed low-level JSON configuration for a named volume, including its mountpoint, driver, labels, and options. Option E is correct because `podman volume prune` is a valid subcommand that removes all volumes not currently referenced by any container, freeing unused storage. Option A is incorrect because there is no `podman volume resize` subcommand; volume size limits are not managed that way in Podman. Option C is incorrect because `podman volume encrypt` does not exist; Podman does not provide a volume-encryption subcommand in its volume suite. Option D is incorrect because `podman volume convert` is not a real subcommand and bind mounts cannot be converted into named volumes via the volume management suite.

Answer

Modify the size limit of an existing volume using podman volume resize

Answer

Encrypt a managed volume at rest using podman volume encrypt

Answer

Convert a bind mount to a named volume using podman volume convert

Question 20

An administrator wants to temporarily pause a running container's processes and later resume them. Which TWO commands should be used? (Choose TWO)

Accepted Answer

podman unpause. Option B, podman pause, is correct because it suspends all processes in a running container by sending SIGSTOP via the freezer cgroup, leaving the container intact so it can be resumed later. Option A, podman unpause, is correct because it reverses that state by sending SIGCONT through the freezer cgroup, allowing the previously paused processes to continue running. Together these two commands implement the temporary pause-and-resume workflow the administrator needs. Option C, podman freeze, is not a valid Podman command for this purpose, and option D, podman resume, is likewise not a real Podman subcommand. Option E, podman stop, is incorrect because it terminates the container's processes rather than temporarily suspending them, so the container could not simply be resumed.

Answer

podman freeze

Answer

podman resume

Answer

podman stop