EX188 Registry And Security Practice Test 1 — 15 Questions

Question 1

An administrator configures rootless Podman on RHEL 9. For container user namespace mapping to function correctly for a specific user account, entries must be present in which two system files?

Accepted Answer

/etc/subuid and /etc/subgid. Rootless user namespaces rely on /etc/subuid and /etc/subgid.

Answer

/etc/passwd and /etc/group

Answer

/etc/containers/namespace.conf and /etc/containers/users.conf

Answer

/etc/security/limits.conf and /etc/login.defs

Question 2

A security officer wants to disable all signature checking for a specific insecure test registry in /etc/containers/policy.json. What transport matching rule should be configured under 'transports'?

Accepted Answer

Set the transport rule for that registry prefix to 'accept'. Policy matching is configured under the 'transports' key in policy.json, often using 'reject', 'accept', or 'signedBy'.

Answer

Set the rule to 'bypass-security'

Answer

Remove the registry entry entirely from policy.json

Answer

Set the rule to 'ignore-signatures'

Question 3

An administrator is configuring Podman on a RHEL 9 host to pull images from an internal, insecure container registry at registry.example.com:5000 using HTTP instead of TLS. Where should this registry address be added to allow unencrypted communication?

Accepted Answer

~/.config/containers/policy.json. The /etc/containers/registries.conf file contains the [registries.insecure] table (or unqualified-search-registries and registries.block configurations) where insecure registries lacking TLS certificates can be explicitly declared.

Answer

/etc/hosts

Answer

/etc/containers/registries.d/default.yaml

Question 4

An administrator needs to configure a custom search domain for short-name image pulls across all users on a RHEL 9 system. Which configuration file must be edited?

Accepted Answer

/etc/containers/registries.conf. System-wide registry configurations, including unqualified-search-registries, are defined in /etc/containers/registries.conf.

Answer

/etc/containers/storage.conf

Answer

/etc/containers/policy.json

Answer

/etc/containers/registries.d/

Question 5

A user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?

Accepted Answer

~/.config/containers/registries.conf. For rootless users, insecure registries are configured in ~/.config/containers/registries.conf.

Answer

~/.local/share/containers/storage.conf

Answer

/etc/sysconfig/podman

Answer

/etc/containers/registries.conf

Question 6

A user wants to inspect the metadata and layers of an image stored locally without running it. Which Podman command should be used?

Accepted Answer

podman inspect image_name. 'podman inspect' provides detailed configuration and metadata for an image or container.

Answer

podman view image_name

Answer

podman info

Answer

podman show image_name

Question 7

A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?

Accepted Answer

/etc/containers/policy.json. The signature verification policy is defined in /etc/containers/policy.json.

Answer

/etc/containers/signatures.yaml

Answer

~/.config/containers/policy.json

Answer

/etc/containers/registries.conf

Question 8

An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?

Accepted Answer

podman login registry.example.com. Before pushing an image to a registry, you must authenticate using 'podman login'.

Answer

podman push --auth registry.example.com

Answer

podman auth registry.example.com

Answer

podman connect registry.example.com

Question 9

After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?

Accepted Answer

podman tag myapp:v1 registry.example.com/myteam/myapp:latest. 'podman tag' is used to create an additional tag that points to an existing local image ID.

Answer

podman rename myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman commit myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman push myapp:v1 --target registry.example.com/myteam/myapp:latest

Question 10

A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?

Accepted Answer

:z. The ':z' or ':Z' suffix handles SELinux relabeling for volume mounts.

Answer

:ro

Answer

:shared

Answer

:exec

Question 11

An administrator needs to run a container that requires access to the host's network stack directly, bypassing network isolation. Which flag should be passed to 'podman run'?

Accepted Answer

--network host. Passing '--net=host' or '--network=host' disables network namespace isolation.

Answer

--share network

Answer

--privileged

Answer

--net bridge

Question 12

When configuring a secure private registry that uses a self-signed TLS certificate, a user receives an x509 certificate signed by an unknown authority error when pulling images. Where should the CA certificate file be placed on a RHEL system for system-wide trust?

Accepted Answer

/etc/containers/certs.d/registry.example.com/ca.crt. Custom CA certificates for registries are placed in /etc/containers/certs.d/<registry-name>/ or /etc/docker/certs.d/.

Answer

/etc/pki/ca-trust/source/anchors/registry.crt

Answer

/usr/share/pki/trust/anchors/ca.crt

Answer

~/.config/containers/certs.d/ca.crt

Question 13

A user wants to remove all unused container images that are not currently associated with an existing container from local storage. Which command should they execute?

Accepted Answer

podman image prune -a. 'podman image prune' removes unused images.

Answer

podman container prune

Answer

podman rmi --all

Answer

podman system clean

Question 14

An administrator wants to inspect the container storage configuration settings, such as graph root and storage driver, on a RHEL system. Which configuration file should they examine?

Accepted Answer

/etc/containers/storage.conf. Storage settings for containers are defined in /etc/containers/storage.conf.

Answer

/etc/containers/podman.conf

Answer

/etc/containers/registries.conf

Answer

/etc/sysconfig/docker

Question 15

A user wants to save a locally stored container image to a tar archive file to transfer it across systems without a registry. Which command should they use?

Accepted Answer

podman save -o image.tar image_name. 'podman save' exports an image to a tarball archive.

Answer

podman export -o image.tar container_name

Answer

podman backup image_name

Answer

podman dump image_name