EX188 Practice Test 4 — 25 Questions

Question 1

You need to copy local application source code from your build context into the /app directory inside the container image, automatically unpacking it if it is a local tar archive. Which instruction should you select?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ADD. The ADD instruction in a Containerfile (Dockerfile) copies files from the build context into the image, and it has the additional feature of automatically unpacking local tar archives and fetching remote URLs. The COPY instruction only copies files and directories without unpacking or fetching. Therefore, ADD is the correct choice when you need to unpack a local tar archive into the image.

Answer

FETCH

Answer

TRANSFER

Answer

COPY

Question 2

A developer wants to build a container image using podman build, but the Containerfile is named 'Customfile' and located in a subdirectory named 'dockerfiles'. Which command accomplishes this?

Accepted Answer

podman build -f dockerfiles/Customfile .. The `podman build` command uses the `-f` or `--file` flag to specify an alternative Containerfile. The correct syntax is `podman build -f dockerfiles/Customfile .`, where the path to the Containerfile is given relative to the current directory, and the build context is the current directory (`.`).

Answer

podman build --file-path dockerfiles/Customfile .

Answer

podman build -p dockerfiles/Customfile .

Answer

podman build --config dockerfiles/Customfile .

Question 3

When writing a Containerfile, what is the difference between shell form and exec form for the CMD instruction?

Accepted Answer

Exec form runs the executable directly without invoking a shell, making it receive Unix signals (like SIGTERM) properly as PID 1.. Exec form (JSON array syntax, e.g., CMD ["executable","arg1"]) runs the executable directly without a shell, so the process becomes PID 1 and receives Unix signals such as SIGTERM directly, enabling graceful shutdown. Shell form (CMD command arg1) wraps the command in /bin/sh -c, so the shell becomes PID 1 and may not forward signals to the child process. This distinction is critical for container lifecycle management.

Answer

There is no functional difference; they are syntactic aliases.

Answer

Shell form is required for multi-stage builds, while exec form is for single-stage builds.

Answer

Shell form runs the command as PID 1, while exec form spawns a bash shell wrapper.

Question 4

An administrator is managing rootless containers and wants to enable systemd linger for their user account so that user-level container services continue running after the user logs out. Which command should be run?

Accepted Answer

loginctl enable-linger. The loginctl enable-linger command (optionally with a username) enables systemd linger for a user, which keeps that user's systemd instance and its user services running after the user logs out. This is essential for rootless Podman containers managed as systemd user services (via podman generate systemd or Quadlet) to survive logout and start at boot. Running loginctl enable-linger $USER is the canonical way to enable this.

Answer

systemctl enable --user --linger

Answer

podman system linger enable

Answer

usermod --linger=true $USER

Question 5

An administrator needs to inspect container health check logs to determine why recent health checks failed for a container named app_prod. Which command displays the container's health check log history?

Accepted Answer

podman inspect --format='{{json .State.Health.Log}}' app_prod. inspecting State.Health.Log within podman inspect shows recent health check execution details and error outputs.

Answer

podman logs --health app_prod

Answer

podman health-log app_prod

Answer

podman events --health app_prod

Question 6

Which TWO conditions are required for a non-root (rootless) user to successfully bind mount a host directory into a container? (Choose TWO)

Accepted Answer

The user must have read/write access to the host directory on the host file system. Option B is correct because a rootless user can only bind mount a host directory into a container if that user actually has read/write permissions on the source directory in the host filesystem; without those permissions, the mount would be denied or the container process could not access the content. Option E is correct because when SELinux is enforcing, the host directory must carry a label that the container process is allowed to access, typically applied with the :z or :Z volume option so the bind mount is not blocked by SELinux policy. Option A is not required and is generally impossible for a non-root user, since directly editing kernel mount tables requires root privileges. Option C is incorrect because disabling user namespaces would remove the very mechanism that enables rootless containers, not help bind mounting. Option D is incorrect because the whole point of a rootless container is to operate without root privileges on the host.

Answer

Direct modification of the host kernel mount tables

Answer

Disabling user namespaces across the system

Answer

Root privileges on the host operating system

Question 7

You need to troubleshoot name resolution between containers on a custom network. Which backend service does Podman utilize by default for container DNS resolution in modern rootless setups?

Accepted Answer

aardvark-dns. In modern rootless Podman setups, container name resolution on user-defined networks is handled by aardvark-dns, a lightweight authoritative DNS server that Podman launches per network. It reads container name/IP mappings from the network's configuration and answers A/AAAA queries from containers, enabling name-based communication without editing /etc/hosts.

