EX188 Hard Questions — 25 Difficult Questions

Question 1

An administrator is troubleshooting a container that fails its health check repeatedly. The container definition needs a health check that runs curl -f http://localhost/ || exit 1 every 30s, with a 5s timeout and 3 retries, starting after a 10s grace period. Which flag combination implements this correctly in podman run?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

podman run --health-cmd="curl -f http://localhost/ || exit 1" --health-interval=30s --health-timeout=5s --health-retries=3 --health-start-period=10s webapp. The --health-cmd, --health-interval, --health-timeout, --health-retries, and --health-start-period options configure container health checks.

Answer

podman run --healthcheck="curl -f http://localhost/" --interval=30 --timeout=5 --retries=3 webapp

Answer

podman run --health-probe="curl -f http://localhost/" --health-delay=10s webapp

Answer

podman run --check-command="curl -f http://localhost/" --check-period=30s webapp

Question 2

A container named 'worker' was configured with a health check command during build time, but an administrator needs to temporarily override or define a new health check command while running the container. Which flag should be passed to 'podman run' to achieve this?

Accepted Answer

--health-cmd. The '--health-cmd' flag allows defining or overriding the health check command when starting a container.

Answer

--check-command

Answer

--healthcheck-run

Answer

--health-test

Question 3

Which THREE statements accurately describe the differences between shell form and exec form for CMD and ENTRYPOINT instructions? (Choose three.)

Accepted Answer

Exec form ensures that Unix signals (such as SIGTERM) sent by Podman are received directly by the application process as PID 1.. Exec form uses JSON array syntax, avoids running a shell, and correctly passes signals as PID 1.

Answer

Shell form is mandatory when using multi-stage builds.

Answer

Exec form allows shell variable expansion (like $VAR) directly without needing explicit shell invocation.

Question 4

A container named api_gw is configured with a health check. An administrator needs to check the current health status (e.g., healthy, unhealthy, starting) using the command line without reading the full inspect JSON. Which command string achieves this?

Accepted Answer

podman inspect --format='{{json .State.Health.Status}}' api_gw. Using format strings with podman inspect allows extracting specific fields like the health status directly.

Answer

podman health status api_gw

Answer

podman ps --filter health=unhealthy

Answer

podman status api_gw

Question 5

An administrator needs to view the processes running inside a specific container named worker_node, along with custom ps options like -ef to see full command arguments. Which command accomplishes this?

Accepted Answer

podman top worker_node -ef. podman top displays the running processes of a container and accepts ps-compatible argument flags.

Answer

podman ps --processes worker_node

Answer

podman exec worker_node ps -ef

Answer

podman inspect --processes worker_node

Question 6

A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?

Accepted Answer

Into the local GnuPG keyring using 'gpg --import'. Public keys used for verification must be imported into the local GPG keyring managed by GnuPG.

Answer

Into ~/.config/containers/policy.d/keys/

Answer

Into /etc/containers/certs.d/keys/

Answer

Into /var/lib/containers/sigstore/

Question 7

An administrator is troubleshooting container exit codes. A container exited with code 137. What does this specific exit code typically signify in container engines?

Accepted Answer

The container was terminated forcefully by SIGKILL (often due to Out-Of-Memory).. Exit code 137 indicates that the container process was terminated forcibly by the OOM killer or SIGKILL (128 + 9).

Answer

The container executed an invalid system call blocked by seccomp.

Answer

The container encountered an application-level syntax error.

Answer

The container startup script had a permission denied error.

Question 8

A container named 'app_prod' is currently running, and an operator needs to troubleshoot its current configuration, network settings, and mounted volumes in detail. Which THREE commands or approaches can retrieve this information? (Choose THREE)

Accepted Answer

Run 'podman inspect app_prod' to output comprehensive JSON-formatted metadata regarding configuration, mounts, and network settings.. Podman provides several ways to inspect running containers, including 'podman inspect', 'podman port', and 'podman exec' / 'podman top'.

Answer

Run 'podman config app_prod' to print a summary of environment variables and limits.

Answer

Run 'podman diff app_prod' to view changes to the container's file system, which is primarily used for tracking modifications rather than initial configuration.

Question 9

An administrator wants to run a container with a custom health check command that disables health checking entirely for a container that inherited one from its base image. Which flag achieves this?

Accepted Answer

--health-cmd=none. Setting --health-cmd=none disables the health check inherited from the base image.

Answer

--health-enabled=false

Answer

--disable-health

Answer

--no-healthcheck

Question 10

An administrator is troubleshooting process execution and live configuration updates on a running container. Which TWO commands allow interacting with processes or updating resource limits on the fly? (Choose TWO)

Accepted Answer

podman update. podman top shows container processes, and podman update modifies container resources live.

