EX188 Networking And Compose Practice Test 3 — 15 Questions

Question 1

You want to create a Podman network with a specific subnet and gateway. Which command correctly specifies these parameters?

Accepted Answer

podman network create --subnet 192.168.200.0/24 --gateway 192.168.200.1 customnet. The `podman network create` command accepts `--subnet` to define the CIDR block and `--gateway` to set the gateway IP for the new network, with the network name as the positional argument at the end. Option A uses both flags correctly with valid syntax, creating a network named `customnet` on 192.168.200.0/24 with gateway 192.168.200.1. This is the canonical form documented in podman-network-create(1).

Answer

podman network create --ip-range 192.168.200.0/24 customnet

Answer

podman network new --subnet=192.168.200.0/24 customnet

Answer

podman network create customnet --network 192.168.200.0/24

Question 2

Which command removes all unused Podman networks that are not currently connected to any containers?

Accepted Answer

podman network prune. 'podman network prune' deletes unused networks.

Answer

podman network clean

Answer

podman network rm --unused

Answer

podman prune networks

Question 3

When generating a Kubernetes Pod YAML from a Podman container using 'podman generate kubernetes', how are published ports mapped into the resulting Kubernetes manifest?

Accepted Answer

They are translated into container port definitions within the containers spec array.. When generating a Kubernetes Pod YAML from a Podman container, published ports are translated into containerPort entries within the containers spec array. This reflects the container's exposed ports in the Kubernetes manifest, allowing the Pod to declare which ports it listens on.

Answer

They are converted into host-level iptables rules embedded in annotations.

Answer

They are ignored entirely and must be added manually.

Answer

They cause the generation command to fail with a port conflict error.

Question 4

You need to inspect the network traffic of a container by capturing packets on its virtual interface. Where can you find the host-side veth interface name associated with a running container?

Accepted Answer

In the container's network inspection output under network interface details.. The host-side veth interface name is found in the container's network inspection output, typically via 'podman inspect <container>' under the 'NetworkSettings' or 'Networks' section, which lists the interface name and its peer. This allows the admin to identify the correct veth to capture packets on.

Answer

It is always named 'eth0' on the host system.

Answer

In the /etc/resolv.conf file inside the container.

Answer

In the systemd journal logs exclusively.

Question 5

You have created a Podman pod and want to launch two containers inside this pod so they share the same network namespace. How do you specify this during container creation?

Accepted Answer

podman run --pod mypod -d myimage. The --pod flag on podman run attaches a new container to an existing pod, and all containers in the same pod share the pod's network namespace (and by default its IPC and UTS namespaces). So podman run --pod mypod -d myimage launches the container inside the pod with shared networking. This is the standard way to add containers to a pod after the pod is created.

Answer

podman run --share-namespace mypod -d myimage

Answer

podman pod connect mypod myimage

Answer

podman run --network pod:mypod -d myimage

Question 6

How do you check the logs of all services managed by a Podman Compose file?

Accepted Answer

podman-compose logs. 'podman-compose logs' displays log output from all services defined in the compose file.

Answer

podman-compose monitor

Answer

podman-compose output

Answer

podman logs --compose

Question 7

Which environment file option can be used in a Podman Compose file to automatically load environment variables for service configuration?

Accepted Answer

env_file. In Podman Compose (and Docker Compose), the env_file key within a service definition specifies one or more files containing environment variables in KEY=VALUE format that are loaded into the container at runtime. This is the standard, documented way to inject environment variables from a file rather than listing them inline under environment:. Podman Compose implements this key for compatibility with the Compose specification.

Answer

environment_source

Answer

variables_file

Answer

load_env

Question 8

You need to configure container DNS servers explicitly when running a container, overriding the host's /etc/resolv.conf settings. Which Podman flag do you use?

Accepted Answer

--dns 8.8.8.8. The '--dns' flag on 'podman run' explicitly sets the DNS server(s) inside the container's /etc/resolv.conf, overriding what would otherwise be inherited from the host. Passing '--dns 8.8.8.8' makes the container use Google's public resolver for name lookups, regardless of the host's resolver configuration.

Answer

--resolv-conf custom

Answer

--nameserver 8.8.8.8

Answer

--dns-search 8.8.8.8

Question 9

When deploying containers using Podman Compose, what is the default network driver assigned to user-defined networks created by compose if no driver is specified?

