EX188 Practice Test 5 — 25 Questions

Question 1

You need to inspect the configuration details, including subnet, gateway, and driver, of a custom Podman network named 'appnet'. Which command should you run?

Accepted Answer

podman network inspect appnet. 'podman network inspect' displays detailed low-level network configurations in JSON format.

Answer

podman inspect --network appnet

Answer

podman network show appnet

Answer

podman network status appnet

Question 2

You are configuring a container to consume a Podman secret named db_password. By default, where within the container's file system will this secret be mounted if no destination path is specified?

Accepted Answer

/run/secrets/db_password. Podman secrets are mounted into the container under /run/secrets/ by default if an explicit target is not provided.

Answer

/secrets/db_password

Answer

/etc/secrets/db_password

Answer

/var/run/secrets/db_password

Question 3

A system administrator logs into a RHEL 9 server as a regular non-root user and executes 'podman ps'. The command succeeds, but no containers are displayed. What architecture feature enables this user to run containers without root privileges?

Accepted Answer

Linux user namespaces and subuid/subgid mapping. Rootless Podman utilizes user namespaces (user_namespaces(7)) to map the unprivileged user to a set of UIDs and GIDs inside the container environment, combined with shadow-utils mapping files.

Answer

The Docker daemon running as a system service in user space

Answer

The systemd-logind setuid binary wrapper

Answer

SELinux multi-category security (MCS) translation tables

Question 4

A user running a rootless container needs to inspect which subordinate UID and GID ranges have been allocated to their user account on the RHEL 9 host. Which files define these mappings?

Accepted Answer

/etc/subuid and /etc/subgid. Subordinate user and group ID ranges allocated for rootless namespaces are defined in /etc/subuid and /etc/subgid respectively.

Answer

/etc/passwd and /etc/group

Answer

/etc/security/limits.conf

Answer

~/.config/containers/storage.conf

Question 5

When interacting with container registries using Podman, which THREE commands or tasks are valid operations supported natively by the Podman CLI? (Choose three.)

Accepted Answer

podman pull registry.example.com/image:tag. Podman natively supports pulling, pushing, tagging, logging into, and searching container registries using standard commands matching Docker syntax.

Answer

podman mount-registry --remote

Answer

podman compile-image --from-registry

Question 6

An administrator wants to ensure that a bind-mounted directory allows propagation of mounts from the host into the container. Which mount option configures mount propagation mode?

Accepted Answer

podman run -v /host/dir:/container/dir:shared myapp. Mount propagation (shared, slave, private) can be configured using propagation options like 'shared' or 'slave'.

Answer

podman run -v /host/dir:/container/dir:mtype=shared myapp

Answer

podman run -v /host/dir:/container/dir:sync myapp

Answer

podman run -v /host/dir:/container/dir:propagate myapp

Question 7

Which THREE methods or directives can be used to pass environment variables into containers via Podman Compose? (Choose three.)

Accepted Answer

env_file. Environment variables can be passed using 'environment', 'env_file', and shell interpolation.

Answer

sysctl_env

Answer

container_env

Question 8

You are deploying a container and want to bind its published port exclusively to the loopback interface (127.0.0.1) on the host to prevent external network access. Which syntax is correct?

Accepted Answer

-p 127.0.0.1:8080:80. Podman allows binding ports to a specific host IP using the format ip:host_port:container_port. Therefore, 127.0.0.1:8080:80 accomplishes this.

Answer

-p 8080:80@127.0.0.1

Answer

-p 80:80 --host-ip 127.0.0.1

Answer

--bind-ip 127.0.0.1 -p 8080:80

Question 9

Which TWO actions are required when configuring a secure container workflow to push a signed image to a registry using Podman? (Choose two.)

Accepted Answer

Generate a cryptographic key pair and ensure the private key is available to sign the image.. Pushing a signed image requires generating a local key pair (e.g., using GPG), configuring the signature storage destination in registries.d, and signing the image during or after the push process using podman push or podman image sign.

Answer

Disable SELinux enforcement globally on the container host before generating signatures.

Answer

Store the private signing key inside the container image payload.

Answer

Set the container storage driver to vfs in storage.conf.

Question 10

An engineer needs to inspect the content and metadata of an existing Podman secret named 'my_secret' without outputting the raw secret value in plain text if masked, or viewing its metadata. Which command inspects the secret?

