EX188 Practice Test 5 — 25 Questions

Question 1

An administrator needs to list all containers, including both running and stopped ones, on the system. Which command should be used?

Accepted Answer

podman ps -a. The podman ps command lists containers, and the -a (or --all) flag includes both running and stopped containers. Without -a, podman ps shows only running containers. This mirrors the Docker CLI behavior and is the standard way to view all container states.

Answer

podman status --all

Answer

podman list --all

Answer

podman containers show

Question 2

You need to set a persistent environment variable named 'APP_PORT' with the value '8080' inside a container image via the Containerfile. Which instruction should you use?

Accepted Answer

ENV APP_PORT=8080. The ENV instruction in a Containerfile sets a persistent environment variable that is available both during the build and at container runtime. This is the standard Dockerfile/Containerfile directive for environment variables, and it persists in the image metadata. Options like EXPORT, VAR, or SET are not valid Containerfile instructions.

Answer

EXPORT APP_PORT=8080

Answer

VAR APP_PORT=8080

Answer

SET APP_PORT=8080

Question 3

A user wants to inspect the metadata and layers of an image stored locally without running it. Which Podman command should be used?

Accepted Answer

podman inspect image_name. 'podman inspect image_name' returns detailed JSON metadata about the image, including its layers, configuration, environment variables, and creation history, without running it. This is the standard command for examining local image details.

Answer

podman view image_name

Answer

podman info

Answer

podman show image_name

Question 4

You need to configure a container so that its port 8080 maps to port 80 on the host's loopback interface only (127.0.0.1). Which syntax is correct?

Accepted Answer

podman run -p 127.0.0.1:80:8080 myapp. The correct syntax for binding a published container port to a specific host IP is `-p HOST_IP:HOST_PORT:CONTAINER_PORT`. Option D, `-p 127.0.0.1:80:8080`, maps container port 8080 to host port 80, but only on the loopback interface 127.0.0.1, which is exactly what the question requires. This restricts external access so only processes on the host itself can reach the service.

Answer

podman run --net 127.0.0.1:80:8080 myapp

Answer

podman run -p 80:8080/127.0.0.1 myapp

Answer

podman run --publish 8080:80/lo myapp

Question 5

Which flag allows you to publish a container port to a random ephemeral port on the host interface?

Accepted Answer

-P. The -P (uppercase) flag tells podman to publish all EXPOSED ports from the image to randomly assigned ephemeral ports on the host. This is the documented shorthand for --publish-all, and it satisfies the requirement of mapping to a random host port without specifying a fixed number. Lowercase -p requires explicit port mappings and does not have a 'random' keyword.

Answer

-p random

Answer

-p 0:8080

Answer

--port dynamic

Question 6

Which command starts services defined in a Podman Compose file in detached mode?

Accepted Answer

podman-compose up -d. `podman-compose up -d` is the direct equivalent of `docker-compose up -d`: it creates and starts all services defined in the compose file and runs them in detached (background) mode. The `-d` flag is the standard shorthand for `--detach` across both Docker Compose and podman-compose.

Answer

podman-compose background

Answer

podman-compose start --detach

Answer

podman-compose run -d

Question 7

An administrator needs to create a temporary filesystem mount stored purely in host memory for high-performance temporary data inside a container. Which mount type should be used?

Accepted Answer

podman run --tmpfs /app/cache myapp. The --tmpfs flag in podman run mounts a tmpfs filesystem at the specified container path, backed entirely by host memory (and swap if enabled). This is the standard, documented way to provide high-performance ephemeral storage inside a container. tmpfs contents are lost when the container stops, which matches the 'temporary' requirement.

Answer

podman run --ramdisk /app/cache myapp

Answer

podman run --mount type=memory,destination=/app/cache myapp

Answer

podman run --memory-mount /app/cache myapp

Question 8

A user is running rootless Podman and needs to verify why a container cannot bind to TCP port 80. By default, unprivileged users cannot bind to ports below 1024. Which parameter controls the minimum unprivileged port that can be bound?

Accepted Answer

net.ipv4.ip_unprivileged_port_start. The sysctl parameter net.ipv4.ip_unprivileged_port_start defines the lowest port number that unprivileged (non-root) users are permitted to bind. By default it is set to 1024, which is why rootless Podman containers cannot bind to port 80. Lowering this value (e.g., to 80 or 0) allows unprivileged processes to bind to lower ports.