Answer

podman exec-top

Answer

podman adjust

Answer

podman modify

Question 11

An administrator is configuring container health checks and wants to review health status or force immediate actions. Which TWO of the following statements or commands are accurate regarding Podman health checks? (Choose TWO)

Accepted Answer

podman inspect --format='{{json .State.Health.Status}}' can be used to check container health status.. podman inspect with health format templates can retrieve health status, and health checks can be defined at run time using --health-cmd.

Answer

Container health statuses are automatically logged to /var/log/podman-health.log on the host.

Answer

podman stop automatically triggers a health check before shutting down.

Answer

podman health-check status is a valid built-in standalone top-level command.

Question 12

How does Podman's rootless build architecture handle volume mounts or privileged operations specified within a RUN instruction in a Containerfile?

Accepted Answer

Rootless builds execute within user namespaces, mapping root inside the container to an unprivileged user on the host, restricting certain host-level operations.. Rootless Podman utilizes user namespaces and often relies on tools like buildah or fuse-overlayfs to perform builds without root privileges on the host.

Answer

Rootless builds cannot execute RUN instructions that install RPM packages using dnf.

Answer

Rootless builds automatically elevate privileges via sudo when a RUN instruction requires root access.

Answer

Rootless builds require the buildah daemon to be running as root in systemd.

Question 13

An administrator wants to generate a systemd unit file for an existing Podman container named 'app_server' so that it can be managed as a system service. Which command should be used to generate this unit file and write it directly to the user systemd directory?

Accepted Answer

podman generate systemd --new --files --name app_server. The 'podman generate systemd' command is used to create systemd unit files, and the '--new' flag ensures the unit file creates a new container on start rather than relying on an existing stopped container.

Answer

podman export systemd app_server > /etc/systemd/system/app_server.service

Answer

podman service generate --container app_server --output ~/.config/systemd/user/

Answer

podman systemd create --name app_server > ~/.config/systemd/user/container-app_server.service

Question 14

An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?

Accepted Answer

/etc/containers/registries.conf using the unqualified-search-registries parameter. Unqualified search registries are configured in /etc/containers/registries.conf using the unqualified-search-registries array parameter.

Answer

/etc/sysconfig/podman using the SEARCH_REGISTRIES variable

Answer

/etc/containers/registries.d/default.yaml using the search-domains parameter

Answer

~/.config/containers/auth.json using the default-registry key

Question 15

You are optimizing a Containerfile using multi-stage builds to minimize image size. What is the key advantage of a multi-stage build in Podman?

Accepted Answer

It allows you to copy only finalized artifacts from a heavy build stage into a minimal production stage.. Multi-stage builds allow you to use multiple FROM instructions in a single Containerfile. Each FROM instruction starts a new stage with a different base, and you can copy artifacts from previous stages into the final stage, leaving behind build tools, compilers, and SDKs.

Answer

It automatically converts Dockerfiles into systemd service units.

Answer

It enables building container images concurrently across multiple remote container registries.

Answer

It eliminates the need for caching layers during the podman build process.

Question 16

When creating multi-architecture container images using podman build, how can you ensure that architecture-specific binaries are correctly handled when using instructions like COPY?

Accepted Answer

By running podman build separately for each architecture and combining them with podman manifest.. Podman supports building for multiple architectures using buildah/podman features, where TARGETPLATFORM, TARGETOS, and TARGETARCH build args are automatically available.

Answer

By setting the ARCH environment variable in the base image.

Answer

By manually editing the Containerfile to include architecture-specific IF/ELSE statements.

Question 17

An administrator wants to view real-time container lifecycle events across the entire Podman system, such as container creation, starting, and stopping. Which command should be executed?

Accepted Answer

podman events. The podman events command monitors container events in real time.

Answer

podman monitor --stream

Answer

podman logs --follow --events

Answer

podman system trace

Question 18

An administrator needs to update the CPU shares (cpu-shares) of a running container named compute_job on the fly without stopping it. Which command should be used?

Accepted Answer

podman update --cpu-shares 512 compute_job. podman update modifies container configuration resources on a running container.

Answer

podman config compute_job cpu-shares=512

Answer

podman modify --cpu-shares 512 compute_job

Answer

podman set --shares=512 compute_job

Question 19

Which THREE actions occur when an administrator runs a container with an SELinux volume mount suffix ':Z'? (Choose three.)

Accepted Answer

The host path's SELinux context is altered to match the container's private category.. The ':Z' suffix labels the content with a private SELinux context, modifies the host file context if necessary, and ensures isolation from other containers.

Answer

The SELinux enforcement mode on the host is temporarily set to permissive.

Answer

The host directory becomes completely read-only across all namespaces.

Question 20

When using the '--mount' flag, what parameter specifies the type of mount being performed (e.g., bind, volume, tmpfs)?

Accepted Answer

type=. The 'type=' key specifies whether the mount is a bind, volume, or tmpfs mount.

Answer

kind=

Answer

method=

Answer

mount-type=