Red Hat Certified Specialist in Containers (EX188, Podman-based) (EX188) (EX188) — Questions 76–150

An administrator is managing rootless containers and needs to understand how user namespaces and security isolation function. Which TWO of the following configuration files or tools are directly relevant to rootless user mapping and systemd user persistence? (Choose TWO)

An administrator wants to examine the internal state, environment variables, or port mappings of a running container. Which TWO commands or techniques are appropriate? (Choose TWO)

Which THREE directives or practices are associated with implementing secure container builds and adhering to least-privilege principles? (Choose three.)

An administrator is managing Podman secrets and needs to interact with the secret store. Which THREE commands or operations are valid when working with podman secret? (Choose three.)

An administrator wants to immediately stop and remove a running container named temp_test in a single command. Which command should be used?

An administrator wants to run a container with a custom health check command that disables health checking entirely for a container that inherited one from its base image. Which flag achieves this?

You are optimizing a Containerfile using multi-stage builds to minimize image size. What is the key advantage of a multi-stage build in Podman?

When using the ADD instruction with a remote URL source, what is a recommended best practice regarding security and layer efficiency?

A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?

You are writing a Containerfile and need to ensure that the default command executed when the container starts can be easily overridden by passing arguments on the podman run command line. Which instruction should you use?

You want to set the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it in the Containerfile. Which instruction achieves this?

When configuring a secure private registry that uses a self-signed TLS certificate, a user receives an x509 certificate signed by an unknown authority error when pulling images. Where should the CA certificate file be placed on a RHEL system for system-wide trust?

What type of storage pattern is used by default when a container writes logs and temporary application state directly to its writable layer without any volumes attached?

An administrator wants to modify container settings or state. Which TWO of the following commands are valid Podman subcommands for container management? (Choose TWO)

When using the '--mount' flag, what parameter specifies the type of mount being performed (e.g., bind, volume, tmpfs)?

Which TWO statements are true regarding Podman bind mounts? (Choose TWO)

An administrator needs to run a container that shares the host's network namespace directly so it can listen on privileged ports without port forwarding. Which Podman command flag achieves this network mode?

You want to ensure that if any command in a multi-command RUN instruction fails, the entire container build process fails immediately. What shell option should be set or is default in Containerfiles?

Which configuration block in a Podman Compose YAML file is used to define custom isolated networks for the multi-container application?

An engineer needs to inspect the content and metadata of an existing Podman secret named 'my_secret' without outputting the raw secret value in plain text if masked, or viewing its metadata. Which command inspects the secret?

You need to ensure that a container image built with Podman includes reproducible timestamps for files to improve security and supply chain verification. Which flag or environment variable controls this?

An administrator is working with a rootless Podman setup and needs to ensure that container user namespaces map UIDs correctly such that container root (UID 0) maps to the unprivileged user's UID on the host. Which file configures subordinate UID mappings for rootless users on RHEL?

Which THREE behaviors occur when utilizing multi-stage builds in a Containerfile? (Choose three.)

An administrator wants to view the last 50 lines of logs for a running container named log_test and keep the log stream open for new entries. Which command should be used?

Which TWO instructions are used to define variables or set environment values within a Containerfile? (Choose two.)

An administrator wants to inspect the container storage configuration settings, such as graph root and storage driver, on a RHEL system. Which configuration file should they examine?

A container named api_gw is configured with a health check. An administrator needs to check the current health status (e.g., healthy, unhealthy, starting) using the command line without reading the full inspect JSON. Which command string achieves this?

Which THREE actions occur when a container is executed with the --network none flag? (Choose three)

You are writing a Containerfile to build a custom application image using podman build. Which instruction should you use as the mandatory first non-comment instruction to define the base image?

Two containers running on the same custom user-defined bridge network need to communicate with each other. What built-in mechanism allows them to resolve each other by container name?

An administrator needs to update the CPU shares (cpu-shares) of a running container named compute_job on the fly without stopping it. Which command should be used?

A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?

Which THREE methods or options can be used to authenticate or supply credentials when pulling images from a private registry that requires authentication? (Choose three.)

Which THREE conditions or practices can cause layer cache invalidation during a 'podman build' operation? (Choose three.)

Two containers running on the same custom user-defined bridge network need to communicate using container names as hostnames. What is required for this to work natively in Podman?

