EX188 Registry And Security Practice Test 4 — 15 Questions

Question 1

Which TWO scenarios correctly describe when an administrator should use the ':z' SELinux mount option instead of ':Z'? (Choose two.)

Accepted Answer

When content generated on the host needs to be safely read and written by multiple container instances using a shared label.. The ':z' option is used when volume content needs to be shared read-write among multiple containers simultaneously.

Answer

When disabling SELinux checks entirely for the volume.

Answer

When absolute isolation is required so that no other container can ever read the volume.

Answer

When mounting a host directory as strictly read-only.

Question 2

Which THREE mechanisms are part of Podman's image signature verification framework on RHEL 9? (Choose three.)

Accepted Answer

Signature storage backends (such as sigstore) where detached signatures are stored.. Image verification relies on policy.json, signature storage transports (sigstore), and public keys.

Answer

Automatic kernel SELinux policy compilation during image pull.

Answer

Built-in TLS client certificate authorities for registry TCP handshakes.

Question 3

Which TWO methods can a user employ to verify that an image has been successfully downloaded to their local machine? (Choose two.)

Accepted Answer

Running 'podman image inspect <image_name>' to view its configuration metadata.. Images can be verified using 'podman images' or 'podman image inspect'.

Answer

Running 'podman network ls' to verify image network attachment.

Answer

Running 'podman ps -a' to see the downloaded image layers.

Answer

Running 'podman volume inspect' to check image storage paths.

Question 4

Which TWO conditions are typically required for rootless container users to successfully map UIDs and GIDs from host accounts to container accounts? (Choose two.)

Accepted Answer

The user account must have assigned ranges in /etc/subuid and /etc/subgid.. Rootless UID/GID mapping requires entries in /etc/subuid and /etc/subgid, and support from user namespaces.

Answer

The user must have root privileges via sudo on the host system.

Answer

The storage driver must be set to vfs exclusively.

Answer

SELinux must be set to disabled mode globally.

Question 5

Which THREE configuration directives or files are associated with customizing container storage backends and root directory locations in Podman? (Choose three.)

Accepted Answer

The environment variables 'CONTAINERS_STORAGE_DRIVER' or 'STORAGE_DRIVER'.. Storage options are configured in /etc/containers/storage.conf, via environment variables like STORAGE_DRIVER, or via user home directory overrides.

Answer

The signature verification policy file '/etc/containers/policy.json'.

Answer

The registry authentication file '~/.config/containers/auth.json'.

Question 6

A container administrator needs to download an image named rhel9/httpd-24 from the Red Hat Ecosystem Catalog using Podman, but requires local authorization without interactive password prompts. Which file should the administrator configure to store these registry credentials in base64-encoded format?

Accepted Answer

~/.config/containers/auth.json. Podman uses the standard Docker-compatible auth configuration file located at $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json to store base64-encoded credentials for registry authentication.

Answer

~/.local/share/containers/storage/mounts

Answer

/etc/containers/registries.conf

Answer

/etc/sysconfig/podman

Question 7

A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?

Accepted Answer

Rootless containers cannot use the :Z or :z SELinux volume options because rootless Podman runs inside a user namespace where process MCS labeling is restricted.. In rootless mode, the underlying user namespace maps the user to a UID/GID range on the host, but the SELinux sandbox limitations in older kernels or certain rootless configurations prevent standard multi-category security (MCS) label translation for shared volumes unless configured correctly. Specifically, the correct SELinux handling for rootless containers using shared volumes often requires relying on the user's process label or using the ':disable' suffix if SELinux is not enforcing within the namespace.

Answer

Rootless containers automatically disable SELinux enforcement for all mounted volumes, bypassing container isolation.

Answer

The SELinux policy enforcement level must be set to permissive globally across the entire RHEL host.

Answer

The host directory must be owned by the root user before mounting into a rootless container.

Question 8

A developer wants to push a locally built container image named webapp:v1 to a private container registry located at registry.local:5000/myteam/. Which sequence of commands correctly tags and pushes the image?

Accepted Answer

podman tag localhost/webapp:v1 registry.local:5000/myteam/webapp:v1 followed by podman push registry.local:5000/myteam/webapp:v1. Before pushing an image to a specific remote registry namespace, it must be tagged with the fully qualified registry URL, path, and tag using 'podman tag', followed by 'podman push'.

