EX188 Practice Test 8 — 10 Questions

Question 1

An application container requires multiple configuration variables defined in a local file named 'app.env'. Which flag loads these variables into the container environment?

Accepted Answer

podman run --env-file app.env myapp. The --env-file flag reads environment variables line by line from the specified file and passes them into the container.

Answer

podman run --config-file app.env myapp

Answer

podman run -e @app.env myapp

Answer

podman run --load-env app.env myapp

Question 2

Which TWO settings or files are critical when configuring rootless Podman environments on RHEL 9? (Choose two.)

Accepted Answer

/etc/subuid and /etc/subgid for user namespace allocations.. Rootless Podman relies on subordinate UIDs/GIDs in /etc/subuid and /etc/subgid, and user configurations in ~/.config/containers/.

Answer

/etc/selinux/config for enforcing SELinux mode.

Answer

/etc/sudoers for root privileges.

Answer

/etc/shadow for root password hashes.

Question 3

A containerized web service must be accessible from the host system on TCP port 8080, while the application inside the container listens on port 80. Which flag correctly configures this port mapping?

Accepted Answer

-p 8080:80. The format for the --publish or -p flag is host_port:container_port. Thus, -p 8080:80 maps host port 8080 to container port 80.

Answer

--expose 8080:80

Answer

-p 80:8080

Answer

--port-map 8080=80

Question 4

A developer wants to search for all available container images matching the term 'rhel9' across configured registries using Podman. Which command should they run?

Accepted Answer

podman search rhel9. 'podman search' queries configured registries for matching images.

Answer

podman find rhel9

Answer

podman query rhel9

Answer

podman lookup rhel9

Question 5

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

Accepted Answer

:Z. The ':Z' suffix assigns a private unshared SELinux label to the volume.

Answer

:z

Answer

:private

Answer

:seclabel

Question 6

Which TWO conditions are typically required for rootless container users to successfully map UIDs and GIDs from host accounts to container accounts? (Choose two.)

Accepted Answer

The user account must have assigned ranges in /etc/subuid and /etc/subgid.. Rootless UID/GID mapping requires entries in /etc/subuid and /etc/subgid, and support from user namespaces.

Answer

The user must have root privileges via sudo on the host system.

Answer

The storage driver must be set to vfs exclusively.

Answer

SELinux must be set to disabled mode globally.

Question 7

An administrator runs a container with a SELinux-relabeled host directory mount using the Z option, but multiple containers need to share write access to this exact same volume. Which option should be used instead?

Accepted Answer

podman run -v /host/data:/data:z. The z option (lowercase z) shares SELinux content among multiple containers, whereas Z (uppercase Z) treats the content as private and unshared.

Answer

podman run -v /host/data:/data:O

Answer

podman run -v /host/data:/data:Z

Answer

podman run -v /host/data:/data:shared

Question 8

When inspecting the networking of a container using 'podman inspect', where is the IP address of the container located in the output JSON structure?

Accepted Answer

NetworkSettings.IPAddress. The NetworkSettings.IPAddress field contains the IPv4 address assigned to the container on its default network.

Answer

HostConfig.PortBindings.IP

Answer

Config.Network.IP

Answer

State.Networking.Address

Question 9

A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?

Accepted Answer

Rootless containers cannot use the :Z or :z SELinux volume options because rootless Podman runs inside a user namespace where process MCS labeling is restricted.. In rootless mode, the underlying user namespace maps the user to a UID/GID range on the host, but the SELinux sandbox limitations in older kernels or certain rootless configurations prevent standard multi-category security (MCS) label translation for shared volumes unless configured correctly. Specifically, the correct SELinux handling for rootless containers using shared volumes often requires relying on the user's process label or using the ':disable' suffix if SELinux is not enforcing within the namespace.

Answer

Rootless containers automatically disable SELinux enforcement for all mounted volumes, bypassing container isolation.

Answer

The SELinux policy enforcement level must be set to permissive globally across the entire RHEL host.

Answer

The host directory must be owned by the root user before mounting into a rootless container.

Question 10

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

Accepted Answer

podman load -i app.tar. 'podman load' imports an image from a tar archive.

Answer

podman import app.tar

Answer

podman restore -i app.tar

Answer

podman read app.tar