EX188 Registry And Security — Timed 20 Questions

Question 1

An administrator configures rootless Podman on RHEL 9. For container user namespace mapping to function correctly for a specific user account, entries must be present in which two system files?

Accepted Answer

/etc/subuid and /etc/subgid. Rootless user namespaces rely on /etc/subuid and /etc/subgid.

Answer

/etc/passwd and /etc/group

Answer

/etc/containers/namespace.conf and /etc/containers/users.conf

Answer

/etc/security/limits.conf and /etc/login.defs

Question 2

A security officer wants to disable all signature checking for a specific insecure test registry in /etc/containers/policy.json. What transport matching rule should be configured under 'transports'?

Accepted Answer

Set the transport rule for that registry prefix to 'accept'. Policy matching is configured under the 'transports' key in policy.json, often using 'reject', 'accept', or 'signedBy'.

Answer

Set the rule to 'bypass-security'

Answer

Remove the registry entry entirely from policy.json

Answer

Set the rule to 'ignore-signatures'

Question 3

An administrator is configuring Podman on a RHEL 9 host to pull images from an internal, insecure container registry at registry.example.com:5000 using HTTP instead of TLS. Where should this registry address be added to allow unencrypted communication?

Accepted Answer

~/.config/containers/policy.json. The /etc/containers/registries.conf file contains the [registries.insecure] table (or unqualified-search-registries and registries.block configurations) where insecure registries lacking TLS certificates can be explicitly declared.

Answer

/etc/hosts

Answer

/etc/containers/registries.d/default.yaml

Question 4

An administrator needs to configure a custom search domain for short-name image pulls across all users on a RHEL 9 system. Which configuration file must be edited?

Accepted Answer

/etc/containers/registries.conf. System-wide registry configurations, including unqualified-search-registries, are defined in /etc/containers/registries.conf.

Answer

/etc/containers/storage.conf

Answer

/etc/containers/policy.json

Answer

/etc/containers/registries.d/

Question 5

A user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?

Accepted Answer

~/.config/containers/registries.conf. For rootless users, insecure registries are configured in ~/.config/containers/registries.conf.

Answer

~/.local/share/containers/storage.conf

Answer

/etc/sysconfig/podman

Answer

/etc/containers/registries.conf

Question 6

A user wants to inspect the metadata and layers of an image stored locally without running it. Which Podman command should be used?

Accepted Answer

podman inspect image_name. 'podman inspect' provides detailed configuration and metadata for an image or container.

Answer

podman view image_name

Answer

podman info

Answer

podman show image_name

Question 7

A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?

Accepted Answer

/etc/containers/policy.json. The signature verification policy is defined in /etc/containers/policy.json.

Answer

/etc/containers/signatures.yaml

Answer

~/.config/containers/policy.json

Answer

/etc/containers/registries.conf

Question 8

An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?

Accepted Answer

podman login registry.example.com. Before pushing an image to a registry, you must authenticate using 'podman login'.

Answer

podman push --auth registry.example.com

Answer

podman auth registry.example.com

Answer

podman connect registry.example.com

Question 9

After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?

Accepted Answer

podman tag myapp:v1 registry.example.com/myteam/myapp:latest. 'podman tag' is used to create an additional tag that points to an existing local image ID.

Answer

podman rename myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman commit myapp:v1 registry.example.com/myteam/myapp:latest

Answer

podman push myapp:v1 --target registry.example.com/myteam/myapp:latest

Question 10

A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?

Accepted Answer

:z. The ':z' or ':Z' suffix handles SELinux relabeling for volume mounts.

Answer

:ro

Answer

:shared

Answer

:exec

Question 11

An administrator needs to run a container that requires access to the host's network stack directly, bypassing network isolation. Which flag should be passed to 'podman run'?

Accepted Answer

--network host. Passing '--net=host' or '--network=host' disables network namespace isolation.

Answer

--share network

Answer

--privileged

Answer

--net bridge

Question 12

When configuring a secure private registry that uses a self-signed TLS certificate, a user receives an x509 certificate signed by an unknown authority error when pulling images. Where should the CA certificate file be placed on a RHEL system for system-wide trust?

Accepted Answer

/etc/containers/certs.d/registry.example.com/ca.crt. Custom CA certificates for registries are placed in /etc/containers/certs.d/<registry-name>/ or /etc/docker/certs.d/.

Answer

/etc/pki/ca-trust/source/anchors/registry.crt

Answer

/usr/share/pki/trust/anchors/ca.crt

Answer

~/.config/containers/certs.d/ca.crt

Question 13

A user wants to remove all unused container images that are not currently associated with an existing container from local storage. Which command should they execute?

Accepted Answer

podman image prune -a. 'podman image prune' removes unused images.

Answer

podman container prune

Answer

podman rmi --all

Answer

podman system clean

Question 14

An administrator wants to inspect the container storage configuration settings, such as graph root and storage driver, on a RHEL system. Which configuration file should they examine?

Accepted Answer

/etc/containers/storage.conf. Storage settings for containers are defined in /etc/containers/storage.conf.

Answer

/etc/containers/podman.conf

Answer

/etc/containers/registries.conf

Answer

/etc/sysconfig/docker

Question 15

A user wants to save a locally stored container image to a tar archive file to transfer it across systems without a registry. Which command should they use?

Accepted Answer

podman save -o image.tar image_name. 'podman save' exports an image to a tarball archive.

Answer

podman export -o image.tar container_name

Answer

podman backup image_name

Answer

podman dump image_name

Question 16

A developer needs to pull an image from a private registry that requires credentials without running an interactive shell session. Where are the authentication credentials stored after a successful 'podman login' command?

Accepted Answer

~/.config/containers/auth.json. Login credentials are saved in the auth.json file, typically located in $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json.

Answer

/etc/passwd

Answer

~/.ssh/authorized_keys

Answer

/etc/containers/login.conf

Question 17

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

Accepted Answer

:Z. The ':Z' suffix assigns a private unshared SELinux label to the volume.

Answer

:z

Answer

:private

Answer

:seclabel

Question 18

A user is running rootless Podman and needs to verify why a container cannot bind to TCP port 80. By default, unprivileged users cannot bind to ports below 1024. Which parameter controls the minimum unprivileged port that can be bound?

Accepted Answer

net.ipv4.ip_unprivileged_port_start. The sysctl parameter net.ipv4.ip_unprivileged_port_start controls the lowest port unprivileged users can bind to.

Answer

user.max_user_namespaces

Answer

net.ipv4.tcp_port_range

Answer

fs.inotify.max_user_watches

Question 19

An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?

Accepted Answer

[[registry]]
prefix = "registry.example.com"
location = "internal-mirror.example.com". TOML syntax in registries.conf uses [[registry]] tables and registries.search or registries.block fields alongside mirrors.

Answer

registry:
  name: registry.example.com
  mirror: internal-mirror.example.com

Answer

SERVER=registry.example.com
MIRROR=internal-mirror.example.com

Answer

[registry "registry.example.com"]
mirror = "internal-mirror.example.com"

Question 20

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

Accepted Answer

podman load -i app.tar. 'podman load' imports an image from a tar archive.

Answer

podman import app.tar

Answer

podman restore -i app.tar

Answer

podman read app.tar