301 questions total · 5pages · All types, answers revealed
Page 1 of 5
Page 2Which THREE commands are valid when inspecting or managing Podman storage volumes? (Choose THREE)
Inspects volume details.
Why this answer
'podman volume create', 'podman volume inspect', and 'podman volume rm' are valid volume commands.
Which THREE parameters are valid key-value pairs when using the advanced '--mount' flag with bind or volume types? (Choose THREE)
Specifies the source path or volume name.
Why this answer
When using '--mount', valid keys include type, source (or src), and destination (or target/dst).
An administrator needs to execute multiple commands in a single RUN instruction to minimize image layers. Which syntax is standard in a Containerfile?
Using && ensures commands run sequentially in the same layer.
Why this answer
Combining commands using shell operators like && within a single RUN instruction reduces the total number of layers.
An administrator needs to copy a configuration file named /tmp/nginx.conf from the host into a running container named web_server at path /etc/nginx/nginx.conf. Which command should be used?
podman cp supports copying from host to container using host_path:container_path syntax.
Why this answer
podman cp copies files/folders between a container and the local filesystem.
Which THREE configuration directives or files are associated with customizing container storage backends and root directory locations in Podman? (Choose three.)
Environment variables can override default storage driver settings.
Why this answer
Storage options are configured in /etc/containers/storage.conf, via environment variables like STORAGE_DRIVER, or via user home directory overrides.
How do you disconnect a running container from a custom network named 'mynet'?
Disconnects the container from the network.
Why this answer
'podman network disconnect' removes a container from a specified network.
An administrator is troubleshooting a misbehaving container and needs to examine its output logs and event history. Which TWO commands are appropriate for this task? (Choose TWO)
podman logs fetches standard output and error logs generated by the container.
Why this answer
podman logs retrieves container stdout/stderr, and podman events streams system-wide container events.
A container administrator needs to download an image named rhel9/httpd-24 from the Red Hat Ecosystem Catalog using Podman, but requires local authorization without interactive password prompts. Which file should the administrator configure to store these registry credentials in base64-encoded format?
This file stores registry credentials for Podman authentication.
Why this answer
Podman uses the standard Docker-compatible auth configuration file located at $XDG_RUNTIME_DIR/containers/auth.json or ~/.config/containers/auth.json to store base64-encoded credentials for registry authentication.
An administrator is troubleshooting process execution and live configuration updates on a running container. Which TWO commands allow interacting with processes or updating resource limits on the fly? (Choose TWO)
podman update modifies container resource limits like CPU shares on a running container.
Why this answer
podman top shows container processes, and podman update modifies container resources live.
Which TWO commands can be used with Podman to build a container image from a Containerfile? (Choose two.)
podman image build is an alias/subcommand syntax for building images.
Why this answer
podman build and podman image build are both valid commands for building images.
You need to set a persistent environment variable named 'APP_PORT' with the value '8080' inside a container image via the Containerfile. Which instruction should you use?
ENV defines persistent environment variables in the image.
Why this answer
The ENV instruction sets environment variables that persist when the container runs.
An administrator wants to monitor real-time Podman system events, such as when containers are created, started, stopped, or removed, for auditing purposes. Which command should be executed?
The 'podman events' command listens to and prints real-time streaming events occurring within the Podman environment.
Why this answer
The 'podman events' command streams real-time events from the Podman system.
Which subcommand deletes one or more specific named volumes?
'rm' is the subcommand for removing volumes.
Why this answer
'podman volume rm' removes specified named volumes.
A container needs read-only access to a host configuration directory located at /etc/appconfig. Which Podman volume flag configuration correctly achieves this?
Correct. The :ro suffix applies read-only permissions.
Why this answer
Appending :ro to a volume mount specifier ensures the mount is read-only inside the container.
A system administrator logs into a RHEL 9 server as a regular non-root user and executes 'podman ps'. The command succeeds, but no containers are displayed. What architecture feature enables this user to run containers without root privileges?
Rootless containers rely on user namespaces and subordinate UID/GID ranges configured in /etc/subuid and /etc/subgid.
Why this answer
Rootless Podman utilizes user namespaces (user_namespaces(7)) to map the unprivileged user to a set of UIDs and GIDs inside the container environment, combined with shadow-utils mapping files.
You need to inspect the configuration details, including subnet, gateway, and driver, of a custom Podman network named 'appnet'. Which command should you run?
