CCNA Container Image Building Questions

MCQmedium

An administrator needs to execute multiple commands in a single RUN instruction to minimize image layers. Which syntax is standard in a Containerfile?

A.RUN ["dnf update -y", "dnf install -y httpd"]

B.RUN { dnf update -y; dnf install -y httpd; }

C.RUN dnf update -y dnf install -y httpd

D.RUN dnf update -y && dnf install -y httpd

AnswerD

Using && ensures commands run sequentially in the same layer.

Why this answer

Combining commands using shell operators like && within a single RUN instruction reduces the total number of layers.

Practice this question →

Multi-Selecteasy

Which TWO commands can be used with Podman to build a container image from a Containerfile? (Choose two.)

Select 2 answers

A.podman container build

B.podman image build

C.podman make image

D.podman create build

E.podman build

AnswersB, E

podman image build is an alias/subcommand syntax for building images.

Why this answer

podman build and podman image build are both valid commands for building images.

Practice this question →

MCQeasy

You need to set a persistent environment variable named 'APP_PORT' with the value '8080' inside a container image via the Containerfile. Which instruction should you use?

A.EXPORT APP_PORT=8080

B.ENV APP_PORT=8080

C.VAR APP_PORT=8080

D.SET APP_PORT=8080

AnswerB

ENV defines persistent environment variables in the image.

Why this answer

The ENV instruction sets environment variables that persist when the container runs.

Practice this question →

MCQmedium

You are building an image behind a corporate firewall that requires a custom Certificate Authority (CA) certificate to trust internal registries and repositories. How can you add this CA certificate to the build container?

A.TRUST corporate-ca.crt

B.EXPOSE CERT corporate-ca.crt

C.COPY corporate-ca.crt /etc/pki/ca-trust/source/anchors/ RUN update-ca-trust

D.ENV CA_CERT=corporate-ca.crt

AnswerC

This correctly installs the CA certificate and updates the system trust store on Red Hat-based images.

Why this answer

Placing the CA certificate in the appropriate system directory (e.g., /etc/pki/ca-trust/source/anchors/ on RHEL/Fedora-based images) and running update-ca-trust is standard.

Practice this question →

Multi-Selectmedium

Which THREE mechanisms are valid ways to pass build arguments into a Containerfile during a 'podman build' invocation? (Choose three.)

Select 3 answers

A.Using the '--build-arg-file' flag to read variables from a file.

B.Placing default values directly in the Containerfile using 'ARG KEY=DEFAULT_VALUE'.

C.Using the '--env-file' flag during 'podman build' to populate ARG variables.

D.Using the '--build-arg KEY=VALUE' flag on the command line.

E.Using multiple '--build-arg KEY' flags without values, which automatically inherits the value from the host environment.

AnswersB, D, E

ARG instructions can define default values that apply if no build-arg is passed.

Why this answer

Build arguments can be passed via command line flags or environment files during build.

Practice this question →

MCQhard

You are building a minimal container image from scratch using 'FROM scratch'. Your statically compiled Go binary fails to execute when the container starts, with a 'file not found' error, even though it was successfully copied into the image. What is the most likely cause?

A.The binary was copied with incorrect permissions; it needs to be made executable with chmod +x during build.

B.The EXPOSE instruction was missing, preventing the binary from binding to network interfaces.

C.The WORKDIR instruction was omitted, preventing Podman from locating the binary.

D.The binary was dynamically linked against glibc or requires system files (like /etc/passwd or /lib64/ld-linux-x86-64.so.2) that are absent in the scratch image.

AnswerD

'FROM scratch' contains no libraries or shell; dynamically linked binaries fail unless all dependencies are also copied.

Why this answer

'FROM scratch' is an empty image. If the binary depends on shared libraries (e.g., glibc) or dynamic linkers that exist in the host/build environment but not in scratch, it will fail.

Practice this question →

MCQmedium

What is the primary benefit of utilizing multi-stage builds in Containerfiles?

A.It allows you to produce a final production image containing only the application binary and runtime dependencies, significantly reducing image size and attack surface.

B.It automatically encrypts environment variables stored in the image layers.

C.It bypasses the need for a container registry when sharing images.

D.It speeds up local DNS resolution during container execution.

AnswerA

This is the core purpose of multi-stage builds.

Why this answer

Multi-stage builds allow developers to use multiple FROM statements, leaving behind build tools and heavy SDKs in earlier stages and keeping production images small and secure.

