EX200 Manage containers Practice Test 2 — 15 Questions

Question 1

A database container crashes repeatedly. The administrator wants to see the last 10 lines of the container's logs before it exited. Which command should be used?

Accepted Answer

podman logs --tail 10 . The `podman logs --tail 10 ` command retrieves the last 10 lines of the container's log output, which is exactly what the administrator needs to see the final log entries before the container exited. The `--tail` flag specifies the number of lines from the end of the log, making it ideal for troubleshooting a crash without viewing the entire log history.

Answer

podman logs -f <container>

Answer

podman logs --since 10m <container>

Answer

podman inspect <container>

Question 2

An administrator is building a container image with a Containerfile. They want to ensure that a specific RUN command always executes without using the build cache. Which build option should they use?

Accepted Answer

--no-cache. The `--no-cache` build option instructs Podman or Docker to rebuild every layer from scratch, ignoring any cached intermediate layers. This ensures that the specific RUN command always executes fresh, which is essential when the command's outcome depends on dynamic external data or must not reuse stale cached results.

Answer

--layers=false

Answer

--squash

Answer

--force-rm

Question 3

A container needs to share the host's network namespace for performance monitoring. Which podman run option achieves this?

Accepted Answer

--network host. `--network host` makes the container use the host's network stack directly, bypassing any network namespace isolation. This allows performance monitoring tools inside the container to see the host's actual network interfaces, IP addresses, and traffic without NAT or port mapping overhead.

Answer

--network slirp4netns

Answer

--network bridge

Answer

--network none

Question 4

Which TWO options to podman run can be used to persist data outside the container? (Select exactly two.)

Accepted Answer

--mount. The `--mount` option (A) and `-v` (D) are both used to mount host directories or volumes into a container, allowing data to persist outside the container's writable layer. `--mount` provides a more explicit syntax for specifying mount type, source, and destination, while `-v` is a shorter alias for `--volume` that also binds host paths or named volumes. Both ensure data survives container removal.

Answer

--read-only

Answer

--tmpfs

Answer

--squash

Question 5

Which THREE options to podman run can be used to publish container ports to the host? (Select exactly three.)

Accepted Answer

-p. (-p) is correct because it is the short form of --publish, which maps a container port to a host port. Option B (--publish) is the long form of -p and explicitly publishes container ports to the host. Option D (-P) is correct because it publishes all exposed container ports to random high-numbered ports on the host (typically in the range 32768-60999).

Answer

--expose

Answer

--port

Question 6

A container is running but cannot be accessed from the network. Which TWO commands could help diagnose the issue? (Select exactly two.)

Accepted Answer

podman port. `podman port` lists the port mappings for a container, showing which host ports are mapped to container ports. If a container is running but unreachable from the network, this command reveals whether the expected port mapping exists and is correctly configured. Without a proper mapping, external traffic cannot reach the container's service.

Answer

podman logs

Answer

podman exec

Answer

podman top

Question 7

Based on the exhibit, which statement about the container 'webserver' is true?

Accepted Answer

Container port 80 is mapped to host port 8080.. The exhibit shows the container 'webserver' with port mapping '0.0.0.0:8080->80/tcp'. This indicates that host port 8080 is mapped to container port 80, meaning traffic arriving at the host on port 8080 is forwarded to port 80 inside the container. Therefore, option A is correct.

Answer

The container uses the host network.

Answer

Container port 8080 is mapped to host port 80.

Answer

No port mapping exists.

Question 8

Based on the exhibit, what is the most likely cause of the error?

Accepted Answer

DNS resolution failure is preventing the registry hostname from being resolved.. The error indicates a DNS lookup failure, as shown by a timeout on port 53. Option D correctly identifies that DNS resolution is failing for the registry hostname. Option A (firewall blocking port 443) would result in a connection timeout on port 443, not a DNS error. Option B (invalid image name) would produce an 'image not found' or similar error. Option C (network outage) would generally cause connectivity issues but not specifically a DNS timeout.

Answer

The container registry is unreachable due to a firewall blocking port 443.

Answer

The image name is invalid.

Answer

The container registry is unreachable due to a network outage.

