EX188 Container Image Building Practice Test 4 — 15 Questions

Question 1

Which THREE behaviors occur when utilizing multi-stage builds in a Containerfile? (Choose three.)

Accepted Answer

You can include multiple 'FROM' instructions in a single Containerfile, where each 'FROM' starts a new stage of the build.. Multi-stage builds allow multiple FROM lines, naming stages, and selective copying between them.

Answer

All intermediate stages are automatically tagged and pushed to the local registry when the build completes.

Answer

Artifacts from earlier stages are automatically merged into the final image layers unless explicitly deleted.

Question 2

Which THREE statements accurately describe the differences between shell form and exec form for CMD and ENTRYPOINT instructions? (Choose three.)

Accepted Answer

Exec form ensures that Unix signals (such as SIGTERM) sent by Podman are received directly by the application process as PID 1.. Option C is correct because in exec form the specified executable is launched directly as PID 1, so signals like SIGTERM sent by Podman (or Docker) are delivered straight to the application, enabling proper graceful shutdown. Option D is correct because exec form uses JSON array syntax such as ["executable", "param"], which is the defining syntactic characteristic of exec form in CMD and ENTRYPOINT instructions. Option E is correct because shell form implicitly wraps the command with '/bin/sh -c', so the shell becomes PID 1 and the actual application runs as a child process, which can prevent it from receiving signals directly. Option A is incorrect because shell form is not mandatory in multi-stage builds; both shell and exec forms work in any build stage. Option B is incorrect because exec form does not perform shell variable expansion of things like $VAR unless you explicitly invoke a shell (e.g., ["/bin/sh", "-c", "echo $VAR"]); it is shell form that provides implicit variable expansion.

Answer

Shell form is mandatory when using multi-stage builds.

Answer

Exec form allows shell variable expansion (like $VAR) directly without needing explicit shell invocation.

Question 3

Which THREE practices should be observed when managing environment variables (ENV vs ARG) in Containerfiles for secure and efficient builds? (Choose three.)

Accepted Answer

Use 'ENV' for configuration parameters that the application needs to read during container runtime.. Option A is correct because ENV variables are baked into the image configuration and are available to the application at runtime, making them the right choice for runtime configuration parameters. Option B is correct because ARG values exist only during the build and, unlike ENV, are not persisted in the final image metadata, so build-only values should use ARG. Option D is correct because an ARG declared before the first FROM is in the global scope and can be referenced in FROM instructions (e.g., ARG BASE=alpine then FROM ${BASE}), enabling base image parameterization. Option C is not correct because ENV variables do not automatically carry over between separate stages in a multi-stage build; each stage starts from its own base and must re-declare or explicitly inherit values. Option E is not correct because ENV values are stored in plaintext in image layers and metadata, so they must never be used for secrets such as API tokens.

Answer

Ensure that 'ENV' variables defined in earlier stages automatically carry over into subsequent multi-stage build stages without re-declaration.

Answer

Use 'ENV' for passing secret API tokens so they are automatically encrypted in the image layers.

Question 4

You are writing a Containerfile to build a custom application image using podman build. Which instruction should you use as the mandatory first non-comment instruction to define the base image?

Accepted Answer

FROM. The FROM instruction is the mandatory first non-comment instruction in a Containerfile (or Dockerfile) because it specifies the base image upon which subsequent instructions operate. Without FROM, the build cannot determine the starting filesystem and will fail. It sets the stage for all following layers, such as RUN, COPY, and CMD.

Answer

IMPORT

Answer

BASE

Answer

INIT

Question 5

An administrator needs to execute a package update and install dependencies during the podman build process, ensuring these commands are committed as a new layer in the final image. Which instruction accomplishes this?

Accepted Answer

RUN. `RUN` executes a command during the image build and commits the resulting filesystem changes as a new layer in the image. Using `RUN dnf update -y && dnf install -y <deps>` performs the package update and dependency install at build time, baking the results into the final image.

Answer

EXEC

Answer

START

Answer

CMD

Question 6

You need to copy local application source code from your build context into the /app directory inside the container image, automatically unpacking it if it is a local tar archive. Which instruction should you select?

Accepted Answer

ADD. The ADD instruction in a Containerfile (Dockerfile) copies files from the build context into the image, and it has the additional feature of automatically unpacking local tar archives and fetching remote URLs. The COPY instruction only copies files and directories without unpacking or fetching. Therefore, ADD is the correct choice when you need to unpack a local tar archive into the image.

Answer

FETCH

Answer

TRANSFER

Answer

COPY

Question 7

By default, podman build executes build instructions using the root user. You want to switch the execution context to a non-privileged user named 'appuser' for all subsequent RUN, CMD, and ENTRYPOINT instructions. Which instruction should you use?

Accepted Answer

USER. The USER instruction in a Containerfile sets the UID (and optionally GID) that subsequent RUN, CMD, and ENTRYPOINT instructions execute as, and it also sets the default user for the running container. Placing USER appuser before the relevant instructions switches the execution context to that non-privileged account.

Answer

LOGIN

Answer

SU

Answer

ACCOUNT

Question 8

You want to set the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it in the Containerfile. Which instruction achieves this?

Accepted Answer

WORKDIR. The WORKDIR instruction sets the working directory for subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions in a Containerfile. If the directory does not exist, WORKDIR creates it automatically, and it can be used multiple times to change context throughout the build.

Answer

DIR

Answer

CD

Answer

PATH

Question 9

You are designing a container image that runs an executable web server. You want to provide default arguments to the executable that can be easily overridden by a user passing arguments directly to 'podman run'. Which instruction combination is best?

