EX188 Registry And Security Practice Test 4 — 15 Questions

Question 1

A developer wants to search for all available container images matching the term 'rhel9' across configured registries using Podman. Which command should they run?

Accepted Answer

podman search rhel9. The `podman search` command queries configured container registries for images matching the given term. Running `podman search rhel9` returns a list of repositories and images whose names or descriptions contain 'rhel9'. This is the correct command for discovering available images across registries.

Answer

podman find rhel9

Answer

podman query rhel9

Answer

podman lookup rhel9

Question 2

Which TWO configuration files or directories are routinely modified when establishing secure private container registry trust and signature policies on RHEL 9? (Choose two.)

Accepted Answer

/etc/containers/registries.conf. Option B, /etc/containers/registries.conf, is correct because it is the primary configuration file used by container tools such as Podman and Skopeo to define registry trust settings, including which registries are allowed, blocked, or treated as insecure, and it can reference registry-specific configuration directories. Option E, /etc/containers/policy.json, is correct because it defines the signature verification policy that container engines apply when pulling images, specifying which keys or signed identities are trusted for particular registries or repositories. Together, these files establish both registry access trust and image signature enforcement on RHEL 9. Option A, /etc/fstab, is incorrect because it defines filesystem mount points and has nothing to do with container registry trust. Option C, /etc/hosts, is incorrect because it only provides static hostname-to-IP mappings. Option D, /etc/passwd, is incorrect because it stores local user account information, not container registry or signature policy settings.

Answer

/etc/fstab

Answer

/etc/hosts

Answer

/etc/passwd

Question 3

Which THREE methods or options can be used to authenticate or supply credentials when pulling images from a private registry that requires authentication? (Choose three.)

Accepted Answer

Running 'podman login' beforehand to store credentials in auth.json.. Option A is correct because 'podman login' stores the registry credentials in the auth.json file (typically under $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json), and subsequent 'podman pull' operations automatically read those stored credentials. Option D is correct because the '--authfile' flag lets you point 'podman pull' at a custom credentials file in the same JSON format, which is useful for non-default credential locations or automation. Option E is correct because 'podman pull --creds username:password' supplies the credentials inline for that single command, authenticating directly against the private registry without a prior login. Option B is not a valid mechanism: Podman does not read a 'PODMAN_PASSWORD' environment variable to authenticate pulls, so setting it alone has no effect. Option C is not valid because '--password-stdin' is an option of 'podman login' (to read the password from standard input), not of 'podman pull', so it cannot be passed directly to the pull command.

Answer

Setting the environment variable 'PODMAN_PASSWORD' without any login command.

Answer

Passing '--password-stdin' directly to 'podman pull'.

Question 4

Which TWO actions can an administrator take to manage container image tags in local Podman storage? (Choose two.)

Accepted Answer

Use 'podman rmi' to remove a specific image tag from local storage.. Option A is correct because 'podman rmi' removes images from local storage, and when given a tag reference (e.g., 'podman rmi myimage:oldtag') it deletes that specific tag; if it is the last tag on the image, the underlying image is also removed. Option D is correct because 'podman tag' creates an additional name/tag pointing to an existing local image ID (e.g., 'podman tag IMAGE_ID repo/name:newtag'), which is the standard way to assign a new tag without rebuilding or pushing. Option B is wrong because 'podman push --tag' does not exist as a rename mechanism; push transfers an image to a registry and does not manage local tags. Option C is wrong because 'podman rename' renames containers, not images, so it cannot change an image tag. Option E is wrong because 'podman commit' creates a new image from a container's changes and does not accept a '--tag' flag for tagging during creation.

Answer

Use 'podman push --tag' to rename images remotely.

Answer

Use 'podman rename' to change an image tag.

Answer

Use 'podman commit --tag' to tag running containers during creation.

Question 5

Which TWO commands are used to transfer container images via archive files without interacting with a network registry? (Choose two.)

Accepted Answer

podman save. Option A, `podman save`, is correct because it serializes one or more local container images into an archive file (e.g., a tarball) on disk, which can then be moved to another host without contacting a registry. Option D, `podman load`, is correct because it reads such an image archive produced by `podman save` and restores the image(s) into the local container storage, again with no network registry involved. Together, `podman save` and `podman load` form the standard offline image transfer pair. Option B, `podman import`, is not correct here because it creates an image from a filesystem tarball (often produced by `podman export`), not from a saved image archive. Option C, `podman export`, is not correct because it exports a running or existing container's filesystem to a tar file, not a container image. Option E, `podman transfer`, is not a valid Podman command for this purpose.