Question 9

An administrator needs to run a container with a bind mount of the host directory /data to /var/lib/data inside the container. The container image is web:latest. Which command correctly achieves this?

Accepted Answer

podman run -v /data:/var/lib/data web:latest. The `-v` flag in Podman creates a bind mount from the host directory `/data` to the container directory `/var/lib/data`. The syntax `-v /host/path:/container/path` is the standard way to specify a bind mount, and this command correctly maps the host directory to the intended container path.

Answer

podman run -V /data:/var/lib/data web:latest

Answer

podman run -v /var/lib/data:/data web:latest

Answer

podman run -v /data::/var/lib/data web:latest

Question 10

A container running a web server exits immediately after starting. The administrator runs 'podman logs <container>' and sees 'Error: listen tcp :80: bind: address already in use'. What is the most likely cause and solution?

Accepted Answer

The host port 80 is occupied; use -p 8080:80 to map a different host port.. The error 'address already in use' indicates that port 80 on the host is already occupied by another process. By default, Podman maps container port 80 to host port 80. Using `-p 8080:80` maps the container's port 80 to an unused host port 8080, resolving the conflict without changing the container's internal configuration.

Answer

SELinux is preventing the container from binding to the port; set enforce to permissive.

Answer

The container does not have network access; add --network host.

Answer

The firewall is blocking outbound connections; disable firewalld.

Question 11

An administrator needs to pull a container image from a private registry at registry.example.com:5000. The registry requires authentication. Which command should be used first?

Accepted Answer

podman login registry.example.com:5000. `podman login` authenticates the user to the specified private registry (registry.example.com:5000) before any pull or push operation. Without prior authentication, Podman cannot access the registry's content, and the pull command will fail with an authentication error.

Answer

podman tag registry.example.com:5000/myimage

Answer

podman images

Answer

podman pull registry.example.com:5000/myimage

Question 12

A containerized application writes logs to stdout. The administrator wants to view only the last 50 lines of logs from a container named 'app1'. Which command accomplishes this?

Accepted Answer

podman logs --tail 50 app1. The `podman logs --tail 50 app1` command is correct because `--tail` is the Podman option to specify the number of lines from the end of the log to display. This directly fulfills the requirement to view only the last 50 lines of logs from the container named 'app1'.

Answer

podman logs --lines 50 app1

Answer

podman logs app1

Answer

podman logs -n 50 app1

Question 13

An administrator creates a pod named 'webpod' containing two containers: 'nginx' and 'logger'. The goal is for the nginx container to access the logger container via hostname 'logger'. Which network configuration is required?

Accepted Answer

No special configuration; containers in a pod can communicate via container names.. In Podman, containers within the same Pod share the same network namespace. This means they can communicate with each other using the container name as a hostname, which is resolved via the Pod's internal DNS or /etc/hosts. No additional network configuration is required for inter-container communication within a Pod.

Answer

Use 'podman network create' and connect both containers to that network.

Answer

Set environment variable LOGGER_HOST in nginx container.

Answer

Create a network with --internal and --ip-range.

Question 14

Which file should be present in a directory to build a container image using 'podman build'?

Accepted Answer

Dockerfile (or Containerfile). The `podman build` command requires a Dockerfile or Containerfile in the build context directory to define the container image layers and instructions. Podman follows the OCI (Open Container Initiative) image specification and uses the Dockerfile format by default, making option C the only correct choice for building an image.

Answer

docker-compose.yml

Answer

container.json

Answer

.dockerignore

Question 15

An administrator wants to run a container with --user 1001:1001 to avoid running as root. After starting, the container cannot write to a bind-mounted directory owned by root. What is the best practice to allow write access?

Accepted Answer

Use 'podman unshare chown 1001:1001 /host/dir' to change host directory ownership.. `podman unshare chown 1001:1001 /host/dir` changes the ownership of the host directory to UID/GID 1001, matching the container's user. This is the best practice in rootless Podman environments, as it avoids running the container with elevated privileges while ensuring the container user can write to the bind-mounted directory.

Answer

Run the container with --privileged.

Answer

Add the user 1001 on the host to the root group.

Answer

Set setuid bit on the host directory.