Answer

nscd

Answer

dnsmasq

Answer

bind9

Question 8

A containerized web service must be accessible from the host system on TCP port 8080, while the application inside the container listens on port 80. Which flag correctly configures this port mapping?

Accepted Answer

-p 8080:80. The `-p` (or `--publish`) flag maps a host port to a container port using the syntax `-p HOST_PORT:CONTAINER_PORT`. Since the host must expose TCP 8080 and the application inside the container listens on port 80, the correct mapping is `-p 8080:80`. This forwards traffic arriving on host port 8080 to container port 80.

Answer

--expose 8080:80

Answer

-p 80:8080

Answer

--port-map 8080=80

Question 9

A developer wants to search for all available container images matching the term 'rhel9' across configured registries using Podman. Which command should they run?

Accepted Answer

podman search rhel9. The `podman search` command queries configured container registries for images matching the given term. Running `podman search rhel9` returns a list of repositories and images whose names or descriptions contain 'rhel9'. This is the correct command for discovering available images across registries.

Answer

podman find rhel9

Answer

podman query rhel9

Answer

podman lookup rhel9

Question 10

You need to ensure that a file copied into your image via the COPY instruction is owned by a specific user 'developer' and group 'devgroup'. How can this be achieved efficiently?

Accepted Answer

COPY --chown=developer:devgroup app.py /app/app.py. The COPY instruction in a Containerfile supports the --chown flag, which sets the ownership of the copied files directly during the copy operation. This is the most efficient method because it avoids creating an extra layer and does not require the user/group to exist in the image beforehand. The syntax --chown=developer:devgroup correctly specifies both user and group.

Answer

COPY app.py /app/app.py && chown developer:devgroup /app/app.py

Answer

COPY --user=developer:devgroup app.py /app/app.py

Answer

ADD --owner=developer app.py /app/app.py

Question 11

You are deploying a container and want to bind its published port exclusively to the loopback interface (127.0.0.1) on the host to prevent external network access. Which syntax is correct?

Accepted Answer

-p 127.0.0.1:8080:80. The -p flag accepts an optional host IP prefix in the form [hostIP:]hostPort:containerPort. Specifying 127.0.0.1:8080:80 binds the published port only to the loopback interface, so only processes on the host itself can reach the container's port 80 via host port 8080. This is the standard Docker/Podman port-publishing syntax and is the only option that places the IP in the correct position.

Answer

-p 8080:80@127.0.0.1

Answer

-p 80:80 --host-ip 127.0.0.1

Answer

--bind-ip 127.0.0.1 -p 8080:80

Question 12

A container needs to be created that shares the host's network stack entirely, bypassing any NAT or virtual interface overhead. Which Podman flag achieves this?

Accepted Answer

--network host. Using --network host disables network isolation and places the container directly on the host's network namespace.

Answer

--share-net

Answer

--publish host

Answer

--net bridge

Question 13

You have a file named config.env containing multiple KEY=VALUE pairs. Which flag allows you to load these configurations into a container as environment variables?

Accepted Answer

--env-file config.env. The --env-file flag allows you to specify a file containing KEY=VALUE pairs that will be loaded as environment variables in the container. This is the standard way to pass multiple environment variables from a file. The file format is simple: each line is a KEY=VALUE pair, and comments are supported with #.

Answer

--config-file config.env

Answer

--volume config.env:/etc/env

Answer

--secret file=config.env

Question 14

An administrator is troubleshooting container exit codes. A container exited with code 137. What does this specific exit code typically signify in container engines?

Accepted Answer

The container was terminated forcefully by SIGKILL (often due to Out-Of-Memory).. Exit code 137 is calculated as 128 + 9, where 9 is the signal number for SIGKILL. This means the container's main process was forcibly terminated with SIGKILL, most commonly because the kernel OOM killer invoked it when the container exceeded its memory cgroup limit, or because an administrator ran `podman kill`.

Answer

The container executed an invalid system call blocked by seccomp.

Answer

The container encountered an application-level syntax error.

Answer

The container startup script had a permission denied error.

Question 15

You need to configure a container port mapping in Podman Compose so that host port 80 forwards to container port 8080. Which YAML syntax is correct under the service definition?

Accepted Answer

ports:
  - "80:8080". In Podman Compose (and Docker Compose), the ports key under a service takes a list of strings in the form "HOST:CONTAINER" to publish a container port on the host. So "80:8080" maps host port 80 to container port 8080. The quotes are recommended because YAML can misinterpret bare numbers containing colons.

