EX188 Storage And Configuration Practice Test 2 — 15 Questions

Question 1

An administrator runs a container with an SELinux-enforced host bind mount, but the container processes fail to write to the directory due to permission errors. Which volume option resolves this by sharing the SELinux content label?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

--volume /host/data:/container/data:z. The :z volume option tells Podman to relabel the host directory with an SELinux context that allows the container to access it, using a shared label (system_u:object_r:container_file_t:s0). This resolves permission errors caused by SELinux denying access to files with the wrong label. The :z option is specifically for shared access among multiple containers.

Answer

--volume /host/data:/container/data:rprivate

Answer

--volume /host/data:/container/data:shared

Answer

--volume /host/data:/container/data:private

Question 2

A container using a named volume needs to be deleted, but you want to ensure the persistent volume data is preserved for future containers. Which command should you execute?

Accepted Answer

podman rm my_container. 'podman rm my_container' removes the container but leaves its named volume intact, because named volumes are independent storage objects not tied to the container's lifecycle. This is exactly the behavior needed when the volume data must survive for future containers. The volume remains listed and can be reattached to a new container by name.

Answer

podman rm -v my_container

Answer

podman rm --volumes my_container

Answer

podman volume prune --associated my_container

Question 3

You need to inspect the disk space usage and detailed metadata of all managed volumes currently configured in Podman. Which command provides this information?

Accepted Answer

podman volume inspect. `podman volume inspect` is the correct command because it returns detailed metadata for one or more Podman volumes, including mountpoint, driver, labels, options, and scope. When run against all managed volumes, it exposes the underlying storage path and configuration needed to assess disk usage and volume details. The other commands either do not exist, provide only summary listings, or report system-wide disk usage without per-volume metadata.

Answer

podman storage inspect volumes

Answer

podman volume ls --details

Answer

podman system df

Question 4

An administrator is managing Podman secrets and needs to interact with the secret store. Which THREE commands or operations are valid when working with podman secret? (Choose three.)

Accepted Answer

podman secret ls. Option A, 'podman secret ls', is correct because it lists all secrets stored in the Podman secret store, which is a valid and commonly used operation for managing secrets. Option C, 'podman secret inspect', is correct because it displays detailed information about a specified secret, such as its ID, name, and metadata. Option D, 'podman secret rm', is correct because it removes a specified secret from the store, which is a valid management operation. Option B, 'podman secret export', is not a valid Podman subcommand; secrets cannot be exported in this manner. Option E, 'podman secret modify', is also not a valid subcommand; Podman secrets are immutable after creation, so modification is not supported.

Answer

podman secret export

Answer

podman secret modify

Question 5

A developer runs a rootless Podman container that writes application logs to /var/log/app inside the container. They want these logs to persist on the host at /home/dev/logs and be accessible even if the container is removed. Which command correctly achieves this using a bind mount?

Accepted Answer

podman run -d --name app -v /home/dev/logs:/var/log/app:Z myapp:latest. The -v flag with :Z correctly bind-mounts the host directory and applies an SELinux label that allows container access. This ensures logs are written to the host and persist beyond the container's lifecycle. Other options either use tmpfs (non-persistent), create an anonymous volume, or omit SELinux relabeling, which would cause permission errors.

Answer

podman run -d --name app --volume /home/dev/logs myapp:latest

Answer

podman run -d --name app --mount type=bind,source=/home/dev/logs,target=/var/log/app myapp:latest

Answer

podman run -d --name app --mount type=tmpfs,destination=/var/log/app myapp:latest

Question 6

An administrator runs a container with an SELinux-enforced host bind mount, but the container processes fail to write to the directory due to permission errors. Which volume option resolves this by sharing the SELinux content label?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

podman run -v /host/data:/data:z. The `:z` option applies a shared SELinux label to the volume, allowing multiple containers to access the same content. When multiple containers need write access to the same host directory, `:z` is the correct choice because it relabels the content with a shared MCS category rather than a private one.

Answer

podman run -v /host/data:/data:O

Answer

podman run -v /host/data:/data:Z

Answer

podman run -v /host/data:/data:shared

Question 7

An engineer needs to inspect the low-level configuration details, mount points, and driver options of a named volume named 'app_vol'. Which command provides this information in JSON format?

Accepted Answer

podman volume inspect app_vol. 'podman volume inspect app_vol' returns detailed JSON output including the volume's mount point, driver, labels, and options. This is the canonical command for retrieving low-level volume metadata in a machine-readable format.

