EX188 Registry And Security — 10 Questions

Question 1

An administrator configures rootless Podman on RHEL 9. For container user namespace mapping to function correctly for a specific user account, entries must be present in which two system files?

Accepted Answer

/etc/subuid and /etc/subgid. Rootless user namespaces rely on /etc/subuid and /etc/subgid.

Answer

/etc/passwd and /etc/group

Answer

/etc/containers/namespace.conf and /etc/containers/users.conf

Answer

/etc/security/limits.conf and /etc/login.defs

Question 2

A security officer wants to disable all signature checking for a specific insecure test registry in /etc/containers/policy.json. What transport matching rule should be configured under 'transports'?

Accepted Answer

Set the transport rule for that registry prefix to 'accept'. Policy matching is configured under the 'transports' key in policy.json, often using 'reject', 'accept', or 'signedBy'.

Answer

Set the rule to 'bypass-security'

Answer

Remove the registry entry entirely from policy.json

Answer

Set the rule to 'ignore-signatures'

Question 3

An administrator is configuring Podman on a RHEL 9 host to pull images from an internal, insecure container registry at registry.example.com:5000 using HTTP instead of TLS. Where should this registry address be added to allow unencrypted communication?

Accepted Answer

~/.config/containers/policy.json. The /etc/containers/registries.conf file contains the [registries.insecure] table (or unqualified-search-registries and registries.block configurations) where insecure registries lacking TLS certificates can be explicitly declared.

Answer

/etc/hosts

Answer

/etc/containers/registries.d/default.yaml

Question 4

An administrator needs to configure a custom search domain for short-name image pulls across all users on a RHEL 9 system. Which configuration file must be edited?

Accepted Answer

/etc/containers/registries.conf. System-wide registry configurations, including unqualified-search-registries, are defined in /etc/containers/registries.conf.

Answer

/etc/containers/storage.conf

Answer

/etc/containers/policy.json

Answer

/etc/containers/registries.d/

Question 5

A user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?

Accepted Answer

~/.config/containers/registries.conf. For rootless users, insecure registries are configured in ~/.config/containers/registries.conf.

Answer

~/.local/share/containers/storage.conf

Answer

/etc/sysconfig/podman

Answer

/etc/containers/registries.conf

Question 6

A user wants to inspect the metadata and layers of an image stored locally without running it. Which Podman command should be used?

Accepted Answer

podman inspect image_name. 'podman inspect' provides detailed configuration and metadata for an image or container.

Answer

podman view image_name

Answer

podman info

Answer

podman show image_name

Question 7

A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?

Accepted Answer

/etc/containers/policy.json. The signature verification policy is defined in /etc/containers/policy.json.

Answer

/etc/containers/signatures.yaml

Answer

~/.config/containers/policy.json

Answer

/etc/containers/registries.conf

Question 8

An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?

Accepted Answer

podman login registry.example.com. Before pushing an image to a registry, you must authenticate using 'podman login'.

Answer

podman push --auth registry.example.com

Answer

podman auth registry.example.com

Answer

podman connect registry.example.com

Question 9

After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?

Accepted Answer

podman tag myapp:v1 registry.example.com/myteam/myapp:latest. 'podman tag' is used to create an additional tag that points to an existing local image ID.

Answer

podman rename myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman commit myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman push myapp:v1 --target registry.example.com/myteam/myapp:latest

Question 10

A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?

Accepted Answer

:z. The ':z' or ':Z' suffix handles SELinux relabeling for volume mounts.

Answer

:ro

Answer

:shared

Answer

:exec