This command shows detailed JSON configuration for the network.
Why this answer
'podman network inspect' displays detailed low-level network configurations in JSON format.
You are building an image behind a corporate firewall that requires a custom Certificate Authority (CA) certificate to trust internal registries and repositories. How can you add this CA certificate to the build container?
This correctly installs the CA certificate and updates the system trust store on Red Hat-based images.
Why this answer
Placing the CA certificate in the appropriate system directory (e.g., /etc/pki/ca-trust/source/anchors/ on RHEL/Fedora-based images) and running update-ca-trust is standard.
Which THREE formatting options or commands can be used with 'podman volume ls' to customize or filter output? (Choose THREE)
Filters output based on conditions (e.g., driver, name).
Why this answer
'podman volume ls' supports flags such as --filter, --format, and --no-trunc.
You need to pass sensitive database credentials to a Podman container securely without storing them in plaintext environment variables. Which sequence of commands correctly creates and injects the secret?
Correct. The secret is created and then mounted using the appropriate options.
Why this answer
Secrets must first be created via 'podman secret create' and then injected using the '--secret' flag during container creation.
A container using a named volume needs to be deleted, but you want to ensure the persistent volume data is preserved for future containers. Which command should you execute?
Correct. Running podman rm without volume removal flags leaves named volumes intact.
Why this answer
The standard podman rm command deletes the container, but volume data persists unless the -v or --rm --volumes flags are specified.
Which THREE mechanisms are valid ways to pass build arguments into a Containerfile during a 'podman build' invocation? (Choose three.)
ARG instructions can define default values that apply if no build-arg is passed.
Why this answer
Build arguments can be passed via command line flags or environment files during build.
You are building a minimal container image from scratch using 'FROM scratch'. Your statically compiled Go binary fails to execute when the container starts, with a 'file not found' error, even though it was successfully copied into the image. What is the most likely cause?
'FROM scratch' contains no libraries or shell; dynamically linked binaries fail unless all dependencies are also copied.
Why this answer
'FROM scratch' is an empty image. If the binary depends on shared libraries (e.g., glibc) or dynamic linkers that exist in the host/build environment but not in scratch, it will fail.
You are configuring a container to consume a Podman secret named db_password. By default, where within the container's file system will this secret be mounted if no destination path is specified?
Correct. Podman mounts secrets in /run/secrets/ by default.
Why this answer
Podman secrets are mounted into the container under /run/secrets/ by default if an explicit target is not provided.
What is the primary benefit of utilizing multi-stage builds in Containerfiles?
This is the core purpose of multi-stage builds.
Why this answer
Multi-stage builds allow developers to use multiple FROM statements, leaving behind build tools and heavy SDKs in earlier stages and keeping production images small and secure.
A container running in rootless mode needs to map a user account on the host to a different user inside the container namespace. Which options configure UID and GID mapping?
--uidmap and --gidmap explicitly define how container UIDs/GIDs map to host UIDs/GIDs.
Why this answer
UID/GID mappings are configured using --uidmap and --gidmap.
An application requires a secret to be exposed as an environment variable inside the container instead of a file mount. Which option achieves this with '--secret'?
type=env configures the secret to be loaded as an environment variable.
Why this answer
Using the 'type=env' option with '--secret' injects the secret value directly into an environment variable.
An administrator is managing rootless Podman containers as a non-root user and wants to ensure that these containers automatically start upon system boot and persist across reboots using systemd. Which TWO steps or commands are required to accomplish this? (Choose TWO)
Lingering is mandatory for rootless containers managed by user systemd to start at boot without an active user session.
Why this answer
Rootless Podman persistence via systemd requires lingering to be enabled for the user so systemd runs when they are logged out, and generating/enabling a systemd service file.
Which TWO commands or flags can be used to publish a container port to the host in Podman? (Choose two.)
Short flag for publishing ports.
Why this answer
Both -p and --publish are valid flags for publishing ports in Podman.
An engineer needs to mount a host directory using the advanced '--mount' syntax instead of '-v'. Which syntax correctly specifies a bind mount?
This is the correct key-value syntax for the --mount flag.
Why this answer
The '--mount' flag uses comma-separated key-value pairs like type=bind,source=...,destination=...
An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?
The unqualified-search-registries setting allows Podman to prefix short image names with specified registry domains.