Practice this question →

Multi-Selectmedium

Which TWO instructions can be used to copy files or directories from a build context into a container image?

Select 2 answers

A.PULL

B.INSTALL

C.COPY

D.ADD

E.GET

AnswersC, D

COPY is the standard instruction for copying local files into the container.

Why this answer

Both COPY and ADD can be used to copy files and directories from the build context into the container image filesystem.

Practice this question →

MCQmedium

An auditor notices that a container image runs its main application process as the 'root' user by default. Which Containerfile instruction can be added to ensure the container runs as a non-privileged user named 'appuser'?

A.EXEC appuser

B.PRIVILEGE drop appuser

C.RUN useradd -u 1000 appuser && chown -R appuser /app USER appuser

D.SECURITY --user=appuser

AnswerC

This creates the user, sets permissions, and switches to it.

Why this answer

Using USER appuser ensures that subsequent commands and the runtime process execute under that user account.

Practice this question →

Multi-Selecthard

Which THREE statements correctly describe the differences between CMD and ENTRYPOINT in a Containerfile?

Select 3 answers

A.ENTRYPOINT instructions cannot be overridden at runtime under any circumstances.

B.Combining ENTRYPOINT and CMD allows default arguments to be supplied while retaining override flexibility.

C.ENTRYPOINT allows configuring an image that runs as a specific dedicated executable.

D.CMD arguments can be easily overridden by arguments passed to 'podman run'.

E.CMD and ENTRYPOINT perform identical functions with no syntactical differences.

AnswersB, C, D

This pairing is a common best practice for flexible yet rigid executable containers.

Why this answer

ENTRYPOINT configures a container that will run as an executable; parameters in CMD can act as defaults or be overridden; and using exec form for ENTRYPOINT prevents container processes from receiving signals if not handled carefully, whereas shell form runs inside /bin/sh.

Practice this question →

MCQmedium

You want to create a rigid container image where the container always executes a specific binary (/usr/bin/redis-server) and any arguments passed to 'podman run' are appended as arguments to that binary. Which instruction combination is best?

A.RUN /usr/bin/redis-server

B.CMD ["/usr/bin/redis-server", "--protected-mode", "no"]

C.ENV BIN=/usr/bin/redis-server CMD $BIN

D.ENTRYPOINT ["/usr/bin/redis-server"] CMD ["--protected-mode", "no"]

AnswerD

This makes the binary immutable as the entrypoint while allowing default or overridden arguments via CMD.

Why this answer

Using ENTRYPOINT in exec form combined with CMD allows default parameters that can be appended to the fixed entrypoint.

Practice this question →

Multi-Selectmedium

Which TWO of the following instructions in a Containerfile can be written using either the shell form or the exec form?

Select 2 answers

A.WORKDIR

B.RUN

C.FROM

D.CMD

E.ENV

AnswersB, D

RUN supports both shell form and exec form.

Why this answer

Both RUN, CMD, and ENTRYPOINT support both shell form (e.g., RUN yum update) and exec form (e.g., RUN ["yum", "update"]). Among the options, RUN and CMD are standard examples.

Practice this question →

MCQeasy

Which instruction documents the network ports on which a container listens at runtime?

A.LISTEN

B.EXPOSE

C.PORT

D.OPEN

AnswerB

EXPOSE informs Podman that the container listens on the specified network ports at runtime.

Why this answer

EXPOSE functions as a type of documentation between the person who builds the image and the person who runs the container.

Practice this question →

Multi-Selecthard

Which THREE practices should be observed when managing environment variables (ENV vs ARG) in Containerfiles for secure and efficient builds? (Choose three.)

Select 3 answers

A.Use 'ENV' for configuration parameters that the application needs to read during container runtime.

B.Use 'ARG' for variables that are only needed during the build process and should not persist in the final image metadata.

C.Ensure that 'ENV' variables defined in earlier stages automatically carry over into subsequent multi-stage build stages without re-declaration.

D.Declare 'ARG' instructions before the first 'FROM' instruction if they are to be used in global FROM scoping (e.g., base image parameterization).

E.Use 'ENV' for passing secret API tokens so they are automatically encrypted in the image layers.

AnswersA, B, D

ENV persists into the final image and is available at runtime.

Why this answer

ARG is build-time and doesn't persist, ENV persists into runtime, and sensitive values shouldn't be baked in.

Practice this question →

Multi-Selectmedium

Which THREE directives or practices are associated with implementing secure container builds and adhering to least-privilege principles? (Choose three.)

