EX200 Manage containers Practice Test 2 — 15 Questions

Question 1

An administrator has a Podman pod named 'apppod' that contains a single container named 'web'. The pod was started with `podman pod start apppod`. A configuration change requires the container to be removed and recreated with an additional port mapping, but the pod's shared network namespace and its assigned IP address must remain unchanged. Which sequence of commands should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

podman stop web, podman rm web, podman run --pod apppod .... To change a container's port mappings while keeping the pod's network namespace and IP address, only the container needs to be recreated, not the pod. Stopping and removing the container 'web' leaves the pod's infra container running, preserving the pod's networking. The new container joins the same pod with `--pod apppod`, inheriting the pod's namespace and IP. Removing the pod would lose the IP.

Answer

podman pod stop apppod, podman pod rm apppod, podman pod create --name apppod ... , podman run --pod apppod ...

Answer

podman pod stop apppod, podman rm web, podman run --pod apppod ... , podman pod start apppod

Answer

podman container update web --add-port 8080:80

Question 2

An administrator needs to ensure that a container always runs with a specific SELinux context for security reasons. The container uses a volume mount from the host. Which command should be used to start the container?

Accepted Answer

podman run --security-opt label=type:container_t -v /host/data:/data myimage. `--security-opt label=type:container_t` explicitly sets the SELinux type for the container process to `container_t`, ensuring the container runs with the required SELinux context. This is the proper way to assign a specific SELinux type when using `podman run`, especially when volume mounts are involved, as it avoids permission conflicts with the host's SELinux policy.

Answer

podman run --label selinux_context=container_t -v /host/data:/data myimage

Answer

podman run --privileged -v /host/data:/data myimage

Answer

podman run --selinux-context container_t -v /host/data:/data myimage

Question 3

A system administrator wants to run a container that uses the rootless mode available in Podman. Which requirement must be met for rootless containers to work correctly?

Accepted Answer

The user must have entries in /etc/subuid and /etc/subgid for user namespace mapping.. Rootless Podman containers require user namespace mapping to assign subordinate UIDs and GIDs from the host to the container. Without entries in /etc/subuid and /etc/subgid for the user, Podman cannot allocate the necessary ID ranges, and the container will fail to run in rootless mode.

Answer

The container must be run with the '--privileged' flag.

Answer

The system must have cgroups v2 enabled.

Answer

The user must have root privileges to run the container.

Question 4

A container running a database service needs to persist data across restarts. The administrator decides to use a named volume. Which command creates a named volume and mounts it correctly?

Accepted Answer

podman volume create dbdata && podman run -v dbdata:/var/lib/mysql mydb. It first creates a named volume with `podman volume create dbdata`, then mounts that named volume to the container's `/var/lib/mysql` directory using the `-v` flag. Named volumes are managed by Podman and persist data independently of the container lifecycle, ensuring data survives container restarts or removal.

Answer

podman run -v /var/lib/mysql:/var/lib/mysql mydb

Answer

podman run --mount type=bind,src=dbdata,dst=/var/lib/mysql mydb

Answer

podman run --mount type=tmpfs,dst=/var/lib/mysql mydb

Question 5

Which TWO statements are true regarding container images and containers in Podman?

Accepted Answer

A container is a running or stopped instance of an image with a writable layer.. A container in Podman is an instantiation of an image that adds a writable layer on top of the image's read-only layers. This writable layer persists changes made during the container's runtime, even after the container is stopped, unless explicitly removed.

Answer

A container can only be created from an image that is stored locally.

Answer

When a container is stopped, its writable layer is automatically removed.

Answer

A container image must be built using a Dockerfile.

Question 6

Which THREE actions are required to enable a non-root user to run containers using Podman on Red Hat Enterprise Linux 8?

Accepted Answer

Ensure the user has a running systemd user instance (loginctl enable-linger).. `loginctl enable-linger` ensures that the user's systemd user instance starts at boot and remains running after the user logs out. This is required for Podman to manage containers using systemd user services, such as auto-starting containers with `podman generate systemd`.

Answer

Add the user to the 'docker' group to access the Docker socket.

Answer

Grant the user sudo privileges to run podman commands.

Question 7

A system administrator needs to run a container that remains running in the background and executes a web server. Which podman command will correctly run the container detached and map host port 8080 to container port 80?

Accepted Answer

podman run -d -p 8080:80 nginx. `podman run -d` runs the container in detached mode (background), and `-p 8080:80` maps host port 8080 to container port 80, which is the standard port for the nginx web server. This allows external traffic on host port 8080 to be forwarded to the nginx service inside the container.