Accepted Answer

Use ENTRYPOINT for the binary and CMD for the default arguments.. Using ENTRYPOINT for the binary and CMD for the default arguments is the best practice. When a user runs 'podman run ', the arguments passed on the command line override the CMD instruction, while the ENTRYPOINT remains the executable. This allows the user to easily override default arguments without changing the binary.

Answer

Use ENV for the binary and WORKDIR for the arguments.

Answer

Use RUN for both the binary and the arguments.

Answer

Use CMD for the binary and ENTRYPOINT for the default arguments.

Question 10

You need to define a persistent environment variable named 'PORT' with the value '8080' that is available during both the build process and when running containers from the resulting image. Which instruction should you use?

Accepted Answer

ENV. The ENV instruction in a Containerfile/Dockerfile sets an environment variable that persists both during subsequent build steps (RUN) and in the final image at runtime. Using ENV PORT=8080 makes PORT available to any process started from the resulting image, satisfying the requirement for build-time and runtime availability.

Answer

SET

Answer

VAR

Answer

EXPORT

Question 11

An auditor reviewing your Containerfile notices an EXPOSE instruction for port 80. What is the primary function of the EXPOSE instruction?

Accepted Answer

It documents which ports the container listens on at runtime.. The EXPOSE instruction in a Containerfile is purely metadata — it documents the port the containerized application listens on, so tools like podman and image consumers know which port to publish. It does not actually open, publish, or firewall the port; the operator must still use -p or -P at runtime to map it to a host port.

Answer

It opens firewall ports on the underlying RHEL host system permanently.

Answer

It encrypts network traffic entering the specified container port.

Answer

It automatically publishes all exposed ports to random host ports without flags.

Question 12

You are optimizing a Containerfile using multi-stage builds to minimize image size. What is the key advantage of a multi-stage build in Podman?

Accepted Answer

It allows you to copy only finalized artifacts from a heavy build stage into a minimal production stage.. Multi-stage builds let you use multiple FROM instructions in a single Containerfile, where earlier stages can contain heavy build tools and dependencies, and the final stage copies only the compiled artifacts (binaries, static files) from the build stage. This dramatically reduces the final image size because compilers, SDKs, and intermediate files are discarded. The COPY --from=<stage> instruction is the key mechanism enabling this selective transfer.

Answer

It automatically converts Dockerfiles into systemd service units.

Answer

It enables building container images concurrently across multiple remote container registries.

Answer

It eliminates the need for caching layers during the podman build process.

Question 13

Which TWO of the following instructions in a Containerfile can be written using either the shell form or the exec form?

Accepted Answer

RUN. Option B (RUN) is correct because the RUN instruction supports both the shell form (e.g., RUN apt-get update) and the exec form (e.g., RUN ["apt-get", "update"]), allowing either a shell command string or a JSON array of executable and arguments. Option D (CMD) is correct because CMD likewise accepts both forms: the shell form (CMD echo hello) and the exec form (CMD ["echo", "hello"]), with the exec form being the preferred default-command syntax. Option A (WORKDIR) is not correct because it takes only a plain path argument (WORKDIR /app) and has no exec/shell form distinction. Option C (FROM) is not correct because it specifies an image reference and optional stage name (FROM alpine:3.19 AS build) with no shell or exec form. Option E (ENV) is not correct because it sets variables using key=value syntax (ENV KEY=value) and does not offer an exec-form JSON array variant.

Answer

WORKDIR

Answer

FROM

Answer

ENV

Question 14

Which THREE practices are recommended when optimizing cache utilization during image builds with podman build?

Accepted Answer

Place instructions that change frequently, such as COPYing source code, near the end of the Containerfile.. Option C is correct because placing frequently changing instructions such as COPYing source code near the end of the Containerfile preserves the cache for earlier, stable layers; when source changes, only the final layers are rebuilt. Option D is correct because combining related package installation and cleanup into a single RUN instruction creates one cacheable layer and avoids leaving package-manager metadata or temporary files in intermediate layers, which also reduces image size. Option E is correct because ordering instructions from least frequently changed to most frequently changed maximizes cache hits: stable base and dependency layers stay cached while only the volatile trailing layers are invalidated. Option A is not recommended because --no-cache disables layer caching entirely, forcing full rebuilds and defeating cache optimization for routine builds. Option B is wrong because putting COPY . . at the top invalidates the cache for every subsequent instruction whenever any source file changes, so dependency installation and other expensive steps rerun unnecessarily.

Answer

Use the --no-cache flag on every routine build to ensure absolute freshness.

Answer

Always place COPY . . at the very top of the Containerfile before installing software dependencies.

Question 15

Which TWO instructions can be used to copy files or directories from a build context into a container image?

Accepted Answer

COPY. The COPY instruction is correct because it copies files or directories from the build context (or a stage in a multi-stage build) into the image filesystem, with the syntax COPY ... , and it performs no automatic extraction or remote URL fetching. The ADD instruction is also correct because it likewise copies files or directories from the build context into the image, and additionally supports remote URLs and auto-extraction of local tar archives, though for plain copying COPY is preferred. PULL is not a Dockerfile instruction for transferring build-context files into an image; it describes fetching an image from a registry (docker pull). INSTALL is not a Dockerfile instruction; package installation is done via RUN with a package manager such as apt-get or yum. GET is not a Dockerfile instruction for copying build-context content into an image.

Answer

PULL

Answer

INSTALL

Answer

GET