EX188 Registry And Security Practice Test 2 — 15 Questions

Question 1

An administrator is configuring Podman on a RHEL 9 host to pull images from an internal, insecure container registry at registry.example.com:5000 using HTTP instead of TLS. Where should this registry address be added to allow unencrypted communication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

~/.config/containers/policy.json. The /etc/containers/registries.conf file contains the [registries.insecure] table (or unqualified-search-registries and registries.block configurations) where insecure registries lacking TLS certificates can be explicitly declared.

Answer

/etc/hosts

Answer

/etc/containers/registries.d/default.yaml

Question 2

A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?

Accepted Answer

Rootless containers cannot use the :Z or :z SELinux volume options because rootless Podman runs inside a user namespace where process MCS labeling is restricted.. In rootless Podman, the container process runs inside a user namespace, and the MCS (Multi-Category Security) categories used by SELinux to label container processes are drawn from the user's own MCS range, which is typically limited to a single category pair (e.g., c0,c1). The :Z option requires relabeling the host directory with a category that matches the container's process label, but rootless users cannot assign arbitrary MCS categories to files they don't own at the system level, and the relabel operation is restricted. As a result, the volume mount cannot be properly relabeled and the container process is denied write access.

Answer

Rootless containers automatically disable SELinux enforcement for all mounted volumes, bypassing container isolation.

Answer

The SELinux policy enforcement level must be set to permissive globally across the entire RHEL host.

Answer

The host directory must be owned by the root user before mounting into a rootless container.

Question 3

An administrator is troubleshooting an issue where a rootless container cannot access a host file because of SELinux denials. Which THREE statements accurately describe how SELinux interacts with rootless Podman containers on RHEL 9? (Choose three.)

Accepted Answer

Rootless containers run under the user's unprivileged process context and are still constrained by SELinux policy rules.. Option A is correct because rootless Podman containers still execute as the invoking unprivileged user (e.g., user_u:user_r:user_t or unconfined_u:unconfined_r:unconfined_t) and remain subject to the loaded SELinux policy, so denials such as AVC messages can occur even without root. Option D is correct because SELinux MCS uses category sets (e.g., c1,c2) assigned to each container's processes and files, and these categories keep containers from different users (or different containers) from accessing each other's resources, effectively preventing escape into other users' namespaces. Option E is correct because a rootless user lacks the CAP_MAC_ADMIN capability and the SELinux policy does not permit unprivileged domains to relabel arbitrary host files, so commands like chcon or setfiles on host paths fail unless the user is granted elevated privileges or the file is relabeled by an administrator. Option B is incorrect because SELinux enforcement is never automatically disabled for rootless containers; the policy remains active regardless of rootless mode. Option C is incorrect because rootless Podman works fine with SELinux enforcing, and booting with selinux=0 is not a requirement — it would actually remove the protection rather than enable the container to run.

Answer

Rootless containers completely disable SELinux enforcement automatically upon startup.

Answer

Rootless containers require the container host to be booted with selinux=0 kernel parameter to function.

Question 4

A container image stored in an OCI registry is signed with a GPG key. A rootless Podman user on a RHEL 9 system needs to validate that signature automatically during `podman pull`. Which file should the user edit to define the trust policy that Podman applies to the registry?

Accepted Answer

/etc/containers/policy.json. Podman evaluates image signatures during pull using the trust policy defined in /etc/containers/policy.json. That file maps registries and repositories to requirements such as signedBy with specific GPG keys. Configuring it correctly causes Podman to reject unsigned or improperly signed images, satisfying the need to validate the GPG signature automatically during pull.

Answer

/etc/containers/registries.d/default.yaml

Answer

/etc/containers/registries.conf.d/99-signature.conf

Answer

~/.config/containers/registries.conf

Question 5

An administrator wants to prevent all users on a RHEL 9 system from pulling images from any registry except registry.access.redhat.com. Which configuration change achieves this?

Accepted Answer

Set `blocked_registries = ["*", "!registry.access.redhat.com"]` in /etc/containers/registries.conf.. The blocked_registries option in registries.conf can enforce an allowlist by blocking all registries with a wildcard and then negating the allowed one. This ensures that only registry.access.redhat.com is permitted, while any other registry is denied for image pulls across the system.

Answer

Set `unqualified-search-registries = ["registry.access.redhat.com"]` in /etc/containers/registries.conf.

Answer

Add `registry.access.redhat.com` to the `blocked_registries` list in /etc/containers/registries.conf.

Answer

Remove all other registry entries from /etc/containers/registries.conf.

Question 6

A rootless Podman user needs to authenticate to a private registry that requires credentials. The user wants to avoid storing the password in plain text on disk. Which TWO methods satisfy this requirement? (Choose two.)

