An administrator needs to configure a custom search domain for short-name image pulls across all users on a RHEL 9 system. Which configuration file must be edited?
When configuring a secure private registry that uses a self-signed TLS certificate, a user receives an x509 certificate signed by an unknown authority error when pulling images. Where should the CA certificate file be placed on a RHEL system for system-wide trust?
A user wants to remove all unused container images that are not currently associated with an existing container from local storage. Which command should they execute?
A developer needs to pull an image from a private registry that requires credentials without running an interactive shell session. Where are the authentication credentials stored after a successful 'podman login' command?
An organization enforces that all container images must be signed using a local GPG key before they can be deployed in production. Which command generates a signature for an image stored in local storage using a specific signing key?
An administrator wants to prevent users from pulling images from any registry except 'registry.access.redhat.com'. Where should this restriction be configured?
An administrator needs to configure a local container registry mirror that redirects all requests for 'registry.redhat.io' to an internal caching proxy 'mirror.corp.local'. Which section of /etc/containers/registries.conf must be modified?
A security officer wants to disable all signature checking for a specific insecure test registry in /etc/containers/policy.json. What transport matching rule should be configured under 'transports'?
An administrator needs to set up a local directory to act as an OCI-compliant layout image store, and then push an image into it using Podman. Which transport prefix is used for local OCI layout directories?
Which TWO parameters or directives can be configured inside '/etc/containers/registries.conf' to control how Podman interacts with container registries? (Choose two.)
Which THREE configuration directives or files are associated with customizing container storage backends and root directory locations in Podman? (Choose three.)
A container administrator needs to download an image named rhel9/httpd-24 from the Red Hat Ecosystem Catalog using Podman, but requires local authorization without interactive password prompts. Which file should the administrator configure to store these registry credentials in base64-encoded format?
An administrator is configuring Podman on a RHEL 9 host to pull images from an internal, insecure container registry at registry.example.com:5000 using HTTP instead of TLS. Where should this registry address be added to allow unencrypted communication?
A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?
An administrator is troubleshooting an issue where a rootless container cannot access a host file because of SELinux denials. Which THREE statements accurately describe how SELinux interacts with rootless Podman containers on RHEL 9? (Choose three.)
A container image stored in an OCI registry is signed with a GPG key. A rootless Podman user on a RHEL 9 system needs to validate that signature automatically during `podman pull`. Which file should the user edit to define the trust policy that Podman applies to the registry?
An administrator wants to prevent all users on a RHEL 9 system from pulling images from any registry except registry.access.redhat.com. Which configuration change achieves this?
A rootless Podman user needs to authenticate to a private registry that requires credentials. The user wants to avoid storing the password in plain text on disk. Which TWO methods satisfy this requirement? (Choose two.)
A user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?
An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?
After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?
A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?
An administrator needs to run a container that requires access to the host's network stack directly, bypassing network isolation. Which flag should be passed to 'podman run'?
An administrator wants to inspect the container storage configuration settings, such as graph root and storage driver, on a RHEL system. Which configuration file should they examine?
A user wants to save a locally stored container image to a tar archive file to transfer it across systems without a registry. Which command should they use?
An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?
A user is running rootless Podman and needs to verify why a container cannot bind to TCP port 80. By default, unprivileged users cannot bind to ports below 1024. Which parameter controls the minimum unprivileged port that can be bound?
An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?
A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?
A container running in rootless mode needs to map a user account on the host to a different user inside the container namespace. Which options configure UID and GID mapping?
A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?
An administrator configures rootless Podman on RHEL 9. For container user namespace mapping to function correctly for a specific user account, entries must be present in which two system files?
A practitioner wants to view all container images currently stored in local storage, including their size, tag, and image ID. Which command should they execute?
A security team requires that all container processes run with a specific SELinux type instead of the default container_t. How can an administrator specify a custom SELinux type when launching a container with 'podman run'?
A user running rootless Podman wants to check the disk space consumed by images and containers in local storage. Which command provides this storage usage summary?
An administrator wants to configure Podman to pull images using a specific TLS client certificate for mutual TLS authentication against a secure private registry. Where should the client certificate and private key be placed?
A user needs to download an image from Docker Hub named 'library/alpine' using its explicit transport prefix. Which command demonstrates the correct transport syntax?
A developer wants to search for all available container images matching the term 'rhel9' across configured registries using Podman. Which command should they run?
Which TWO configuration files or directories are routinely modified when establishing secure private container registry trust and signature policies on RHEL 9? (Choose two.)
Which THREE methods or options can be used to authenticate or supply credentials when pulling images from a private registry that requires authentication? (Choose three.)
Which TWO conditions are typically required for rootless container users to successfully map UIDs and GIDs from host accounts to container accounts? (Choose two.)
A developer wants to push a locally built container image named webapp:v1 to a private container registry located at registry.local:5000/myteam/. Which sequence of commands correctly tags and pushes the image?
An organization mandates that all container images produced internally must be signed using local GPG keys before being pushed to the production registry. Which tool and configuration file must be used to enforce that Podman rejects unsigned images during a pull operation?
A system administrator logs into a RHEL 9 server as a regular non-root user and executes 'podman ps'. The command succeeds, but no containers are displayed. What architecture feature enables this user to run containers without root privileges?
An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?
A user running a rootless container needs to inspect which subordinate UID and GID ranges have been allocated to their user account on the RHEL 9 host. Which files define these mappings?
When interacting with container registries using Podman, which THREE commands or tasks are valid operations supported natively by the Podman CLI? (Choose three.)
A security-conscious administrator runs a rootless Podman container that must bind-mount a directory from the host. The container process is denied access to the files even though the directory has world-readable permissions, and SELinux is enforcing. Which TWO steps will resolve the denial while keeping SELinux enforcing? (Choose two.)
A developer needs to push a locally built image to a private registry that requires authentication. The registry uses a self-signed certificate, and the developer wants Podman to trust that certificate for this registry only. Which action should be taken?
A user wants to inspect the effective signature verification policy that Podman will apply when pulling images, without modifying any files. Which command displays the current policy configuration?
A rootless Podman user must run a container that needs to write to a bind-mounted host directory. The container consistently fails with permission denied. The host directory is owned by the user and has mode 0775. SELinux is enforcing. Which action will allow the container to write to the directory without disabling SELinux?
A developer needs to pull a private image from quay.io. The registry requires authentication. Which command should the developer use to store credentials for quay.io so that subsequent `podman pull` operations succeed without prompting?