EX188 Registry And Security Practice Test 2 — 15 Questions

Question 1

A developer needs to pull an image from a private registry that requires credentials without running an interactive shell session. Where are the authentication credentials stored after a successful 'podman login' command?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

~/.config/containers/auth.json. Login credentials are saved in the auth.json file, typically located in $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json.

Answer

/etc/passwd

Answer

~/.ssh/authorized_keys

Answer

/etc/containers/login.conf

Question 2

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

Accepted Answer

:Z. The ':Z' suffix assigns a private unshared SELinux label to the volume.

Answer

:z

Answer

:private

Answer

:seclabel

Question 3

A user is running rootless Podman and needs to verify why a container cannot bind to TCP port 80. By default, unprivileged users cannot bind to ports below 1024. Which parameter controls the minimum unprivileged port that can be bound?

Accepted Answer

net.ipv4.ip_unprivileged_port_start. The sysctl parameter net.ipv4.ip_unprivileged_port_start controls the lowest port unprivileged users can bind to.

Answer

user.max_user_namespaces

Answer

net.ipv4.tcp_port_range

Answer

fs.inotify.max_user_watches

Question 4

An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?

Accepted Answer

[[registry]]
prefix = "registry.example.com"
location = "internal-mirror.example.com". TOML syntax in registries.conf uses [[registry]] tables and registries.search or registries.block fields alongside mirrors.

Answer

registry:
  name: registry.example.com
  mirror: internal-mirror.example.com

Answer

SERVER=registry.example.com
MIRROR=internal-mirror.example.com

Answer

[registry "registry.example.com"]
mirror = "internal-mirror.example.com"

Question 5

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

Accepted Answer

podman load -i app.tar. 'podman load' imports an image from a tar archive.

Answer

podman import app.tar

Answer

podman restore -i app.tar

Answer

podman read app.tar

Question 6

A container running in rootless mode needs to map a user account on the host to a different user inside the container namespace. Which options configure UID and GID mapping?

Accepted Answer

--uidmap and --gidmap. UID/GID mappings are configured using --uidmap and --gidmap.

Answer

--userns-map and --groupmap

Answer

--user-namespace-file

Answer

--map-user and --map-group

Question 7

An organization enforces that all container images must be signed using a local GPG key before they can be deployed in production. Which command generates a signature for an image stored in local storage using a specific signing key?

Accepted Answer

podman image sign --sign-by <key_id> registry.example.com/app:latest. 'podman image sign' is used to sign images for verification policies.

Answer

podman push --sign-by <key_id> app:latest

Answer

podman gpg --sign app:latest

Answer

podman sign --key <key_id> app:latest

Question 8

A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?

Accepted Answer

Into the local GnuPG keyring using 'gpg --import'. Public keys used for verification must be imported into the local GPG keyring managed by GnuPG.

Answer

Into ~/.config/containers/policy.d/keys/

Answer

Into /etc/containers/certs.d/keys/

Answer

Into /var/lib/containers/sigstore/

Question 9

A user needs to log out from a private container registry to remove stored credentials from their local machine. Which command accomplishes this?

Accepted Answer

podman logout registry.example.com. 'podman logout' removes stored credentials for a registry.

Answer

podman rm auth registry.example.com

Answer

podman clear-credentials registry.example.com

Answer

podman disconnect registry.example.com

Question 10

An administrator wants to prevent users from pulling images from any registry except 'registry.access.redhat.com'. Where should this restriction be configured?

Accepted Answer

/etc/containers/registries.conf under 'unqualified-search-registries' and blocked registries lists. Registry blocking is configured in /etc/containers/registries.conf using the unqualified-search-registries or blocked registries directives.

Answer

/etc/containers/policy.json under 'default' block rules

Answer

/etc/containers/storage.conf under 'block-pull'

Answer

~/.config/containers/access.conf

Question 11

A practitioner wants to view all container images currently stored in local storage, including their size, tag, and image ID. Which command should they execute?

Accepted Answer

podman images. 'podman images' lists all locally stored images.

Answer

podman list images

Answer

podman show images

Answer

podman ps -a

Question 12

A user needs to remove a local container image that is no longer needed. Which command should be used?

Accepted Answer

podman rmi image_name. 'podman rmi' removes one or more local images.

Answer

podman image delete image_name

Answer

podman rm image_name

Answer

podman delete image_name

Question 13

A security team requires that all container processes run with a specific SELinux type instead of the default container_t. How can an administrator specify a custom SELinux type when launching a container with 'podman run'?

Accepted Answer

--security-opt label=type:custom_t. The '--security-opt' flag can be used to set custom SELinux labels (e.g., label=type:custom_t).

Answer

--selinux-type custom_t

Answer

--cap-add SELINUX

Answer

--env SELINUX_TYPE=custom_t

Question 14

An administrator needs to configure a local container registry mirror that redirects all requests for 'registry.redhat.io' to an internal caching proxy 'mirror.corp.local'. Which section of /etc/containers/registries.conf must be modified?

Accepted Answer

[[registry]] with prefix and location/mirrors parameters. Mirrors are configured under the [[registry]] table in registries.conf.

Answer

[registries.search]
mirrors = [...]

Answer

[mirror "registry.redhat.io"]

Answer

[cache.registry]
proxy = [...]

Question 15

A user running rootless Podman wants to check the disk space consumed by images and containers in local storage. Which command provides this storage usage summary?

Accepted Answer

podman system df. 'podman system df' reports disk space usage for Podman storage.

Answer

df -h podman

Answer

podman storage status

Answer

podman disk usage