Accepted Answer

Use `podman login --username user --password-stdin` and pipe the password from a secure secret manager.. The two methods that avoid plain-text password storage during authentication are piping the password via standard input and using command substitution to retrieve it from a secure vault. Both prevent the password from being exposed in shell history or process arguments, and neither stores the password in plain text outside of the auth file, which is a standard requirement.

Answer

Set the `REGISTRY_AUTH_FILE` environment variable to a file containing the password in plain text.

Answer

Use `podman login` and when prompted, paste the password; Podman encrypts the auth file automatically.

Answer

Use `podman login --authfile` with a file that is encrypted using a tool like `gpg` and decrypted on the fly.

Question 7

A user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?

Accepted Answer

~/.config/containers/registries.conf. For rootless Podman, user-specific configuration files take precedence over system-wide ones. The correct location to define an insecure registry for a single user is ~/.config/containers/registries.conf, which is the per-user override for /etc/containers/registries.conf. Podman reads this file when running as a non-root user, allowing the user to specify registries as insecure without requiring root privileges. This is part of the containers/image configuration stack, and the user-level file is the proper place for such customizations.

Answer

~/.local/share/containers/storage.conf

Answer

/etc/sysconfig/podman

Answer

/etc/containers/registries.conf

Question 8

A user wants to inspect the metadata and layers of an image stored locally without running it. Which Podman command should be used?

Accepted Answer

podman inspect image_name. 'podman inspect image_name' returns detailed JSON metadata about the image, including its layers, configuration, environment variables, and creation history, without running it. This is the standard command for examining local image details.

Answer

podman view image_name

Answer

podman info

Answer

podman show image_name

Question 9

A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?

Accepted Answer

/etc/containers/policy.json. The default system-wide signature policy file for container image verification on RHEL 9 is located at /etc/containers/policy.json. This file defines the policy for validating image signatures using tools like podman and skopeo.

Answer

/etc/containers/signatures.yaml

Answer

~/.config/containers/policy.json

Answer

/etc/containers/registries.conf

Question 10

An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?

Accepted Answer

podman login registry.example.com. The correct command is `podman login registry.example.com` because it authenticates the user to the specified container registry, storing credentials in the local authentication file (typically `${XDG_RUNTIME_DIR}/containers/auth.json`). This step is required before any push operation to a private registry, as it establishes the necessary session and permissions. Without a successful login, `podman push` would fail with an authentication error.

Answer

podman push --auth registry.example.com

Answer

podman auth registry.example.com

Answer

podman connect registry.example.com

Question 11

After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?

Accepted Answer

podman tag myapp:v1 registry.example.com/myteam/myapp:latest. The podman tag command creates a new tag that points to the same image ID as an existing local image. Running podman tag myapp:v1 registry.example.com/myteam/myapp:latest adds the fully qualified registry tag to the local image, preparing it for a push to that registry.

Answer

podman rename myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman commit myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman push myapp:v1 --target registry.example.com/myteam/myapp:latest

Question 12

A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?

Accepted Answer

:z. The `:z` volume option tells Podman to relabel the host directory with the SELinux context expected by the container process (typically `container_file_t`), allowing the confined container to read and write the mount. Without it, the directory retains its host label (e.g., `user_home_t` or `default_t`), and SELinux denies the container's writes even though Unix permissions look fine.

Answer

:ro

Answer

:shared

Answer

:exec

Question 13

An administrator needs to run a container that requires access to the host's network stack directly, bypassing network isolation. Which flag should be passed to 'podman run'?

Accepted Answer

--network host. The `--network host` flag makes the container share the host's network namespace, so it uses the host's IP address, routing table, and ports directly without network isolation. This is the correct way to bypass network isolation and give the container direct access to the host network stack.

Answer

--share network

Answer

--privileged

Answer

--net bridge

Question 14

An administrator wants to inspect the container storage configuration settings, such as graph root and storage driver, on a RHEL system. Which configuration file should they examine?

Accepted Answer

/etc/containers/storage.conf. The /etc/containers/storage.conf file is the primary configuration file for container storage on RHEL systems using Podman. It defines settings such as the storage driver (e.g., overlay) and the graph root directory where container images and layers are stored. Administrators inspect this file to understand or modify how container storage is managed.

Answer

/etc/containers/podman.conf

Answer

/etc/containers/registries.conf

Answer

/etc/sysconfig/docker

Question 15

A user wants to save a locally stored container image to a tar archive file to transfer it across systems without a registry. Which command should they use?

Accepted Answer

podman save -o image.tar image_name. 'podman save -o image.tar image_name' exports a locally stored image to a tar archive, preserving all layers and metadata. This is the correct command for transferring images between systems without a registry.

Answer

podman export -o image.tar container_name

Answer

podman backup image_name

Answer

podman dump image_name