Select 3 answers

A.Hardcoding database passwords directly into ENV instructions so the application can read them easily.

B.Using minimal, trusted base images to reduce the total software footprint and vulnerability surface.

C.Adding a 'USER' instruction with a non-root UID/username before defining the runtime CMD or ENTRYPOINT.

D.Running all RUN instructions with '--privileged' inside the Containerfile.

E.Using build-time secrets with '--secret' mounts rather than baking credentials into image layers.

AnswersB, C, E

Minimal base images reduce vulnerabilities.

Why this answer

Secure builds involve using non-root users, secure secret mounting, and trusted base images.

Practice this question →

MCQhard

You are optimizing a Containerfile using multi-stage builds to minimize image size. What is the key advantage of a multi-stage build in Podman?

A.It automatically converts Dockerfiles into systemd service units.

B.It allows you to copy only finalized artifacts from a heavy build stage into a minimal production stage.

C.It enables building container images concurrently across multiple remote container registries.

D.It eliminates the need for caching layers during the podman build process.

AnswerB

Multi-stage builds allow leaving build tools in earlier stages and copying only runtime assets to the final output image.

Why this answer

Multi-stage builds allow you to use multiple FROM instructions in a single Containerfile. Each FROM instruction starts a new stage with a different base, and you can copy artifacts from previous stages into the final stage, leaving behind build tools, compilers, and SDKs.

Practice this question →

MCQhard

When using the ADD instruction with a remote URL source, what is a recommended best practice regarding security and layer efficiency?

A.Always use ADD for remote URLs because it automatically verifies SSL/TLS certificates against the host system store.

B.ADD for remote URLs is deprecated and will cause podman build to abort with an error.

C.Avoid ADD for remote URLs; instead, use curl or wget within a RUN instruction to download, extract, and clean up in a single layer.

D.Use ADD for remote URLs because it creates a smaller layer than RUN.

AnswerC

Using curl/wget in a RUN instruction gives granular control over downloads, headers, and cache handling.

Why this answer

Downloading remote archives or files via ADD does not allow caching effectively, and it's generally recommended to use curl or wget inside a RUN instruction combined with cleanup to keep images lean and secure.

Practice this question →

MCQmedium

You are writing a Containerfile and need to ensure that the default command executed when the container starts can be easily overridden by passing arguments on the podman run command line. Which instruction should you use?

A.RUN

B.EXEC

C.ENTRYPOINT

D.CMD

AnswerD

CMD sets default parameters that are easily overridden.

Why this answer

CMD provides default arguments for an entrypoint or a default command, which is easily overridden by command-line arguments.

Practice this question →

MCQeasy

You want to set the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it in the Containerfile. Which instruction achieves this?

A.DIR

B.WORKDIR

C.CD

D.PATH

AnswerB

WORKDIR changes the active directory context for subsequent instructions.

Why this answer

The WORKDIR instruction sets the working directory for any RUN, CMD, ENTRYPOINT, COPY, and ADD instruction that follows it in the Containerfile.

Practice this question →

MCQmedium

You want to ensure that if any command in a multi-command RUN instruction fails, the entire container build process fails immediately. What shell option should be set or is default in Containerfiles?

A.RUN --strict-error command1 && command2

B.BUILD --fail-on-error

C.RUN ignore-errors=false command1 && command2

D.RUN set -e && command1 && command2

AnswerD

'set -e' causes the shell to exit immediately if a command exits with a non-zero status.

Why this answer

By default, the shell used in shell form runs with /bin/sh -c. To ensure failures propagate, strict error handling like set -o pipefail can be used.

Practice this question →

MCQhard

You need to ensure that a container image built with Podman includes reproducible timestamps for files to improve security and supply chain verification. Which flag or environment variable controls this?

A.PODMAN_REPRODUCIBLE_BUILD=true

B.TIMESTAMP=0 in the Containerfile ENV

C.--reproducible flag in podman build

D.SOURCE_DATE_EPOCH

AnswerD

SOURCE_DATE_EPOCH standardizes file timestamps across image builds for reproducibility.

Why this answer

Setting SOURCE_DATE_EPOCH environment variable ensures reproducible builds by normalizing file timestamps.

Practice this question →

Multi-Selecthard

Which THREE behaviors occur when utilizing multi-stage builds in a Containerfile? (Choose three.)

Select 3 answers

A.You can include multiple 'FROM' instructions in a single Containerfile, where each 'FROM' starts a new stage of the build.