Accepted Answer

bridge. When Podman Compose creates a user-defined network without an explicit driver, it defaults to the bridge driver, matching Docker Compose behavior. The bridge driver creates a local software bridge on the host, giving containers on that network isolated L2 connectivity and automatic DNS-based name resolution among them.

Answer

host

Answer

macvlan

Answer

overlay

Question 10

Which TWO actions can be performed using the 'podman network' subcommand? (Choose two.)

Accepted Answer

ls. Option C (ls) is correct because 'podman network ls' lists all the container networks configured on the system, which is a core function of the 'podman network' subcommand. Option E (rm) is correct because 'podman network rm' removes one or more specified networks, another valid operation under the 'podman network' subcommand. The unmarked options do not belong: 'start' (A) is used with containers (e.g., 'podman start'), not networks; 'build' (B) is used to build images (e.g., 'podman build'), not networks; and 'commit' (D) creates an image from a container's changes (e.g., 'podman commit'), which is unrelated to network management.

Answer

start

Answer

build

Answer

commit

Question 11

Which THREE configuration keys are valid within a service definition block in a Podman Compose file for managing container networking and ports? (Choose three.)

Accepted Answer

ports. In a Podman Compose service definition, the ports key is valid because it publishes container ports to the host using the standard HOST:CONTAINER syntax, which is essential for managing port mappings. The expose key is also valid because it documents and exposes container ports to linked services on the internal network without publishing them to the host. The networks key is valid because it attaches a service to one or more named networks defined in the top-level networks section, enabling container-to-container networking. The interfaces key is not a Compose service configuration key, as interface naming is handled by the container runtime rather than the Compose file. The firewall key is not part of the Compose specification; firewall rules are managed by the host's firewall tooling, not by service definitions.

Answer

interfaces

Answer

firewall

Question 12

Which TWO files or backend network management utilities are heavily relied upon by Podman for container networking stack configuration on modern Linux distributions? (Choose two.)

Accepted Answer

aardvark-dns. Option E, netavark, is correct because it is the default OCI container network backend for Podman on modern Linux distributions, responsible for setting up container network interfaces, bridges, and firewall rules. Option A, aardvark-dns, is correct because it is the authoritative DNS server that Podman relies on to provide name resolution between containers on the same network, working alongside netavark. Together, netavark and aardvark-dns replaced the older CNI-based stack as Podman's default networking solution. Option B, libnetwork, is incorrect because it is Docker's networking library, not Podman's backend. Option C, docker-proxy, is incorrect because it is a Docker component for port forwarding, not used by Podman. Option D, iptables-nft, is incorrect because although Podman may interact with nftables through netavark, iptables-nft itself is not a Podman-specific networking utility relied upon for stack configuration.

Answer

libnetwork

Answer

docker-proxy

Answer

iptables-nft

Question 13

An administrator needs to run a container that shares the host's network namespace directly so it can listen on privileged ports without port forwarding. Which Podman command flag achieves this network mode?

Accepted Answer

--network host. The `--network host` flag runs the container in the host's network namespace, meaning it shares the host's IP address and can bind to privileged ports (e.g., port 80) without port forwarding. This is the correct flag for the described requirement.

Answer

--network bridge

Answer

--publish-all

Answer

--net=none

Question 14

You are troubleshooting a container that should have no network access whatsoever for security isolation. Which networking option should you apply?

Accepted Answer

--network none. `--network none` is the Podman option that places the container in an isolated network namespace containing only the loopback interface, providing complete network isolation. This is exactly what is required when a container must have no network access whatsoever for security reasons. It removes all external interfaces and prevents any inbound or outbound traffic beyond the container itself.

Answer

--network isolated

Answer

--network bridge

Answer

--network host

Question 15

A containerized web service must be accessible from the host system on TCP port 8080, while the application inside the container listens on port 80. Which flag correctly configures this port mapping?

Accepted Answer

-p 8080:80. The `-p` (or `--publish`) flag maps a host port to a container port using the syntax `-p HOST_PORT:CONTAINER_PORT`. Since the host must expose TCP 8080 and the application inside the container listens on port 80, the correct mapping is `-p 8080:80`. This forwards traffic arriving on host port 8080 to container port 80.

Answer

--expose 8080:80

Answer

-p 80:8080

Answer

--port-map 8080=80