Answer

podman import

Answer

podman export

Answer

podman transfer

Question 6

Which THREE actions occur when an administrator runs a container with an SELinux volume mount suffix ':Z'? (Choose three.)

Accepted Answer

The host path's SELinux context is altered to match the container's private category.. Option A is correct because the ':Z' suffix instructs the container runtime (e.g., podman/docker with SELinux) to relabel the host path's SELinux context, changing its type and adding a unique MCS category so it matches the container's private label. Option C is correct because ':Z' applies a private, unshared SELinux context (a unique category pair) to the mounted content, unlike ':z' which applies a shared label. Option E is correct because the private MCS category ensures that only the specific container launched with that flag can access the labeled files while SELinux is enforcing, preventing other containers from accessing them. Option B is incorrect because ':Z' does not change the host's SELinux enforcement mode to permissive; enforcement remains as configured. Option D is incorrect because ':Z' only relabels the content and does not make the host directory read-only across all namespaces.

Answer

The SELinux enforcement mode on the host is temporarily set to permissive.

Answer

The host directory becomes completely read-only across all namespaces.

Question 7

Which TWO commands allow a user to remove unwanted items from local Podman storage? (Choose two.)

Accepted Answer

podman rmi. Option B, `podman rmi`, is correct because it removes one or more images from local Podman storage, deleting the image layers and metadata from the local image store. Option D, `podman rm`, is correct because it removes one or more containers from local Podman storage, cleaning up stopped containers that are no longer wanted. Both commands directly target unwanted local objects (images and containers respectively) and are the standard Podman subcommands for deletion. Option A, `podman container clear`, is not a valid Podman subcommand, so it cannot remove anything. Option C, `podman prune-all`, is not a real Podman command; pruning is done via `podman system prune` or `podman image prune`/`podman container prune`. Option E, `podman image delete`, is not a valid Podman subcommand; image deletion is performed with `podman rmi` (or `podman image rm`).

Answer

podman container clear

Answer

podman prune-all

Answer

podman image delete

Question 8

Which THREE tasks can be performed using the 'podman system' command set? (Choose three.)

Accepted Answer

Displaying storage disk space usage statistics with 'podman system df'.. Option B is correct because 'podman system df' reports disk space usage statistics for Podman-managed storage, showing total, active, and reclaimable space for images, containers, and volumes. Option C is correct because 'podman system service' starts a background process that exposes the Podman REST API (Docker-compatible) on a socket, enabling remote clients to manage containers. Option E is correct because 'podman system prune' removes unused containers, images, networks, and optionally volumes, reclaiming storage. Option A is not part of the 'podman system' command set; sysctl parameters are configured via 'sysctl' or container runtime settings, not Podman. Option D is also not provided by 'podman system'; automatic updates of systemd container services are handled by tools like 'podman auto-update' or systemd timers, not the 'podman system' subcommands.

Answer

Configuring system-wide kernel sysctl parameters for container networking.

Answer

Automatically updating all running systemd container services.

Question 9

Which THREE mechanisms are part of Podman's image signature verification framework on RHEL 9? (Choose three.)

Accepted Answer

Signature storage backends (such as sigstore) where detached signatures are stored.. Podman's image signature verification framework on RHEL 9 relies on three core components. Option A is correct because signature storage backends (for example, the sigstore backend configured in registries.d YAML files) define where detached signatures are fetched from and stored during verification. Option D is correct because /etc/containers/policy.json is the policy configuration file that specifies which repositories or transports require signature verification and what type of verification (such as signedBy) must pass. Option E is correct because GnuPG public key rings (referenced via keyPath or keyData in policy.json) supply the cryptographic keys used to validate the detached image signatures. Option B is not part of this framework, since SELinux policy compilation is unrelated to image signature verification and is not triggered by image pulls. Option C is also incorrect because TLS client certificate authorities for registry handshakes belong to transport-level TLS authentication, not to Podman's signature verification framework.

Answer

Automatic kernel SELinux policy compilation during image pull.

Answer

Built-in TLS client certificate authorities for registry TCP handshakes.

Question 10

Which TWO methods can a user employ to verify that an image has been successfully downloaded to their local machine? (Choose two.)

Accepted Answer

Running 'podman image inspect ' to view its configuration metadata.. Option B is correct because 'podman image inspect ' returns the image's configuration metadata (such as its ID, layers, and creation details) from the local image store, which only succeeds if the image was actually downloaded and is present locally. Option E is correct because 'podman images' lists all images in local storage with their repository, tag, image ID, and size, so seeing the expected name and tag confirms the download completed. Option A is wrong because 'podman network ls' lists configured networks, not images, and has nothing to do with verifying a downloaded image. Option C is wrong because 'podman ps -a' lists containers (running and stopped), not image layers, so it cannot confirm an image download. Option D is wrong because 'podman volume inspect' reports on volumes, not image storage paths or downloaded images.