Answer

publish:
  - 80->8080

Answer

expose:
  - "80:8080"

Answer

ports:
  container: 8080
  host: 80

Question 16

Which TWO methods can be used to supply environment variables to a Podman container? (Choose TWO)

Accepted Answer

Using the -e or --env flag. Option C is correct because Podman supports the -e or --env flag to pass individual environment variables directly on the command line, e.g. podman run -e MYVAR=value image, which sets the variable inside the container. Option E is correct because the --env-file flag lets you supply a file containing KEY=value lines that Podman reads and injects as environment variables into the container. The other options are not valid Podman flags: --environment-map (A), --var-file (B), and --inject-env (D) do not exist in Podman's CLI, so they cannot be used to supply environment variables.

Answer

Using the --environment-map flag

Answer

Using the --var-file flag

Answer

Using the --inject-env flag

Question 17

Which TWO options can be specified when mounting a Podman secret into a container? (Choose TWO)

Accepted Answer

type=env. Option A (type=env) is correct because Podman secrets support being exposed to a container as environment variables, which is selected with the type=env mount option (e.g., podman run --secret mysecret,type=env). Option D (type=mount) is correct because the default and explicitly supported way to inject a secret is as a file mounted into the container's filesystem, specified with type=mount (e.g., --secret mysecret,type=mount). The remaining options do not belong: type=volume, type=tmpfs, and type=bind are not valid secret type values for Podman secrets — tmpfs and bind are storage/mount concepts used elsewhere (e.g., --mount type=tmpfs or type=bind), and volume is a storage driver concept, none of which are accepted as the secret type parameter.

Answer

type=volume

Answer

type=tmpfs

Answer

type=bind

Question 18

When configuring container networking in Podman, which TWO built-in network modes are available by default without creating custom networks? (Choose two)

Accepted Answer

bridge. Option A (bridge) is correct because Podman ships with a default bridge network (named 'podman') that containers attach to by default, providing NAT-based connectivity and inter-container communication on the host. Option B (host) is correct because Podman supports the host network mode out of the box, where the container shares the host's network namespace and uses the host's IP stack directly. Options C (macvlan), D (routed), and E (overlay) are not default built-in modes: macvlan and overlay typically require creating a custom network with specific drivers, and routed is not a standard Podman network mode available without additional configuration.

Answer

macvlan

Answer

routed

Answer

overlay

Question 19

Which TWO statements are true regarding the EXPOSE instruction in a Containerfile? (Choose two.)

Accepted Answer

It informs Podman that the container listens on the specified network ports at runtime.. Option A is correct because EXPOSE in a Containerfile declares the network ports the containerized application listens on at runtime, and Podman records this metadata so tools like podman inspect and podman run -P can use it. Option D is correct because EXPOSE serves primarily as documentation between the image creator and the container operator, indicating intended listening ports without actually opening or publishing them. Option B is wrong because EXPOSE has no relationship to environment variables; port configuration via env vars is a separate application-level concern. Option C is wrong because EXPOSE does not create or enforce firewall rules in the container network namespace and does not block unexposed ports. Option E is wrong because EXPOSE alone does not publish ports to the host; publishing requires -p for explicit mapping or -P to publish all exposed ports to random host ports.

Answer

It replaces the need to define environment variables for port configuration.

Answer

It enforces strict firewall rules inside the container network namespace, blocking unexposed ports.

Answer

It automatically publishes all exposed ports to random host ports without needing the -p or -P flag.

Question 20

Which THREE directives or practices are associated with implementing secure container builds and adhering to least-privilege principles? (Choose three.)

Accepted Answer

Using minimal, trusted base images to reduce the total software footprint and vulnerability surface.. Option B is correct because starting from minimal, trusted base images (e.g., distroless, alpine, or scratch) shrinks the installed package set and attack surface, reducing the number of exploitable CVEs in the final image. Option C is correct because a USER instruction that switches to a non-root UID/username before CMD or ENTRYPOINT enforces least privilege at runtime, preventing container processes from having root capabilities if the container is compromised. Option E is correct because BuildKit's --secret mounts (e.g., RUN --mount=type=secret) inject credentials only during the build step without persisting them in any image layer, unlike ENV or COPY which bake secrets permanently into the image history. Option A is wrong because hardcoding database passwords in ENV instructions stores credentials in plaintext in image metadata and layers, violating least privilege and secret-management best practices. Option D is wrong because running RUN instructions with --privileged grants the build container full host capabilities, which is the opposite of least privilege and dramatically increases the risk of container escape during builds.

Answer

Hardcoding database passwords directly into ENV instructions so the application can read them easily.

Answer

Running all RUN instructions with '--privileged' inside the Containerfile.