EX188 Practice Test 4 — 25 Questions

Question 1

Which TWO conditions are typically required for rootless container users to successfully map UIDs and GIDs from host accounts to container accounts? (Choose two.)

Accepted Answer

The user account must have assigned ranges in /etc/subuid and /etc/subgid.. Rootless UID/GID mapping requires entries in /etc/subuid and /etc/subgid, and support from user namespaces.

Answer

The user must have root privileges via sudo on the host system.

Answer

The storage driver must be set to vfs exclusively.

Answer

SELinux must be set to disabled mode globally.

Question 2

An administrator runs a container with a SELinux-relabeled host directory mount using the Z option, but multiple containers need to share write access to this exact same volume. Which option should be used instead?

Accepted Answer

podman run -v /host/data:/data:z. The z option (lowercase z) shares SELinux content among multiple containers, whereas Z (uppercase Z) treats the content as private and unshared.

Answer

podman run -v /host/data:/data:O

Answer

podman run -v /host/data:/data:Z

Answer

podman run -v /host/data:/data:shared

Question 3

When inspecting the networking of a container using 'podman inspect', where is the IP address of the container located in the output JSON structure?

Accepted Answer

NetworkSettings.IPAddress. The NetworkSettings.IPAddress field contains the IPv4 address assigned to the container on its default network.

Answer

HostConfig.PortBindings.IP

Answer

Config.Network.IP

Answer

State.Networking.Address

Question 4

A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?

Accepted Answer

Rootless containers cannot use the :Z or :z SELinux volume options because rootless Podman runs inside a user namespace where process MCS labeling is restricted.. In rootless mode, the underlying user namespace maps the user to a UID/GID range on the host, but the SELinux sandbox limitations in older kernels or certain rootless configurations prevent standard multi-category security (MCS) label translation for shared volumes unless configured correctly. Specifically, the correct SELinux handling for rootless containers using shared volumes often requires relying on the user's process label or using the ':disable' suffix if SELinux is not enforcing within the namespace.

Answer

Rootless containers automatically disable SELinux enforcement for all mounted volumes, bypassing container isolation.

Answer

The SELinux policy enforcement level must be set to permissive globally across the entire RHEL host.

Answer

The host directory must be owned by the root user before mounting into a rootless container.

Question 5

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

Accepted Answer

podman load -i app.tar. 'podman load' imports an image from a tar archive.

Answer

podman import app.tar

Answer

podman restore -i app.tar

Answer

podman read app.tar

Question 6

After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?

Accepted Answer

podman tag myapp:v1 registry.example.com/myteam/myapp:latest. 'podman tag' is used to create an additional tag that points to an existing local image ID.

Answer

podman rename myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman commit myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman push myapp:v1 --target registry.example.com/myteam/myapp:latest

Question 7

An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?

Accepted Answer

podman login registry.example.com. Before pushing an image to a registry, you must authenticate using 'podman login'.

Answer

podman push --auth registry.example.com

Answer

podman auth registry.example.com

Answer

podman connect registry.example.com

Question 8

Which command displays disk space usage statistics for Podman storage, including volumes and containers?

Accepted Answer

podman system df. 'podman system df' reports storage consumption for containers, images, and volumes.

Answer

podman disk status

Answer

podman volume df

Answer

podman storage usage

Question 9

A user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?

Accepted Answer

~/.config/containers/registries.conf. For rootless users, insecure registries are configured in ~/.config/containers/registries.conf.

Answer

~/.local/share/containers/storage.conf

Answer

/etc/sysconfig/podman

Answer

/etc/containers/registries.conf

Question 10

A user needs to remove a local container image that is no longer needed. Which command should be used?

Accepted Answer

podman rmi image_name. 'podman rmi' removes one or more local images.

Answer

podman image delete image_name

Answer

podman rm image_name

Answer

podman delete image_name

Question 11

An administrator configures rootless Podman on RHEL 9. For container user namespace mapping to function correctly for a specific user account, entries must be present in which two system files?

Accepted Answer

/etc/subuid and /etc/subgid. Rootless user namespaces rely on /etc/subuid and /etc/subgid.

Answer

/etc/passwd and /etc/group

Answer

/etc/containers/namespace.conf and /etc/containers/users.conf

Answer

/etc/security/limits.conf and /etc/login.defs

Question 12

A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?

Accepted Answer

:z. The ':z' or ':Z' suffix handles SELinux relabeling for volume mounts.

Answer

:ro

Answer

:shared

Answer

:exec

Question 13

Which THREE mechanisms are part of Podman's image signature verification framework on RHEL 9? (Choose three.)

Accepted Answer

Signature storage backends (such as sigstore) where detached signatures are stored.. Image verification relies on policy.json, signature storage transports (sigstore), and public keys.

Answer

Automatic kernel SELinux policy compilation during image pull.

Answer

Built-in TLS client certificate authorities for registry TCP handshakes.

Question 14

An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?

Accepted Answer

[[registry]]
prefix = "registry.example.com"
location = "internal-mirror.example.com". TOML syntax in registries.conf uses [[registry]] tables and registries.search or registries.block fields alongside mirrors.

Answer

registry:
  name: registry.example.com
  mirror: internal-mirror.example.com

Answer

SERVER=registry.example.com
MIRROR=internal-mirror.example.com

Answer

[registry "registry.example.com"]
mirror = "internal-mirror.example.com"

Question 15

Which TWO commands are used to transfer container images via archive files without interacting with a network registry? (Choose two.)

Accepted Answer

podman save. 'podman save' exports images to tar archives and 'podman load' imports them.

Answer

podman import

Answer

podman export

Answer

podman transfer

Question 16

A developer wants to push a locally built container image named webapp:v1 to a private container registry located at registry.local:5000/myteam/. Which sequence of commands correctly tags and pushes the image?

Accepted Answer

podman tag localhost/webapp:v1 registry.local:5000/myteam/webapp:v1 followed by podman push registry.local:5000/myteam/webapp:v1. Before pushing an image to a specific remote registry namespace, it must be tagged with the fully qualified registry URL, path, and tag using 'podman tag', followed by 'podman push'.

Answer

podman push webapp:v1 --registry registry.local:5000/myteam/

Answer

podman commit webapp:v1 registry.local:5000/myteam/webapp:v1

Answer

podman export webapp:v1 > registry.local:5000/myteam/webapp:v1.tar

Question 17

Which flag allows you to publish a container port to a random ephemeral port on the host interface?

Accepted Answer

-P. Using -P or --publish-all publishes all exposed ports to random high-numbered ports on the host.

Answer

-p random

Answer

-p 0:8080

Answer

--port dynamic

Question 18

A developer needs to pull an image from a private registry that requires credentials without running an interactive shell session. Where are the authentication credentials stored after a successful 'podman login' command?

Accepted Answer

~/.config/containers/auth.json. Login credentials are saved in the auth.json file, typically located in $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json.

Answer

/etc/passwd

Answer

~/.ssh/authorized_keys

Answer

/etc/containers/login.conf

Question 19

A practitioner wants to view all container images currently stored in local storage, including their size, tag, and image ID. Which command should they execute?

Accepted Answer

podman images. 'podman images' lists all locally stored images.

Answer

podman list images

Answer

podman show images

Answer

podman ps -a

Question 20

A container running in rootless mode needs to map a user account on the host to a different user inside the container namespace. Which options configure UID and GID mapping?

Accepted Answer

--uidmap and --gidmap. UID/GID mappings are configured using --uidmap and --gidmap.

Answer

--userns-map and --groupmap

Answer

--user-namespace-file

Answer

--map-user and --map-group