Why this answer
Unqualified search registries are configured in /etc/containers/registries.conf using the unqualified-search-registries array parameter.
An administrator runs a container with an SELinux-enforced host bind mount, but the container processes fail to write to the directory due to permission errors. Which volume option resolves this by sharing the SELinux content label?
Correct. The :z option shares the SELinux label among multiple containers.
Why this answer
The :Z option instructs Podman to relabel the host path specifically for the container, while :z shares it across multiple containers.
An administrator needs to connect an already running container named 'web1' to an existing user-defined network named 'backend-net' without restarting the container. Which command accomplishes this?
Correct. This command connects an active container to a specified network.
Why this answer
The 'podman network connect' command attaches a running container to an additional network interface.
Which TWO instructions can be used to copy files or directories from a build context into a container image?
COPY is the standard instruction for copying local files into the container.
Why this answer
Both COPY and ADD can be used to copy files and directories from the build context into the container image filesystem.
A container needs to be created that shares the host's network stack entirely, bypassing any NAT or virtual interface overhead. Which Podman flag achieves this?
This places the container on the host network stack.
Why this answer
Using --network host disables network isolation and places the container directly on the host's network namespace.
A container named db_master was previously paused using podman pause. Which command should the administrator use to resume its execution?
podman unpause resumes the execution of processes in a paused container.
Why this answer
podman unpause unfreezes the processes within the paused container.
When inspecting the networking of a container using 'podman inspect', where is the IP address of the container located in the output JSON structure?
Contains the primary IP address in the container inspection output.
Why this answer
The NetworkSettings.IPAddress field contains the IPv4 address assigned to the container on its default network.
Which TWO settings or files are critical when configuring rootless Podman environments on RHEL 9? (Choose two.)
Subordinate UID/GID ranges are mandatory for rootless namespace mapping.
Why this answer
Rootless Podman relies on subordinate UIDs/GIDs in /etc/subuid and /etc/subgid, and user configurations in ~/.config/containers/.
An organization enforces that all container images must be signed using a local GPG key before they can be deployed in production. Which command generates a signature for an image stored in local storage using a specific signing key?
podman image sign signs the specified image using the given key ID.
Why this answer
'podman image sign' is used to sign images for verification policies.
A user is running rootless Podman and needs to verify why a container cannot bind to TCP port 80. By default, unprivileged users cannot bind to ports below 1024. Which parameter controls the minimum unprivileged port that can be bound?
This kernel parameter determines the lowest port number that can be bound by non-root users.
Why this answer
The sysctl parameter net.ipv4.ip_unprivileged_port_start controls the lowest port unprivileged users can bind to.
Which TWO options can be specified when mounting a Podman secret into a container? (Choose TWO)
Injects the secret into an environment variable.
Why this answer
Secrets can be mounted as files or injected as environment variables using options like type=mount or type=env.
An administrator wants to view real-time container lifecycle events across the entire Podman system, such as container creation, starting, and stopping. Which command should be executed?
podman events streams real-time events from the Podman system.
Why this answer
The podman events command monitors container events in real time.
Which environment file option can be used in a Podman Compose file to automatically load environment variables for service configuration?
Loads environment variables from a file.
Why this answer
The 'env_file' directive allows passing a .env file into containers or using them for interpolation.
An administrator needs to view the processes running inside a specific container named worker_node, along with custom ps options like -ef to see full command arguments. Which command accomplishes this?
podman top accepts standard ps options after the container name to customize output.
Why this answer
podman top displays the running processes of a container and accepts ps-compatible argument flags.
An auditor notices that a container image runs its main application process as the 'root' user by default. Which Containerfile instruction can be added to ensure the container runs as a non-privileged user named 'appuser'?
This creates the user, sets permissions, and switches to it.
Why this answer
Using USER appuser ensures that subsequent commands and the runtime process execute under that user account.
Which THREE statements correctly describe the differences between CMD and ENTRYPOINT in a Containerfile?
This pairing is a common best practice for flexible yet rigid executable containers.
Why this answer
ENTRYPOINT configures a container that will run as an executable; parameters in CMD can act as defaults or be overridden; and using exec form for ENTRYPOINT prevents container processes from receiving signals if not handled carefully, whereas shell form runs inside /bin/sh.
A container needs to read a secret named 'api_key' injected as a file at '/run/secrets/api_key'. What is the default destination path inside the container when mounting a secret without specifying a target?