Answer

user.max_user_namespaces

Answer

net.ipv4.tcp_port_range

Answer

fs.inotify.max_user_watches

Question 9

An administrator wants to view real-time container lifecycle events across the entire Podman system, such as container creation, starting, and stopping. Which command should be executed?

Accepted Answer

podman events. The podman events command streams real-time container lifecycle events from the Podman system, including create, start, stop, die, and remove actions across all containers. It is the direct analog of docker events and is the correct tool for monitoring system-wide container activity.

Answer

podman monitor --stream

Answer

podman logs --follow --events

Answer

podman system trace

Question 10

Which TWO actions can an administrator take to manage container image tags in local Podman storage? (Choose two.)

Accepted Answer

Use 'podman rmi' to remove a specific image tag from local storage.. Option A is correct because 'podman rmi' removes images from local storage, and when given a tag reference (e.g., 'podman rmi myimage:oldtag') it deletes that specific tag; if it is the last tag on the image, the underlying image is also removed. Option D is correct because 'podman tag' creates an additional name/tag pointing to an existing local image ID (e.g., 'podman tag IMAGE_ID repo/name:newtag'), which is the standard way to assign a new tag without rebuilding or pushing. Option B is wrong because 'podman push --tag' does not exist as a rename mechanism; push transfers an image to a registry and does not manage local tags. Option C is wrong because 'podman rename' renames containers, not images, so it cannot change an image tag. Option E is wrong because 'podman commit' creates a new image from a container's changes and does not accept a '--tag' flag for tagging during creation.

Answer

Use 'podman push --tag' to rename images remotely.

Answer

Use 'podman rename' to change an image tag.

Answer

Use 'podman commit --tag' to tag running containers during creation.

Question 11

An administrator needs to start a container named webapp from the image docker.io/library/httpd in the background. Which podman command should be used?

Accepted Answer

podman run -d --name webapp docker.io/library/httpd. The correct command is 'podman run -d --name webapp docker.io/library/httpd'. The 'run' subcommand creates and starts a container in one step, '-d' detaches it to run in the background, and '--name' assigns the container name. The image reference follows the options.

Answer

podman up -d --name webapp docker.io/library/httpd

Answer

podman container create -d --name webapp docker.io/library/httpd

Answer

podman start -d docker.io/library/httpd --name webapp

Question 12

Which instruction documents the network ports on which a container listens at runtime?

Accepted Answer

EXPOSE. The EXPOSE instruction in a Containerfile documents the network port(s) the containerized application listens on at runtime. It is metadata only — it does not actually publish the port to the host; that requires -p or -P at podman run time. EXPOSE is the standard OCI/Dockerfile directive for this purpose and is what tools like podman inspect read to report exposed ports.

Answer

LISTEN

Answer

PORT

Answer

OPEN

Question 13

An administrator is working with Podman Quadlets to manage container lifecycles via systemd. Which TWO statements regarding Quadlet file naming conventions and directory locations are correct? (Choose TWO)

Accepted Answer

Quadlet configuration files are automatically translated into native systemd unit files by Podman generators.. Option B is correct because Podman ships systemd generators (podman-system-generator and podman-user-generator) that read .container, .volume, .network, .pod, and .kube Quadlet files and translate them into native systemd unit files at boot or daemon-reload time, so no manual compilation is needed. Option C is correct because system-wide (root) Quadlets are stored in /etc/containers/systemd/, which is the documented location the root-level generator scans for administrator-managed units. Option A is wrong because /var/lib/containers/systemd/ is not the rootless Quadlet directory; rootless units belong in ~/.config/containers/systemd/ (or /etc/containers/systemd/users/ for per-user system-wide placement). Option D is wrong because Quadlet files are plain-text INI-style configuration consumed by Podman's generators, not C source requiring gcc. Option E is wrong because Quadlet container units use the single extension .container (e.g., foo.container), not .service.container.

Answer

Rootless Quadlet files are placed in /var/lib/containers/systemd/ root directory.

Answer

Quadlet files must be manually compiled using gcc before systemd can read them.

Answer

Quadlet container unit files must use the exact file extension .service.container.

Question 14

Which TWO flags can be used to mount volumes or bind mounts when running a container? (Choose TWO)

Accepted Answer

--mount. Option A (--mount) is correct because it is the modern, explicit Docker flag for attaching volumes, bind mounts, and tmpfs mounts, using comma-separated key=value pairs such as type=bind,source=/host/path,target=/container/path. Option B (-v or --volume) is correct because it is the classic Docker shorthand for the same purpose, using the colon-separated syntax source:target[:options], and it remains fully supported for both named volumes and bind mounts. The unmarked options do not belong: --store-path is not a Docker run flag (it relates to storage configuration concepts, not container mounting), --attach-storage is not a valid Docker CLI option, and --link-volume is not a recognized Docker flag for attaching volumes or bind mounts.