Answer

podman push webapp:v1 --registry registry.local:5000/myteam/

Answer

podman commit webapp:v1 registry.local:5000/myteam/webapp:v1

Answer

podman export webapp:v1 > registry.local:5000/myteam/webapp:v1.tar

Question 9

An organization mandates that all container images produced internally must be signed using local GPG keys before being pushed to the production registry. Which tool and configuration file must be used to enforce that Podman rejects unsigned images during a pull operation?

Accepted Answer

/etc/containers/policy.json. To enforce signature verification on pull, the policy file /etc/containers/policy.json must be updated to specify 'reject' by default and configure a 'transport' and 'signedBy' requirement for specific registry scopes.

Answer

/etc/containers/registries.conf

Answer

/var/lib/shared/sigstore

Answer

~/.config/containers/auth.json

Question 10

A system administrator logs into a RHEL 9 server as a regular non-root user and executes 'podman ps'. The command succeeds, but no containers are displayed. What architecture feature enables this user to run containers without root privileges?

Accepted Answer

Linux user namespaces and subuid/subgid mapping. Rootless Podman utilizes user namespaces (user_namespaces(7)) to map the unprivileged user to a set of UIDs and GIDs inside the container environment, combined with shadow-utils mapping files.

Answer

The Docker daemon running as a system service in user space

Answer

The systemd-logind setuid binary wrapper

Answer

SELinux multi-category security (MCS) translation tables

Question 11

An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?

Accepted Answer

/etc/containers/registries.conf using the unqualified-search-registries parameter. Unqualified search registries are configured in /etc/containers/registries.conf using the unqualified-search-registries array parameter.

Answer

/etc/sysconfig/podman using the SEARCH_REGISTRIES variable

Answer

/etc/containers/registries.d/default.yaml using the search-domains parameter

Answer

~/.config/containers/auth.json using the default-registry key

Question 12

A user running a rootless container needs to inspect which subordinate UID and GID ranges have been allocated to their user account on the RHEL 9 host. Which files define these mappings?

Accepted Answer

/etc/subuid and /etc/subgid. Subordinate user and group ID ranges allocated for rootless namespaces are defined in /etc/subuid and /etc/subgid respectively.

Answer

/etc/passwd and /etc/group

Answer

/etc/security/limits.conf

Answer

~/.config/containers/storage.conf

Question 13

Which TWO actions are required when configuring a secure container workflow to push a signed image to a registry using Podman? (Choose two.)

Accepted Answer

Generate a cryptographic key pair and ensure the private key is available to sign the image.. Pushing a signed image requires generating a local key pair (e.g., using GPG), configuring the signature storage destination in registries.d, and signing the image during or after the push process using podman push or podman image sign.

Answer

Disable SELinux enforcement globally on the container host before generating signatures.

Answer

Store the private signing key inside the container image payload.

Answer

Set the container storage driver to vfs in storage.conf.

Question 14

An administrator is troubleshooting an issue where a rootless container cannot access a host file because of SELinux denials. Which THREE statements accurately describe how SELinux interacts with rootless Podman containers on RHEL 9? (Choose three.)

Accepted Answer

Rootless containers run under the user's unprivileged process context and are still constrained by SELinux policy rules.. Rootless containers run in user namespaces. While they do not have root privileges, SELinux still applies constraints. Specifically, rootless containers run under an unprivileged user process label (such as unconfined_u:unconfined_r:unconfined_t:s0 or similar user-space mappings), cannot dynamically relabel arbitrary host paths using container tools with the same privileges as root, and rely on container process confinement governed by the active SELinux policy.

Answer

Rootless containers completely disable SELinux enforcement automatically upon startup.

Answer

Rootless containers require the container host to be booted with selinux=0 kernel parameter to function.

Question 15

When interacting with container registries using Podman, which THREE commands or tasks are valid operations supported natively by the Podman CLI? (Choose three.)

Accepted Answer

podman pull registry.example.com/image:tag. Podman natively supports pulling, pushing, tagging, logging into, and searching container registries using standard commands matching Docker syntax.

Answer

podman mount-registry --remote

Answer

podman compile-image --from-registry