Accepted Answer

podman secret inspect my_secret. 'podman secret inspect' displays detailed metadata about the secret object.

Answer

podman secret cat my_secret

Answer

podman secret show my_secret

Answer

podman secret view my_secret

Question 11

Which TWO options can be specified when mounting a Podman secret into a container? (Choose TWO)

Accepted Answer

type=env. Secrets can be mounted as files or injected as environment variables using options like type=mount or type=env.

Answer

type=volume

Answer

type=tmpfs

Answer

type=bind

Question 12

An administrator is troubleshooting an issue where a rootless container cannot access a host file because of SELinux denials. Which THREE statements accurately describe how SELinux interacts with rootless Podman containers on RHEL 9? (Choose three.)

Accepted Answer

Rootless containers run under the user's unprivileged process context and are still constrained by SELinux policy rules.. Rootless containers run in user namespaces. While they do not have root privileges, SELinux still applies constraints. Specifically, rootless containers run under an unprivileged user process label (such as unconfined_u:unconfined_r:unconfined_t:s0 or similar user-space mappings), cannot dynamically relabel arbitrary host paths using container tools with the same privileges as root, and rely on container process confinement governed by the active SELinux policy.

Answer

Rootless containers completely disable SELinux enforcement automatically upon startup.

Answer

Rootless containers require the container host to be booted with selinux=0 kernel parameter to function.

Question 13

An administrator needs to create a persistent storage area managed completely by Podman that does not rely on a specific host directory path. Which command should be used?

Accepted Answer

podman volume create my_data. Podman named volumes are managed by the container engine and stored in a host directory managed by Podman, unlike bind mounts which bind to a specific user-defined host path.

Answer

podman volume bind my_data

Answer

podman run -v /my_data

Answer

podman create volume my_data

Question 14

Two containers running on the same custom user-defined bridge network need to communicate with each other. What built-in mechanism allows them to resolve each other by container name?

Accepted Answer

Automatic DNS resolution provided by the CNI/Netavark network backend. User-defined bridge networks in Podman (backed by CNI or Netavark) provide automatic internal container name resolution through embedded DNS services.

Answer

Static ARP table broadcasting managed by the kernel

Answer

Multicast DNS (mDNS) running inside every container image by default

Answer

Automatic editing of the host's /etc/hosts file by the Podman daemon

Question 15

A Podman secret named 'db_password' has been created. How is this secret made accessible inside a running container?

Accepted Answer

podman run --secret db_password,type=mount myapp. The --secret flag allows mounting or injecting a secret into the container filesystem or environment.

Answer

podman run --env SECRET=db_password myapp

Answer

podman run --inject-secret db_password myapp

Answer

podman run --use-secret db_password myapp

Question 16

What type of storage pattern is used by default when a container writes logs and temporary application state directly to its writable layer without any volumes attached?

Accepted Answer

Ephemeral container storage. Ephemeral storage refers to temporary storage bound to the container's lifecycle and destroyed when the container is removed.

Answer

Persistent named storage

Answer

Bind mount storage

Answer

Block storage replication

Question 17

Which THREE parameters are valid key-value pairs when using the advanced '--mount' flag with bind or volume types? (Choose THREE)

Accepted Answer

source. When using '--mount', valid keys include type, source (or src), and destination (or target/dst).

Answer

format

Question 18

An administrator runs a container with an SELinux-enforced host bind mount, but the container processes fail to write to the directory due to permission errors. Which volume option resolves this by sharing the SELinux content label?

Accepted Answer

--volume /host/data:/container/data:z. The :Z option instructs Podman to relabel the host path specifically for the container, while :z shares it across multiple containers.

Answer

--volume /host/data:/container/data:rprivate

Answer

--volume /host/data:/container/data:shared

Answer

--volume /host/data:/container/data:private

Question 19

Which Podman network mode completely isolates a container from any network communication, removing all interfaces except the loopback?

Accepted Answer

--network none. The 'none' network driver disables all external and internal networking for the container.

Answer

--network isolated

Answer

--network closed

Answer

--network disabled

Question 20

You are troubleshooting a container that should have no network access whatsoever for security isolation. Which networking option should you apply?

Accepted Answer

--network none. The 'none' network driver disables all external networking for the container, leaving only the loopback interface active.

Answer

--network isolated

Answer

--network bridge

Answer

--network host