EX188 Practice Test 8 — 10 Questions

Question 1

Which TWO commands are used to manage Podman secrets? (Choose TWO)

Accepted Answer

podman secret create. Option A, `podman secret create`, is correct because it is the command used to create a new secret in Podman's secret store, reading the secret value from a file or stdin and registering it under a given name for later use by containers. Option D, `podman secret ls`, is correct because it lists all secrets currently stored in the Podman secret store, allowing administrators to verify which secrets exist. The other options are not valid Podman subcommands: `podman secret compile`, `podman secret update`, and `podman secret modify` do not exist in Podman's CLI, so they cannot be used to manage secrets.

Answer

podman secret compile

Answer

podman secret update

Answer

podman secret modify

Question 2

An administrator is troubleshooting container exit codes and low-level state details. Which TWO of the following inspect format expressions correctly extract container state attributes? (Choose TWO)

Accepted Answer

podman inspect --format='{{.State.StartedAt}}' container_name. Option B is correct because podman inspect exposes the container's low-level state under the .State object, and .State.StartedAt is the valid field holding the container start timestamp. Option E is correct because the container exit code is stored at .State.ExitCode in the inspect JSON, so this Go-template expression properly extracts the exit status the administrator is troubleshooting. Option A is wrong because .Metadata.ExitCode does not exist in podman inspect output; exit codes live under .State, not .Metadata. Option C is wrong because .Status.Running is not a valid path — running state is reported via .State.Running. Option D is wrong because there is no top-level .Exit field; the exit code must be referenced as .State.ExitCode.

Answer

podman inspect --format='{{.Metadata.ExitCode}}' container_name

Answer

podman inspect --format='{{.Status.Running}}' container_name

Answer

podman inspect --format='{{.Exit}}' container_name

Question 3

Which THREE of the following are valid options or flags when working with Podman secrets? (Choose THREE)

Accepted Answer

podman secret rm. Option B, `podman secret rm`, is a valid Podman subcommand used to remove one or more existing secrets from Podman's secret store, so it correctly belongs to the `podman secret` command family. Option C, `podman secret ls`, is also valid because it lists all secrets currently managed by Podman, optionally with formatting or filtering flags. Option E, `podman secret create`, is valid as the primary command for creating a new secret from a file or standard input, which is the core operation for Podman secrets. The unmarked options do not belong: `podman secret extract` (A) is not a Podman secret subcommand, and `podman secret compile` (D) is likewise not a recognized Podman secret operation.

Answer

podman secret extract

Answer

podman secret compile

Question 4

Which THREE storage-related items can be inspected using 'podman system df'? (Choose THREE)

Accepted Answer

Images. The 'podman system df' command reports disk usage for the storage-related resources that Podman manages, and its output lists Images (B), Containers (C), and Volumes (D) with their total, active, and reclaimable sizes. Images (B) are included because Podman tracks the space consumed by locally stored image layers and their shared parents. Containers (C) are included because each container's writable layer occupies storage on disk. Volumes (D) are included because named volumes persist data outside the container layer and their disk consumption is reported. Networks (A) and Secrets (E) are not storage-usage items reported by 'podman system df'; networks are runtime/network configuration and secrets are managed credential objects, neither of which appears in this command's output.

Answer

Networks

Answer

Secrets

Question 5

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

Accepted Answer

:Z. The `:Z` suffix applies a private, unshared SELinux label to the volume mount, meaning the content is exclusively accessible by that single container. This is appropriate when the host directory should not be shared with other containers, as it relabels the content with a unique MCS category.

Answer

:z

Answer

:private

Answer

:seclabel

Question 6

You need to copy local application source code from your build context into the /app directory inside the container image, automatically unpacking it if it is a local tar archive. Which instruction should you select?

Accepted Answer

ADD. The ADD instruction in a Containerfile (Dockerfile) copies files from the build context into the image, and it has the additional feature of automatically unpacking local tar archives and fetching remote URLs. The COPY instruction only copies files and directories without unpacking or fetching. Therefore, ADD is the correct choice when you need to unpack a local tar archive into the image.

Answer

FETCH

Answer

TRANSFER

Answer

COPY

Question 7

A developer wants to build a container image using podman build, but the Containerfile is named 'Customfile' and located in a subdirectory named 'dockerfiles'. Which command accomplishes this?

Accepted Answer

podman build -f dockerfiles/Customfile .. The `podman build` command uses the `-f` or `--file` flag to specify an alternative Containerfile. The correct syntax is `podman build -f dockerfiles/Customfile .`, where the path to the Containerfile is given relative to the current directory, and the build context is the current directory (`.`).

Answer

podman build --file-path dockerfiles/Customfile .

Answer

podman build -p dockerfiles/Customfile .

Answer

podman build --config dockerfiles/Customfile .

Question 8

When writing a Containerfile, what is the difference between shell form and exec form for the CMD instruction?

Accepted Answer

Exec form runs the executable directly without invoking a shell, making it receive Unix signals (like SIGTERM) properly as PID 1.. Exec form (JSON array syntax, e.g., CMD ["executable","arg1"]) runs the executable directly without a shell, so the process becomes PID 1 and receives Unix signals such as SIGTERM directly, enabling graceful shutdown. Shell form (CMD command arg1) wraps the command in /bin/sh -c, so the shell becomes PID 1 and may not forward signals to the child process. This distinction is critical for container lifecycle management.

Answer

There is no functional difference; they are syntactic aliases.

Answer

Shell form is required for multi-stage builds, while exec form is for single-stage builds.

Answer

Shell form runs the command as PID 1, while exec form spawns a bash shell wrapper.

Question 9

An administrator is managing rootless containers and wants to enable systemd linger for their user account so that user-level container services continue running after the user logs out. Which command should be run?

Accepted Answer

loginctl enable-linger. The loginctl enable-linger command (optionally with a username) enables systemd linger for a user, which keeps that user's systemd instance and its user services running after the user logs out. This is essential for rootless Podman containers managed as systemd user services (via podman generate systemd or Quadlet) to survive logout and start at boot. Running loginctl enable-linger $USER is the canonical way to enable this.

Answer

systemctl enable --user --linger

Answer

podman system linger enable

Answer

usermod --linger=true $USER

Question 10

An administrator needs to inspect container health check logs to determine why recent health checks failed for a container named app_prod. Which command displays the container's health check log history?

Accepted Answer

podman inspect --format='{{json .State.Health.Log}}' app_prod. inspecting State.Health.Log within podman inspect shows recent health check execution details and error outputs.

Answer

podman logs --health app_prod

Answer

podman health-log app_prod

Answer

podman events --health app_prod