EX200 Manage containers Practice Test 3 — 15 Questions

Question 1

An administrator is building a container image with a Containerfile. They want to ensure that a specific RUN command always executes without using the build cache. Which build option should they use?

Accepted Answer

--no-cache. The `--no-cache` build option instructs Podman or Docker to rebuild every layer from scratch, ignoring any cached intermediate layers. This ensures that the specific RUN command always executes fresh, which is essential when the command's outcome depends on dynamic external data or must not reuse stale cached results.

Answer

--layers=false

Answer

--squash

Answer

--force-rm

Question 2

A container needs to share the host's network namespace for performance monitoring. Which podman run option achieves this?

Accepted Answer

--network host. `--network host` makes the container use the host's network stack directly, bypassing any network namespace isolation. This allows performance monitoring tools inside the container to see the host's actual network interfaces, IP addresses, and traffic without NAT or port mapping overhead.

Answer

--network slirp4netns

Answer

--network bridge

Answer

--network none

Question 3

Which TWO options to podman run can be used to persist data outside the container? (Select exactly two.)

Accepted Answer

--mount. The `--mount` option (A) and `-v` (D) are both used to mount host directories or volumes into a container, allowing data to persist outside the container's writable layer. `--mount` provides a more explicit syntax for specifying mount type, source, and destination, while `-v` is a shorter alias for `--volume` that also binds host paths or named volumes. Both ensure data survives container removal.

Answer

--read-only

Answer

--tmpfs

Answer

--squash

Question 4

Which THREE options to podman run can be used to publish container ports to the host? (Select exactly three.)

Accepted Answer

-p. (-p) is correct because it is the short form of --publish, which maps a container port to a host port. Option B (--publish) is the long form of -p and explicitly publishes container ports to the host. Option D (-P) is correct because it publishes all exposed container ports to random high-numbered ports on the host (typically in the range 32768-60999).

Answer

--expose

Answer

--port

Question 5

A container is running but cannot be accessed from the network. Which TWO commands could help diagnose the issue? (Select exactly two.)

Accepted Answer

podman port. `podman port` lists the port mappings for a container, showing which host ports are mapped to container ports. If a container is running but unreachable from the network, this command reveals whether the expected port mapping exists and is correctly configured. Without a proper mapping, external traffic cannot reach the container's service.

Answer

podman logs

Answer

podman exec

Answer

podman top

Question 6

Based on the exhibit, which command should be used to start the container named 'mycontainer'?

Accepted Answer

podman start mycontainer. The correct command to start an existing but stopped container is 'podman start mycontainer'. 'podman start' resumes a container that has been created (via 'podman create') or previously stopped, without creating a new instance. Option D is correct because it directly addresses the requirement to start the container named 'mycontainer' that already exists.

Answer

podman attach mycontainer

Answer

podman restart mycontainer

Answer

podman run mycontainer

Question 7

Based on the exhibit, which statement about the container 'webserver' is true?

Accepted Answer

Container port 80 is mapped to host port 8080.. The exhibit shows the container 'webserver' with port mapping '0.0.0.0:8080->80/tcp'. This indicates that host port 8080 is mapped to container port 80, meaning traffic arriving at the host on port 8080 is forwarded to port 80 inside the container. Therefore, option A is correct.

Answer

The container uses the host network.

Answer

Container port 8080 is mapped to host port 80.

Answer

No port mapping exists.

Question 8

An administrator needs to run a container with a bind mount of the host directory /data to /var/lib/data inside the container. The container image is web:latest. Which command correctly achieves this?

Accepted Answer

podman run -v /data:/var/lib/data web:latest. The `-v` flag in Podman creates a bind mount from the host directory `/data` to the container directory `/var/lib/data`. The syntax `-v /host/path:/container/path` is the standard way to specify a bind mount, and this command correctly maps the host directory to the intended container path.

Answer

podman run -V /data:/var/lib/data web:latest

Answer

podman run -v /var/lib/data:/data web:latest

Answer

podman run -v /data::/var/lib/data web:latest

Question 9

A system administrator wants to run a container as a systemd service that restarts automatically after a system reboot. Which approach follows Red Hat best practices?