You need to define a persistent environment variable named 'PORT' with the value '8080' that is available during both the build process and when running containers from the resulting image. Which instruction should you use?

Where are Podman named volumes typically stored on the host file system by default for a non-root user?

A container named 'worker' was configured with a health check command during build time, but an administrator needs to temporarily override or define a new health check command while running the container. Which flag should be passed to 'podman run' to achieve this?

An organization mandates that all container images produced internally must be signed using local GPG keys before being pushed to the production registry. Which tool and configuration file must be used to enforce that Podman rejects unsigned images during a pull operation?

Which TWO actions occur when a container is run with ephemeral storage (the default behavior without volume mounts)? (Choose TWO)

An administrator wants to pass custom options to a volume driver when creating a volume. Which flag should be used?

Which instruction should be used in a Containerfile to copy local files from the host machine into the container filesystem?

An operator needs to troubleshoot a failing service inside a container named 'auth_api'. Which command should the operator run to view the standard output log stream generated by this container?

Which THREE advanced configuration steps or flags are available when performing rootless builds or utilizing buildah/podman build advanced features? (Choose three.)

A running Podman container named 'dbapp' is unresponsive, and a technician needs to immediately and forcefully terminate it without waiting for a graceful shutdown timeout. Which Podman command should be executed?

An administrator wants to retrieve only the IP address of a running container named web_svc by querying podman inspect with a specific format template. Which command is correct?

Which THREE mechanisms are part of Podman's image signature verification framework on RHEL 9? (Choose three.)

An administrator wants to configure Podman to pull images using a specific TLS client certificate for mutual TLS authentication against a secure private registry. Where should the client certificate and private key be placed?

Which THREE actions occur when an administrator runs a container with an SELinux volume mount suffix ':Z'? (Choose three.)

An administrator wants to monitor resource usage (CPU, memory, block I/O, network I/O) of all running containers in real-time. Which command provides this functionality?

An administrator needs to manage container lifecycles in Podman. Which TWO of the following commands can be used to start an existing, stopped container? (Choose TWO)

When utilizing Podman Compose, how are service dependencies and container startup orders typically managed within the YAML structure?

Which TWO actions can be performed using the podman volume management command suite? (Choose two.)

An engineer needs to inspect the low-level configuration details, mount points, and driver options of a named volume named 'app_vol'. Which command provides this information in JSON format?

An application container requires multiple configuration variables defined in a local file named 'app.env'. Which flag loads these variables into the container environment?

Which THREE practices should be followed to optimize container image size and build caching when writing Containerfiles? (Choose three.)

Which THREE tasks can be performed using the 'podman system' command set? (Choose three.)

Which THREE characteristics describe Podman named volumes compared to bind mounts? (Choose THREE)

Which TWO configuration files or directories are routinely modified when establishing secure private container registry trust and signature policies on RHEL 9? (Choose two.)

A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?

How do you stop and remove containers, networks, and volumes created by a Podman Compose file?

Which command displays disk space usage statistics for Podman storage, including volumes and containers?

When configuring container mounts using the --mount flag, which THREE key-value pairs are valid parameters in the option string? (Choose three.)

An administrator needs to run a container named 'web01' using Podman in the background using the image registry.access.redhat.com/ubi8/httpd-24:latest. Which command correctly starts this container in detached mode and maps port 8080 on the host to port 80 in the container?

Which THREE statements accurately describe the differences between shell form and exec form for CMD and ENTRYPOINT instructions? (Choose three.)

An administrator needs to inspect the configuration details, including subnet and gateway, of an existing custom network named 'my-net'. Which command should be executed?

You are using a multi-stage build in your Containerfile. How do you copy a compiled binary named 'app' from a build stage named 'builder' into your final production runtime stage?

An administrator wants to check container port mappings and process listings inside containers. Which TWO commands provide these insights? (Choose TWO)

An administrator needs to view all network ports exposed or mapped by a container named web_prod using a simplified summary command. Which command can be used?

How do you check the logs of all services managed by a Podman Compose file?

Which command lists all named volumes currently managed by Podman?

How can an administrator remove an existing Podman secret named 'old_secret'?

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

A developer wants to push a locally built container image named webapp:v1 to a private container registry located at registry.local:5000/myteam/. Which sequence of commands correctly tags and pushes the image?

When generating a Kubernetes Pod YAML from a Podman container using 'podman generate kubernetes', how are published ports mapped into the resulting Kubernetes manifest?