EX188 Registry And Security Practice Test 3 — 15 Questions

Question 1

An administrator wants to configure Podman to pull images using a specific TLS client certificate for mutual TLS authentication against a secure private registry. Where should the client certificate and private key be placed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

/etc/containers/certs.d/registry.example.com/ (with client.cert and client.key). Client certificates and keys are placed in /etc/containers/certs.d/<registry-name>/.

Answer

~/.config/containers/tls/

Answer

/etc/pki/tls/private/

Answer

/etc/containers/auth.d/

Question 2

A user needs to download an image from Docker Hub named 'library/alpine' using its explicit transport prefix. Which command demonstrates the correct transport syntax?

Accepted Answer

podman pull docker://alpine:latest. Podman supports explicit transport prefixes like docker://.

Answer

podman pull registry://alpine:latest

Answer

podman pull remote://alpine:latest

Answer

podman pull OCI://alpine:latest

Question 3

A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?

Accepted Answer

It turns off SELinux separation and labeling for the container.. The '--security-opt label=disable' flag disables SELinux separation for that specific container.

Answer

It disables seccomp system call filtering.

Answer

It disables user namespace mapping.

Answer

It disables AppArmor enforcement.

Question 4

An administrator needs to set up a local directory to act as an OCI-compliant layout image store, and then push an image into it using Podman. Which transport prefix is used for local OCI layout directories?

Accepted Answer

oci:directory_path:tag. The 'oci:' transport prefix is used for local OCI layout directories.

Answer

tar:directory_path:tag

Answer

dir:directory_path:tag

Answer

local:directory_path:tag

Question 5

A developer wants to search for all available container images matching the term 'rhel9' across configured registries using Podman. Which command should they run?

Accepted Answer

podman search rhel9. 'podman search' queries configured registries for matching images.

Answer

podman find rhel9

Answer

podman query rhel9

Answer

podman lookup rhel9

Question 6

Which TWO configuration files or directories are routinely modified when establishing secure private container registry trust and signature policies on RHEL 9? (Choose two.)

Accepted Answer

/etc/containers/registries.conf. Registry definitions and security policies are configured in /etc/containers/registries.conf and /etc/containers/policy.json.

Answer

/etc/fstab

Answer

/etc/hosts

Answer

/etc/passwd

Question 7

Which THREE methods or options can be used to authenticate or supply credentials when pulling images from a private registry that requires authentication? (Choose three.)

Accepted Answer

Running 'podman login' beforehand to store credentials in auth.json.. Authentication can occur via interactive 'podman login', passing credentials on the CLI, or referencing a stored auth file.

Answer

Setting the environment variable 'PODMAN_PASSWORD' without any login command.

Answer

Passing '--password-stdin' directly to 'podman pull'.

Question 8

Which TWO actions can an administrator take to manage container image tags in local Podman storage? (Choose two.)

Accepted Answer

Use 'podman rmi' to remove a specific image tag from local storage.. Podman allows tagging existing images with 'podman tag' and removing tags/images with 'podman rmi'.

Answer

Use 'podman push --tag' to rename images remotely.

Answer

Use 'podman rename' to change an image tag.

Answer

Use 'podman commit --tag' to tag running containers during creation.

Question 9

Which TWO commands are used to transfer container images via archive files without interacting with a network registry? (Choose two.)

Accepted Answer

podman save. 'podman save' exports images to tar archives and 'podman load' imports them.

Answer

podman import

Answer

podman export

Answer

podman transfer

Question 10

Which TWO commands display information about container images present in local Podman storage? (Choose two.)

Accepted Answer

podman image inspect. 'podman images' and 'podman image inspect' display local image information.

Answer

podman container list

Answer

podman ps

Answer

podman volume ls

Question 11

Which TWO settings or files are critical when configuring rootless Podman environments on RHEL 9? (Choose two.)

Accepted Answer

/etc/subuid and /etc/subgid for user namespace allocations.. Rootless Podman relies on subordinate UIDs/GIDs in /etc/subuid and /etc/subgid, and user configurations in ~/.config/containers/.

Answer

/etc/selinux/config for enforcing SELinux mode.

Answer

/etc/sudoers for root privileges.

Answer

/etc/shadow for root password hashes.

Question 12

Which THREE actions occur when an administrator runs a container with an SELinux volume mount suffix ':Z'? (Choose three.)

Accepted Answer

The host path's SELinux context is altered to match the container's private category.. The ':Z' suffix labels the content with a private SELinux context, modifies the host file context if necessary, and ensures isolation from other containers.

Answer

The SELinux enforcement mode on the host is temporarily set to permissive.

Answer

The host directory becomes completely read-only across all namespaces.

Question 13

Which TWO commands allow a user to remove unwanted items from local Podman storage? (Choose two.)

Accepted Answer

podman rmi. 'podman rmi' removes images and 'podman rm' removes containers.

Answer

podman container clear

Answer

podman prune-all

Answer

podman image delete

Question 14

Which THREE tasks can be performed using the 'podman system' command set? (Choose three.)

Accepted Answer

Displaying storage disk space usage statistics with 'podman system df'.. 'podman system' subcommands include df, migrate, prune, and service.

Answer

Configuring system-wide kernel sysctl parameters for container networking.

Answer

Automatically updating all running systemd container services.

Question 15

Which TWO parameters or directives can be configured inside '/etc/containers/registries.conf' to control how Podman interacts with container registries? (Choose two.)

Accepted Answer

[[registry]] for defining prefix matching, mirrors, and insecure registries.. registries.conf handles unqualified search registries and registry blocking/mirroring.

Answer

default_transport

Answer

storage_driver

Answer

signature_policy_file