Secrets are mounted under /run/secrets/ by default.
Why this answer
By default, Podman mounts secrets into /run/secrets/ inside the container using the secret's name as the filename.
You want to create a rigid container image where the container always executes a specific binary (/usr/bin/redis-server) and any arguments passed to 'podman run' are appended as arguments to that binary. Which instruction combination is best?
This makes the binary immutable as the entrypoint while allowing default or overridden arguments via CMD.
Why this answer
Using ENTRYPOINT in exec form combined with CMD allows default parameters that can be appended to the fixed entrypoint.
Which flag allows you to publish a container port to a random ephemeral port on the host interface?
Publishes all exposed ports to random host ports.
Why this answer
Using -P or --publish-all publishes all exposed ports to random high-numbered ports on the host.
Which TWO of the following instructions in a Containerfile can be written using either the shell form or the exec form?
RUN supports both shell form and exec form.
Why this answer
Both RUN, CMD, and ENTRYPOINT support both shell form (e.g., RUN yum update) and exec form (e.g., RUN ["yum", "update"]). Among the options, RUN and CMD are standard examples.
You need to inspect the disk space usage and detailed metadata of all managed volumes currently configured in Podman. Which command provides this information?
Correct. podman volume inspect provides detailed volume configuration and metadata.
Why this answer
The podman volume inspect command displays detailed metadata for one or more volumes.
An administrator needs to start a container named webapp from the image docker.io/library/httpd in the background. Which podman command should be used?
podman run creates and starts a container from an image, and -d runs it in detached mode.
Why this answer
The podman run command with the -d (detached) flag starts a container in the background.
Which instruction documents the network ports on which a container listens at runtime?
EXPOSE informs Podman that the container listens on the specified network ports at runtime.
Why this answer
EXPOSE functions as a type of documentation between the person who builds the image and the person who runs the container.
Which TWO actions can an administrator take to manage container image tags in local Podman storage? (Choose two.)
podman rmi removes an image reference or tag from storage.
Why this answer
Podman allows tagging existing images with 'podman tag' and removing tags/images with 'podman rmi'.
An administrator is troubleshooting container startup failures and wants to inspect the exact entrypoint and command arguments configured for a container named app_run before it starts. Which inspect format expression retrieves this?
This inspect format string retrieves both the entrypoint and command configurations.
Why this answer
The entrypoint and command arguments are stored in .Config.Entrypoint and .Config.Cmd.
An administrator is troubleshooting an issue where a rootless container cannot access a host file because of SELinux denials. Which THREE statements accurately describe how SELinux interacts with rootless Podman containers on RHEL 9? (Choose three.)
SELinux mandatory access control applies to all processes on the system, including rootless container engines.
Why this answer
Rootless containers run in user namespaces. While they do not have root privileges, SELinux still applies constraints. Specifically, rootless containers run under an unprivileged user process label (such as unconfined_u:unconfined_r:unconfined_t:s0 or similar user-space mappings), cannot dynamically relabel arbitrary host paths using container tools with the same privileges as root, and rely on container process confinement governed by the active SELinux policy.
You wish to connect an already running container to an existing custom Podman network named 'mynet'. Which command should you use?
Connects the specified container to the network.
Why this answer
'podman network connect' attaches a running or stopped container to a specified network.
An administrator wants to generate a systemd unit file for an existing Podman container named 'app_server' so that it can be managed as a system service. Which command should be used to generate this unit file and write it directly to the user systemd directory?
The 'podman generate systemd' command with '--new' and '--files' writes the unit file directly into the current working directory, which can then be moved to the systemd folder.
Why this answer
The 'podman generate systemd' command is used to create systemd unit files, and the '--new' flag ensures the unit file creates a new container on start rather than relying on an existing stopped container.
Which TWO commands allow a user to remove unwanted items from local Podman storage? (Choose two.)
podman rmi removes local container images.
Why this answer
'podman rmi' removes images and 'podman rm' removes containers.
An administrator wants to create a named volume using a specific volume driver instead of the default local driver. Which flag should be used with 'podman volume create'?
The --driver flag specifies non-default volume drivers.
Why this answer
The --driver (or -d) flag specifies the volume driver to use for managing the volume.
When working with Podman Compose files, which TWO options are valid keys that can be specified under a service definition for port and networking configuration? (Choose two)
Correct. 'networks' connects the service to specified Compose networks.