Accepted Answer

Use 'podman generate systemd --new --name mycontainer' and enable the generated service.. `podman generate systemd --new --name mycontainer` creates a systemd unit file that defines the container as a transient service with `Restart=always` and `WantedBy=multi-user.target`, ensuring the container starts automatically after a reboot. This approach aligns with Red Hat best practices for managing containers as systemd services, leveraging systemd's native dependency and restart capabilities rather than relying on legacy or non-standard methods.

Answer

Create a cron job that checks if the container is running and starts it if not.

Answer

Create a sysvinit script that calls podman commands.

Answer

Add 'podman run ...' to /etc/rc.local.

Question 10

An administrator needs to pull a container image from a private registry at registry.example.com:5000. The registry requires authentication. Which command should be used first?

Accepted Answer

podman login registry.example.com:5000. `podman login` authenticates the user to the specified private registry (registry.example.com:5000) before any pull or push operation. Without prior authentication, Podman cannot access the registry's content, and the pull command will fail with an authentication error.

Answer

podman tag registry.example.com:5000/myimage

Answer

podman images

Answer

podman pull registry.example.com:5000/myimage

Question 11

A containerized application writes logs to stdout. The administrator wants to view only the last 50 lines of logs from a container named 'app1'. Which command accomplishes this?

Accepted Answer

podman logs --tail 50 app1. The `podman logs --tail 50 app1` command is correct because `--tail` is the Podman option to specify the number of lines from the end of the log to display. This directly fulfills the requirement to view only the last 50 lines of logs from the container named 'app1'.

Answer

podman logs --lines 50 app1

Answer

podman logs app1

Answer

podman logs -n 50 app1

Question 12

Which file should be present in a directory to build a container image using 'podman build'?

Accepted Answer

Dockerfile (or Containerfile). The `podman build` command requires a Dockerfile or Containerfile in the build context directory to define the container image layers and instructions. Podman follows the OCI (Open Container Initiative) image specification and uses the Dockerfile format by default, making option C the only correct choice for building an image.

Answer

docker-compose.yml

Answer

container.json

Answer

.dockerignore

Question 13

An administrator wants to run a container with --user 1001:1001 to avoid running as root. After starting, the container cannot write to a bind-mounted directory owned by root. What is the best practice to allow write access?

Accepted Answer

Use 'podman unshare chown 1001:1001 /host/dir' to change host directory ownership.. `podman unshare chown 1001:1001 /host/dir` changes the ownership of the host directory to UID/GID 1001, matching the container's user. This is the best practice in rootless Podman environments, as it avoids running the container with elevated privileges while ensuring the container user can write to the bind-mounted directory.

Answer

Run the container with --privileged.

Answer

Add the user 1001 on the host to the root group.

Answer

Set setuid bit on the host directory.

Question 14

A container exits immediately with status 1. The administrator runs 'podman logs container' but sees no output. What is the most likely reason for the missing logs?

Accepted Answer

The container binary is missing or has the wrong architecture (exec format error).. When a container exits immediately with status 1 and `podman logs` shows no output, the most common cause is that the container binary is missing or has the wrong architecture (e.g., an x86 binary on an ARM system). This results in an 'exec format error' that prevents the container's entrypoint from executing, so no stdout/stderr is ever written to the logging driver. The container exits before any process runs, leaving the log buffer empty.

Answer

The container's logging driver is not configured to capture stdout.

Answer

The log file is rotated and cleared.

Answer

The container is using a non-standard log location inside the container.

Question 15

Which TWO options correctly describe the use of 'podman exec'? (Choose TWO.)

Accepted Answer

podman exec ls / runs the ls command inside the running container.. `podman exec ls /` executes the `ls /` command directly inside the specified running container, using the container's filesystem and environment. This is the primary purpose of `podman exec`: to run a new process in an already running container without creating a new container.

Answer

podman exec -it <container> /bin/bash attaches to an existing shell process.

Answer

podman exec can start a stopped container.

Answer

podman exec -it <container> /bin/bash runs an interactive shell in a new container.