B.All intermediate stages are automatically tagged and pushed to the local registry when the build completes.

C.You can assign a name to a build stage using the 'AS stage_name' syntax on the FROM instruction.

D.Artifacts from earlier stages are automatically merged into the final image layers unless explicitly deleted.

E.You can use 'COPY --from=<stage_name>' to pull compiled artifacts from a previous stage into the current stage.

AnswersA, C, E

Multiple FROM instructions define distinct build stages.

Why this answer

Multi-stage builds allow multiple FROM lines, naming stages, and selective copying between them.

Practice this question →

Multi-Selecteasy

Which TWO instructions are used to define variables or set environment values within a Containerfile? (Choose two.)

Select 2 answers

A.DEFINE

B.VAR

C.ARG

D.ENV

E.SET

AnswersC, D

ARG defines build-time variables.

Why this answer

ARG and ENV are used for defining build arguments and environment variables respectively.

Practice this question →

MCQeasy

You are writing a Containerfile to build a custom application image using podman build. Which instruction should you use as the mandatory first non-comment instruction to define the base image?

A.IMPORT

B.FROM

C.BASE

D.INIT

AnswerB

FROM specifies the base image and is required as the first instruction in a Containerfile.

Why this answer

The FROM instruction initializes a new build stage and sets the Base Image for subsequent instructions. Every valid Containerfile or Dockerfile must start with a FROM instruction.

Practice this question →

Multi-Selecthard

Which THREE conditions or practices can cause layer cache invalidation during a 'podman build' operation? (Choose three.)

Select 3 answers

A.Adding a comment line '#' at the very top of the Containerfile before the first FROM instruction.

B.Modifying the content or modification timestamp (mtime) of a file referenced by a COPY instruction.

C.Changing the order of instructions within the Containerfile.

D.Passing a different value to an 'ARG' instruction via '--build-arg' compared to the previous build.

E.Running 'podman build' on a different physical workstation while using the exact same build context and Containerfile.

AnswersB, C, D

File changes invalidate the cache for that instruction and all following ones.

Why this answer

Cache invalidation happens when instructions change, files change (checksum/mtime), or ARG values change.

Practice this question →

MCQeasy

You need to define a persistent environment variable named 'PORT' with the value '8080' that is available during both the build process and when running containers from the resulting image. Which instruction should you use?

A.SET

B.ENV

C.VAR

D.EXPORT

AnswerB

ENV defines environment variables that persist in the built container image.

Why this answer

The ENV instruction sets the environment variable <key> to the value <value>. This value will be persistent in the container when it runs and can also be referenced during build time.

Practice this question →

MCQeasy

Which instruction should be used in a Containerfile to copy local files from the host machine into the container filesystem?

A.COPY

B.TRANSFER

C.ADD

D.MOVE

AnswerA

COPY is the standard instruction to copy local files into the image.

Why this answer

The COPY instruction takes files from the local context and adds them to the container's filesystem.

Practice this question →

Multi-Selecthard

Which THREE advanced configuration steps or flags are available when performing rootless builds or utilizing buildah/podman build advanced features? (Choose three.)

Select 3 answers

A.Using '--tls-verify=false' to bypass TLS verification when pulling base images from insecure registries.

B.Using '--format oci' to explicitly specify that the resulting image should be in OCI image format rather than Docker v2.2.

C.Using '--no-cache' to force Podman to rebuild all layers from scratch without utilizing the cache.

D.Using '--rm=false' to automatically keep intermediate build container containers indefinitely on disk after successful builds.

E.Using '--privileged-build' to grant full root host capabilities to a rootless container build.

AnswersA, B, C

--tls-verify disables TLS checks for registry interaction.

Why this answer

Advanced build features include custom storage, volume/secret mounts, and architecture specification.

Practice this question →

Multi-Selectmedium

Which THREE practices should be followed to optimize container image size and build caching when writing Containerfiles? (Choose three.)

Select 3 answers

A.Order Containerfile instructions from least frequently changing to most frequently changing to maximize cache hits.

B.Combine package installation and cache cleanup in a single RUN instruction to prevent cache retention across layers.

C.Avoid using .containerignore files so that all host files are always cached by Podman.

D.Use multi-stage builds to separate build-time dependencies from the final runtime image.

E.Install all debugging tools and heavy development SDKs in the final production stage.

AnswersA, B, D

Placing base dependencies before source code maximizes cache reuse.

