EX188 Registry And Security Practice Test 3 — 15 Questions

Question 1

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

:Z. The `:Z` suffix applies a private, unshared SELinux label to the volume mount, meaning the content is exclusively accessible by that single container. This is appropriate when the host directory should not be shared with other containers, as it relabels the content with a unique MCS category.

Answer

:z

Answer

:private

Answer

:seclabel

Question 2

A user is running rootless Podman and needs to verify why a container cannot bind to TCP port 80. By default, unprivileged users cannot bind to ports below 1024. Which parameter controls the minimum unprivileged port that can be bound?

Accepted Answer

net.ipv4.ip_unprivileged_port_start. The sysctl parameter net.ipv4.ip_unprivileged_port_start defines the lowest port number that unprivileged (non-root) users are permitted to bind. By default it is set to 1024, which is why rootless Podman containers cannot bind to port 80. Lowering this value (e.g., to 80 or 0) allows unprivileged processes to bind to lower ports.

Answer

user.max_user_namespaces

Answer

net.ipv4.tcp_port_range

Answer

fs.inotify.max_user_watches

Question 3

An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?

Accepted Answer

[[registry]]
prefix = "registry.example.com"
location = "internal-mirror.example.com". Podman's `/etc/containers/registries.conf` uses TOML, and a registry block is defined with `[[registry]]` (an array of tables). The `prefix` field specifies the registry hostname to match, and `location` specifies the mirror to use instead, so `[[registry]]` with `prefix` and `location` is the correct syntax.

Answer

registry:
  name: registry.example.com
  mirror: internal-mirror.example.com

Answer

SERVER=registry.example.com
MIRROR=internal-mirror.example.com

Answer

[registry "registry.example.com"]
mirror = "internal-mirror.example.com"

Question 4

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

Accepted Answer

podman load -i app.tar. The podman load command reads a container image from a tar archive and imports it into local container storage. The -i flag specifies the input file, so podman load -i app.tar loads the image from app.tar. This is the standard way to restore an image previously saved with podman save.

Answer

podman import app.tar

Answer

podman restore -i app.tar

Answer

podman read app.tar

Question 5

A container running in rootless mode needs to map a user account on the host to a different user inside the container namespace. Which options configure UID and GID mapping?

Accepted Answer

--uidmap and --gidmap. The --uidmap and --gidmap options are used with podman run to define custom UID and GID mappings between the host and the container user namespace. These flags allow fine-grained control over how host UIDs map to container UIDs, which is essential in rootless mode where the user namespace is already in play. They accept values in the format container_uid:host_uid:count.

Answer

--userns-map and --groupmap

Answer

--user-namespace-file

Answer

--map-user and --map-group

Question 6

A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?

Accepted Answer

Into the local GnuPG keyring using 'gpg --import'. For the dir:// transport, Podman verifies signatures using keys in the local GnuPG keyring, so the public key must be imported with 'gpg --import' into the user's keyring (or root's, depending on context). The signedBy field in policy.json references a key fingerprint that Podman looks up in that keyring during verification.

Answer

Into ~/.config/containers/policy.d/keys/

Answer

Into /etc/containers/certs.d/keys/

Answer

Into /var/lib/containers/sigstore/

Question 7

A user needs to log out from a private container registry to remove stored credentials from their local machine. Which command accomplishes this?

Accepted Answer

podman logout registry.example.com. 'podman logout' removes stored credentials for a registry.

Answer

podman rm auth registry.example.com

Answer

podman clear-credentials registry.example.com

Answer

podman disconnect registry.example.com

Question 8

An administrator configures rootless Podman on RHEL 9. For container user namespace mapping to function correctly for a specific user account, entries must be present in which two system files?

Accepted Answer

/etc/subuid and /etc/subgid. Rootless user namespaces rely on /etc/subuid and /etc/subgid.