Answer

podman volume show app_vol

Answer

podman volume status app_vol

Answer

podman inspect volume app_vol

Question 8

Where are Podman named volumes typically stored on the host file system by default for a non-root user?

Accepted Answer

~/.local/share/containers/storage/volumes/. For a non-root user, Podman stores named volumes under the user's home directory in ~/.local/share/containers/storage/volumes/ by default. This is because rootless Podman uses a separate storage location for each user, following the XDG Base Directory specification. The root user's volumes are stored in /var/lib/containers/storage/volumes/, but non-root users do not have write access there, so Podman uses the user-specific path.

Answer

/var/lib/containers/storage/volumes/

Answer

/etc/containers/volumes/

Answer

/var/run/containers/storage/

Question 9

A developer wants to mount a host directory into a container with read-only permissions to prevent accidental data modification. Which volume option flag achieves this?

Accepted Answer

podman run -v /host/data:/container/data:ro. The -v /host/data:/container/data:ro syntax mounts the host directory with read-only permissions inside the container. The :ro suffix tells the runtime to mount the bind read-only, preventing any writes from the container to the host path. This is the standard short-form volume option for read-only bind mounts.

Answer

podman run --read-only-mount=/host/data

Answer

podman run -v /host/data:/container/data:rw

Answer

podman run --mount type=bind,source=/host/data,destination=/container/data,readonly=false

Question 10

An administrator needs to create a persistent storage area managed completely by Podman that does not rely on a specific host directory path. Which command should be used?

Accepted Answer

podman volume create my_data. podman volume create my_data creates a named volume managed by Podman's volume driver, which stores data in a Podman-controlled location (e.g., ~/.local/share/containers/storage/volumes for rootless) rather than a user-specified host path. This is exactly what the question asks for: persistent storage managed by Podman without relying on a specific host directory.

Answer

podman volume bind my_data

Answer

podman run -v /my_data

Answer

podman create volume my_data

Question 11

How can an administrator remove all unused, dangling Podman volumes that are not currently attached to any container?

Accepted Answer

podman volume prune. 'podman volume prune' removes all volumes not currently referenced by any container — exactly the definition of dangling or unused volumes. It is the dedicated cleanup command for reclaiming storage from orphaned volumes, and it prompts for confirmation unless run with --force. This is the correct tool when an administrator wants to bulk-remove unattached volumes.

Answer

podman rm --volumes

Answer

podman volume rm --all

Answer

podman volume clean

Question 12

An application container requires multiple configuration variables defined in a local file named 'app.env'. Which flag loads these variables into the container environment?

Accepted Answer

podman run --env-file app.env myapp. The --env-file flag is used with podman run to load environment variables from a file. The file should contain lines in the format VAR=value. This allows multiple variables to be set in the container environment without specifying each with -e.

Answer

podman run --config-file app.env myapp

Answer

podman run -e @app.env myapp

Answer

podman run --load-env app.env myapp

Question 13

An administrator needs to list all created Podman secrets on the system. Which command should they execute?

Accepted Answer

podman secret ls. The correct command to list all created Podman secrets is `podman secret ls`. Podman follows the same subcommand naming conventions as Docker, where `ls` is the standard alias for listing resources. The `podman secret` command group includes `create`, `inspect`, `ls`, and `rm`, so `podman secret ls` is the valid syntax to display all secrets stored in the system.

Answer

podman secret list

Answer

podman secrets ls

Answer

podman system secrets

Question 14

How can an administrator remove an existing Podman secret named 'old_secret'?

Accepted Answer

podman secret rm old_secret. The correct Podman command to remove a secret is 'podman secret rm <name>'. Podman's secret subcommand follows the same verb pattern as other resource subcommands (rm for remove), so 'podman secret rm old_secret' deletes the named secret from Podman's secret store.

Answer

podman rm secret old_secret

Answer

podman secret delete old_secret

Answer

podman secret remove old_secret

Question 15

An administrator wants to create a named volume using a specific volume driver instead of the default local driver. Which flag should be used with 'podman volume create'?

Accepted Answer

podman volume create --driver nfs my_vol. 'podman volume create --driver nfs my_vol' correctly specifies the volume driver using the '--driver' flag. Podman supports pluggable volume drivers, and '--driver' is the documented option to select a non-default driver such as nfs, glusterfs, or a custom plugin.

Answer

podman volume create --storage-driver nfs my_vol

Answer

podman volume create --plugin nfs my_vol

Answer

podman volume create -t nfs my_vol