Why this answer
In Compose files, 'ports' defines port mappings to the host, and 'networks' assigns the service to specific custom networks.
Which TWO flags can be used to mount volumes or bind mounts when running a container? (Choose TWO)
The advanced key-value mount attachment flag.
Why this answer
The '-v' / '--volume' and '--mount' flags are used to attach storage to containers.
An administrator is configuring container health checks and wants to review health status or force immediate actions. Which TWO of the following statements or commands are accurate regarding Podman health checks? (Choose TWO)
This inspect command successfully extracts the health status string from container metadata.
Why this answer
podman inspect with health format templates can retrieve health status, and health checks can be defined at run time using --health-cmd.
You are writing a Podman Compose file and want to ensure a service depends on another service being fully started before it initializes. Which directive should you use?
Specifies service startup dependencies.
Why this answer
The 'depends_on' directive controls startup order of services in compose files.
A containerized web service must be accessible from the host system on TCP port 8080, while the application inside the container listens on port 80. Which flag correctly configures this port mapping?
Correct. Host port 8080 is mapped to container port 80.
Why this answer
The format for the --publish or -p flag is host_port:container_port. Thus, -p 8080:80 maps host port 8080 to container port 80.
An administrator creates a custom CNI network using 'podman network create mynet' and wants to assign a static IP address to a container upon creation. Which option achieves this?
--ip assigns a static IP on custom bridge networks.
Why this answer
The --ip flag is used with 'podman run' on a user-defined bridge network to allocate a specific static IP address to the container interface.
Which command starts services defined in a Podman Compose file in detached mode?
Starts containers defined in the compose file in the background.
Why this answer
'podman-compose up -d' or 'podman compose up -d' starts all containers in background/detached mode.
Which TWO methods can be used to supply environment variables to a Podman container? (Choose TWO)
Passes individual environment variables.
Why this answer
Environment variables can be supplied individually via '-e' / '--env' or in batch via '--env-file'.
Which THREE practices should be observed when managing environment variables (ENV vs ARG) in Containerfiles for secure and efficient builds? (Choose three.)
ENV persists into the final image and is available at runtime.
Why this answer
ARG is build-time and doesn't persist, ENV persists into runtime, and sensitive values shouldn't be baked in.
A user needs to download an image from Docker Hub named 'library/alpine' using its explicit transport prefix. Which command demonstrates the correct transport syntax?
The docker:// transport explicitly tells Podman to pull from a Docker-compatible registry.
Why this answer
Podman supports explicit transport prefixes like docker://.
An administrator has a container that failed to start correctly. They want to inspect the exit code and finished timestamp. Which inspect format string provides the finished time?
.State.FinishedAt provides the timestamp when the container last stopped.
Why this answer
Container lifecycle timestamps such as FinishedAt are stored under .State.
A developer wants to mount a host directory into a container with read-only permissions to prevent accidental data modification. Which volume option flag achieves this?
The ':ro' suffix configures the mount as read-only.
Why this answer
Appending ':ro' to a volume or bind mount specification tells Podman to mount the source path in read-only mode inside the container.
An administrator is using Podman Quadlets to manage containers via systemd. Where must the Quadlet .container configuration file be placed for system-wide root containers?
System-wide Quadlet configuration files reside in /etc/containers/systemd/.
Why this answer
System-wide Quadlet files are placed in /etc/containers/systemd/.
An administrator is working with Podman Quadlets to manage container lifecycles via systemd. Which TWO statements regarding Quadlet file naming conventions and directory locations are correct? (Choose TWO)
Quadlet generator tools parse .container and other Quadlet files and generate corresponding systemd unit files on the fly.
Why this answer
Quadlet configuration files use specific extensions like .container and system-wide files reside in /etc/containers/systemd/.
A practitioner wants to view all container images currently stored in local storage, including their size, tag, and image ID. Which command should they execute?
podman images lists local container images.
Why this answer
'podman images' lists all locally stored images.
An administrator needs to export container contents or create new images from containers. Which TWO commands accomplish these actions? (Choose TWO)
podman commit creates a new image from a container's changes.
Why this answer
podman export exports a container filesystem to a tarball, and podman commit creates an image from a container.
Page 1 of 5
Page 2Practice EX188 by domain
Target a specific domain to shore up weak areas.