Answer

/etc/passwd and /etc/group

Answer

/etc/containers/namespace.conf and /etc/containers/users.conf

Answer

/etc/security/limits.conf and /etc/login.defs

Question 9

A practitioner wants to view all container images currently stored in local storage, including their size, tag, and image ID. Which command should they execute?

Accepted Answer

podman images. The `podman images` command lists all container images in local storage, displaying repository, tag, image ID, creation time, and size. It is the direct equivalent of `docker images` and is the standard way to inspect the local image cache. Options A, C, and D are not valid Podman subcommands for listing images.

Answer

podman list images

Answer

podman show images

Answer

podman ps -a

Question 10

A user needs to remove a local container image that is no longer needed. Which command should be used?

Accepted Answer

podman rmi image_name. `podman rmi` is the dedicated image-removal subcommand; it accepts an image name or ID and deletes the local image from container storage. It is the Podman equivalent of `docker rmi` and is the canonical command documented for removing images.

Answer

podman image delete image_name

Answer

podman rm image_name

Answer

podman delete image_name

Question 11

A security team requires that all container processes run with a specific SELinux type instead of the default container_t. How can an administrator specify a custom SELinux type when launching a container with 'podman run'?

Accepted Answer

--security-opt label=type:custom_t. The `--security-opt label=type:custom_t` flag tells Podman to apply the specified SELinux type to the container's processes instead of the default container_t. This is the correct syntax for overriding SELinux labels at container launch. The label=type: prefix is part of Podman's security-opt grammar for SELinux process labeling.

Answer

--selinux-type custom_t

Answer

--cap-add SELINUX

Answer

--env SELINUX_TYPE=custom_t

Question 12

A user running rootless Podman wants to check the disk space consumed by images and containers in local storage. Which command provides this storage usage summary?

Accepted Answer

podman system df. podman system df reports disk usage for images, containers, volumes, and the build cache, similar to docker system df. It shows total, active, and reclaimable space, making it the correct command for a storage usage summary in rootless Podman. The output helps identify what can be pruned with podman system prune.

Answer

df -h podman

Answer

podman storage status

Answer

podman disk usage

Question 13

An administrator wants to configure Podman to pull images using a specific TLS client certificate for mutual TLS authentication against a secure private registry. Where should the client certificate and private key be placed?

Accepted Answer

/etc/containers/certs.d/registry.example.com/ (with client.cert and client.key). Podman (via containers/image) looks for registry-specific TLS client certificates in /etc/containers/certs.d/<registry-hostname>/, where files named client.cert and client.key provide the mutual TLS credentials. This is the documented location for per-registry TLS configuration.

Answer

~/.config/containers/tls/

Answer

/etc/pki/tls/private/

Answer

/etc/containers/auth.d/

Question 14

A user needs to download an image from Docker Hub named 'library/alpine' using its explicit transport prefix. Which command demonstrates the correct transport syntax?

Accepted Answer

podman pull docker://alpine:latest. The correct transport for pulling from a Docker registry like Docker Hub is 'docker://'. The command 'podman pull docker://alpine:latest' explicitly tells Podman to use the Docker transport to fetch the 'library/alpine' image from Docker Hub. This syntax is part of Podman's support for multiple transports, where 'docker://' is the standard prefix for registry-based images.

Answer

podman pull registry://alpine:latest

Answer

podman pull remote://alpine:latest

Answer

podman pull OCI://alpine:latest

Question 15

A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?

Accepted Answer

It turns off SELinux separation and labeling for the container.. The '--security-opt label=disable' flag in Podman disables SELinux labeling for the container. This means that the container processes are not confined by SELinux policies, and the container can access files without SELinux context restrictions. This is often used when SELinux is causing permission issues, but it reduces security. The flag specifically turns off SELinux separation, not seccomp, user namespaces, or AppArmor.

Answer

It disables seccomp system call filtering.

Answer

It disables user namespace mapping.

Answer

It disables AppArmor enforcement.