Answer

--store-path

Answer

--attach-storage

Answer

--link-volume

Question 15

Which TWO commands or flags are valid for managing Podman named volumes? (Choose TWO)

Accepted Answer

podman volume create. Option D, 'podman volume create', is correct because it is the actual Podman subcommand used to create a named volume, which can then be referenced by containers via the -v or --mount flag. Option E, 'podman volume ls', is correct because it lists all existing named volumes along with their driver and mountpoint, making it a valid management command. The other options do not belong: 'podman volume make' (A), 'podman volume compile' (B), and 'podman volume build' (C) are not real Podman subcommands and would return an unknown command error, since Podman's volume management verbs are create, ls, inspect, rm, and prune.

Answer

podman volume make

Answer

podman volume compile

Answer

podman volume build

Question 16

Which TWO commands can be used with Podman to build a container image from a Containerfile? (Choose two.)

Accepted Answer

podman image build. podman build and podman image build are both valid commands for building images.

Answer

podman container build

Answer

podman make image

Answer

podman create build

Question 17

Which THREE inspection or cleanup actions can be performed on Podman secrets? (Choose THREE)

Accepted Answer

List existing secrets with 'podman secret ls'. Option A is correct because 'podman secret ls' is the standard subcommand that enumerates all secrets currently stored in Podman's secret store, showing IDs and names. Option B is correct because 'podman secret inspect' retrieves metadata about a secret (such as ID, name, driver, and timestamps) without exposing the secret payload. Option E is correct because 'podman secret rm' deletes one or more secrets from the store, which is the supported cleanup action. Option C is not a real Podman subcommand; secrets are created via 'podman secret create' and are not compiled into a binary format. Option D is also invalid because Podman does not support editing secret values in place; secrets are immutable and must be removed and recreated to change their contents.

Answer

Compile secrets into binary format with 'podman secret compile'

Answer

Edit secret values in-place with 'podman secret edit'

Question 18

A developer wants to mount a host directory into a container with read-only permissions to prevent accidental data modification. Which volume option flag achieves this?

Accepted Answer

podman run -v /host/data:/container/data:ro. The -v /host/data:/container/data:ro syntax mounts the host directory with read-only permissions inside the container. The :ro suffix tells the runtime to mount the bind read-only, preventing any writes from the container to the host path. This is the standard short-form volume option for read-only bind mounts.

Answer

podman run --read-only-mount=/host/data

Answer

podman run -v /host/data:/container/data:rw

Answer

podman run --mount type=bind,source=/host/data,destination=/container/data,readonly=false

Question 19

Which TWO configuration files or directories are routinely modified when establishing secure private container registry trust and signature policies on RHEL 9? (Choose two.)

Accepted Answer

/etc/containers/registries.conf. Option B, /etc/containers/registries.conf, is correct because it is the primary configuration file used by container tools such as Podman and Skopeo to define registry trust settings, including which registries are allowed, blocked, or treated as insecure, and it can reference registry-specific configuration directories. Option E, /etc/containers/policy.json, is correct because it defines the signature verification policy that container engines apply when pulling images, specifying which keys or signed identities are trusted for particular registries or repositories. Together, these files establish both registry access trust and image signature enforcement on RHEL 9. Option A, /etc/fstab, is incorrect because it defines filesystem mount points and has nothing to do with container registry trust. Option C, /etc/hosts, is incorrect because it only provides static hostname-to-IP mappings. Option D, /etc/passwd, is incorrect because it stores local user account information, not container registry or signature policy settings.

Answer

/etc/fstab

Answer

/etc/hosts

Answer

/etc/passwd

Question 20

Which THREE behaviors occur when utilizing multi-stage builds in a Containerfile? (Choose three.)

Accepted Answer

You can include multiple 'FROM' instructions in a single Containerfile, where each 'FROM' starts a new stage of the build.. Multi-stage builds allow multiple FROM lines, naming stages, and selective copying between them.

Answer

All intermediate stages are automatically tagged and pushed to the local registry when the build completes.

Answer

Artifacts from earlier stages are automatically merged into the final image layers unless explicitly deleted.