Answer

podman run -d -p 80:8080 nginx

Answer

podman run -d --expose 80 nginx

Answer

podman run -d -P 8080:80 nginx

Question 8

A container named 'web1' was created and ran briefly before exiting with status 0. The administrator needs to restart it and attach to the running container's console. Which command should be used?

Accepted Answer

podman start web1 && podman attach web1. `podman start web1` restarts the existing container that exited with status 0, and `podman attach web1` connects the current terminal to the container's main process console. The `&&` ensures the attach runs only after the container is successfully started, allowing the administrator to interact with the running container's console.

Answer

podman run --name web1 -it registry.access.redhat.com/ubi8/httpd-24

Answer

podman start web1

Answer

podman restart web1 && podman attach web1

Question 9

Put the steps to configure NFS server to export /nfsshare to a specific client in order.

Accepted Answer

Step 1: Create the /nfsshare directory. Step 2: Edit /etc/exports to add the export entry. Step 3: Run exportfs -a to export the directory. Step 4: Start and enable the NFS server service.. NFS export configuration involves creating the directory, editing /etc/exports, exporting, and starting services.

Answer

Step 1: Edit /etc/exports to add the export entry. Step 2: Create the /nfsshare directory. Step 3: Start and enable the NFS server service. Step 4: Run exportfs -a.

Answer

Step 1: Start and enable the NFS server service. Step 2: Create the /nfsshare directory. Step 3: Edit /etc/exports to add the export entry. Step 4: Run exportfs -a.

Answer

Step 1: Create the /nfsshare directory. Step 2: Run exportfs -a. Step 3: Edit /etc/exports to add the export entry. Step 4: Start and enable the NFS server service.

Question 10

Match each log file to its typical content.

Accepted Answer

/var/log/messages: General system messages and events. These log files are commonly monitored by sysadmins. Correct matches: /var/log/messages for general messages, /var/log/secure for authentication, /var/log/maillog for mail, /var/log/cron for cron jobs. Common confusions involve swapping secure and maillog.

Answer

/var/log/messages: Authentication and security-related messages

Answer

/var/log/secure: Mail server logs

Question 11

A user wants to run a container that will restart automatically unless explicitly stopped by the administrator. Which podman run option should be used?

Accepted Answer

--restart=unless-stopped. The `--restart=unless-stopped` policy ensures the container restarts automatically whenever it exits, unless the administrator explicitly stops it with `podman stop`. This matches the requirement exactly: the container will keep restarting even after system reboots or crashes, but will not restart if the admin manually stops it. The other policies either do not restart on manual stop (`always`) or only restart on non-zero exit codes (`on-failure`).

Answer

--restart=on-failure

Answer

--restart=always

Answer

--restart=no

Question 12

A container fails to start because the port it needs is already in use. Which command can the administrator use to identify the process using the port?

Accepted Answer

ss -tlnp. The `ss -tlnp` command displays listening TCP sockets (`-t`), numeric addresses (`-n`), and the associated process information (`-p`). This allows the administrator to identify which process (PID and program name) is bound to a specific port, directly addressing the container startup failure caused by a port conflict.

Answer

podman logs <container>

Answer

podman port -l

Answer

firewall-cmd --list-ports

Question 13

A team wants to run a container as a non-root user inside the container for security. Which instruction should be included in the Containerfile?

Accepted Answer

USER. The USER instruction in a Containerfile (Dockerfile) sets the user name or UID to use when running the container and for any subsequent RUN, CMD, or ENTRYPOINT instructions. By default, containers run as root (UID 0), which poses a security risk. Using USER to switch to a non-root user (e.g., USER 1001) ensures the container process runs with reduced privileges, aligning with the principle of least privilege.

Answer

PODMAN_USER

Answer

ENV USER

Answer

RUN useradd

Question 14

A containerized web server needs to persist logs outside the container. Which podman run option allows the administrator to specify a bind mount with mount propagation options?

Accepted Answer

--mount. The `--mount` flag in `podman run` provides the most granular control over bind mounts, including the ability to specify mount propagation options (e.g., `shared`, `slave`, `private`) via the `propagation` parameter. This is essential for persisting container logs to the host filesystem while controlling how mount events are propagated between the container and the host.

Answer

--volume

Answer

--bind

Answer

-v

Question 15

A database container crashes repeatedly. The administrator wants to see the last 10 lines of the container's logs before it exited. Which command should be used?

Accepted Answer

podman logs --tail 10 . The `podman logs --tail 10 ` command retrieves the last 10 lines of the container's log output, which is exactly what the administrator needs to see the final log entries before the container exited. The `--tail` flag specifies the number of lines from the end of the log, making it ideal for troubleshooting a crash without viewing the entire log history.

Answer

podman logs -f <container>

Answer

podman logs --since 10m <container>

Answer

podman inspect <container>