Answer

Running 'podman network ls' to verify image network attachment.

Answer

Running 'podman ps -a' to see the downloaded image layers.

Answer

Running 'podman volume inspect' to check image storage paths.

Question 11

Which TWO conditions are typically required for rootless container users to successfully map UIDs and GIDs from host accounts to container accounts? (Choose two.)

Accepted Answer

The user account must have assigned ranges in /etc/subuid and /etc/subgid.. Option A is correct because rootless containers rely on subordinate UID/GID mappings, which are defined per-user in /etc/subuid and /etc/subgid; without an assigned range, the user namespace cannot map container IDs to unprivileged host IDs. Option C is correct because user namespaces are the kernel feature that makes rootless UID/GID mapping possible, and on RHEL 9 this support is enabled by default. Option B is incorrect because rootless containers are specifically designed to run without root or sudo privileges on the host. Option D is incorrect because the vfs storage driver is not required for UID/GID mapping and is generally used only as a fallback due to poor performance. Option E is incorrect because disabling SELinux globally is not a prerequisite for rootless containers and would weaken host security.

Answer

The user must have root privileges via sudo on the host system.

Answer

The storage driver must be set to vfs exclusively.

Answer

SELinux must be set to disabled mode globally.

Question 12

A developer wants to push a locally built container image named webapp:v1 to a private container registry located at registry.local:5000/myteam/. Which sequence of commands correctly tags and pushes the image?

Accepted Answer

podman tag localhost/webapp:v1 registry.local:5000/myteam/webapp:v1 followed by podman push registry.local:5000/myteam/webapp:v1. The correct workflow requires first creating a new tag that includes the full registry path (registry.local:5000/myteam/webapp:v1) pointing to the existing local image, then pushing that fully-qualified reference. The 'podman tag' command creates an additional name for the same image without copying layers, and 'podman push' uses the registry-qualified name to determine the destination. This two-step approach is required because podman push does not accept a separate --registry flag to redirect an existing local name.

Answer

podman push webapp:v1 --registry registry.local:5000/myteam/

Answer

podman commit webapp:v1 registry.local:5000/myteam/webapp:v1

Answer

podman export webapp:v1 > registry.local:5000/myteam/webapp:v1.tar

Question 13

An organization mandates that all container images produced internally must be signed using local GPG keys before being pushed to the production registry. Which tool and configuration file must be used to enforce that Podman rejects unsigned images during a pull operation?

Accepted Answer

/etc/containers/policy.json. Signature enforcement for image pulls is controlled by /etc/containers/policy.json, which defines per-transport and per-registry requirements such as 'signedBy' with a GPG keyring. To reject unsigned images, the policy must specify a signedBy requirement (or 'reject') for the relevant registry scope, causing Podman to fail the pull if the signature is missing or invalid.

Answer

/etc/containers/registries.conf

Answer

/var/lib/shared/sigstore

Answer

~/.config/containers/auth.json

Question 14

A system administrator logs into a RHEL 9 server as a regular non-root user and executes 'podman ps'. The command succeeds, but no containers are displayed. What architecture feature enables this user to run containers without root privileges?

Accepted Answer

Linux user namespaces and subuid/subgid mapping. Rootless Podman relies on Linux user namespaces combined with subordinate UID/GID ranges defined in /etc/subuid and /etc/subgid. The user namespace maps the container's root (UID 0) to the unprivileged user's UID on the host, and additional container UIDs map into the allocated subuid/subgid ranges. This lets a non-root user run containers without any setuid daemon.

Answer

The Docker daemon running as a system service in user space

Answer

The systemd-logind setuid binary wrapper

Answer

SELinux multi-category security (MCS) translation tables

Question 15

An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?

Accepted Answer

/etc/containers/registries.conf using the unqualified-search-registries parameter. The /etc/containers/registries.conf file contains the unqualified-search-registries parameter, which lists registries to search when a user pulls an image without specifying a registry. Adding registry.access.redhat.com to this list allows podman pull rhel9 to automatically expand to registry.access.redhat.com/rhel9.

Answer

/etc/sysconfig/podman using the SEARCH_REGISTRIES variable

Answer

/etc/containers/registries.d/default.yaml using the search-domains parameter

Answer

~/.config/containers/auth.json using the default-registry key