Why this answer

Caching and layer minimization depend on instruction order, cleanup in the same layer, and avoiding unnecessary tool installation.

Practice this question →

Multi-Selecthard

Which THREE statements accurately describe the differences between shell form and exec form for CMD and ENTRYPOINT instructions? (Choose three.)

Select 3 answers

A.Shell form is mandatory when using multi-stage builds.

B.Exec form allows shell variable expansion (like $VAR) directly without needing explicit shell invocation.

C.Exec form ensures that Unix signals (such as SIGTERM) sent by Podman are received directly by the application process as PID 1.

D.Exec form is written using JSON array syntax (e.g., ["executable", "param"]).

E.Shell form automatically wraps the command with '/bin/sh -c', which causes the application to run as a child process rather than PID 1.

AnswersC, D, E

Direct execution receives signals properly.

Why this answer

Exec form uses JSON array syntax, avoids running a shell, and correctly passes signals as PID 1.

Practice this question →

MCQmedium

You are using a multi-stage build in your Containerfile. How do you copy a compiled binary named 'app' from a build stage named 'builder' into your final production runtime stage?

A.COPY --stage=builder /app /app

B.ADD --stage-name=builder /app /app

C.IMPORT --from=builder /app /app

D.COPY --from=builder /app /app

AnswerD

--from=builder specifies copying from the stage labeled 'builder'.

Why this answer

The COPY --from=<stage_name> instruction allows copying artifacts from previous named stages.

Practice this question →

Multi-Selecteasy

Which TWO Containerfile instructions are used to bring files or data from outside the container into the build context or image? (Choose two.)

Select 2 answers

A.COPY

B.GET

C.ADD

D.FETCH

E.IMPORT

AnswersA, C

COPY brings local files into the image.

Why this answer

COPY and ADD are the two instructions designed to move external files into the image filesystem.

Practice this question →

MCQhard

You are designing a container image that runs an executable web server. You want to provide default arguments to the executable that can be easily overridden by a user passing arguments directly to 'podman run'. Which instruction combination is best?

A.Use ENTRYPOINT for the binary and CMD for the default arguments.

B.Use ENV for the binary and WORKDIR for the arguments.

C.Use RUN for both the binary and the arguments.

D.Use CMD for the binary and ENTRYPOINT for the default arguments.

AnswerA

Combining ENTRYPOINT with CMD allows the base command to remain fixed while parameters supplied to podman run override the CMD defaults.

Why this answer

ENTRYPOINT should define the executable, and CMD should define the default parameters that can be overridden easily when running the container.

Practice this question →

MCQeasy

Which Containerfile instruction sets the working directory for any subsequent RUN, CMD, ENTRYPOINT, COPY, and ADD instructions?

A.PATH

B.ENV

C.WORKDIR

D.RUN

AnswerC

WORKDIR is the correct instruction to change directories.

Why this answer

The WORKDIR instruction sets the working directory for any instructions that follow it in the Containerfile.

Practice this question →

MCQeasy

Which user instruction changes the user name or UID and group name or GID to use when running subsequent instructions in the Containerfile?

A.LOGIN

B.IDENTITY

C.USER

D.ACCOUNT

AnswerC

USER sets the execution user context.

Why this answer

The USER instruction sets the user name or UID to use for running the image and for any RUN, CMD and ENTRYPOINT instructions that follow it.

Practice this question →

MCQmedium

You are troubleshooting a build where a RUN instruction fails because it cannot reach a remote URL to download a file. The local network uses an HTTP proxy. How should you pass the proxy settings to the build command without hardcoding them into the image?

A.podman build --proxy http://proxy.example.com:8080 .

B.podman build --env HTTP_PROXY=http://proxy.example.com:8080 .

C.podman build --build-arg HTTP_PROXY=http://proxy.example.com:8080 .

D.podman build --set-proxy http://proxy.example.com:8080 .

AnswerC

Passing build arguments allows injecting proxy settings securely.

Why this answer

Build arguments can be passed via --build-arg to provide proxy settings dynamically.

Practice this question →

MCQmedium

By default, podman build executes build instructions using the root user. You want to switch the execution context to a non-privileged user named 'appuser' for all subsequent RUN, CMD, and ENTRYPOINT instructions. Which instruction should you use?

A.USER

B.LOGIN

C.SU

D.ACCOUNT

AnswerA

USER specifies the user profile for subsequent build and runtime instructions.

Why this answer

The USER instruction sets the user name (or UID) and optionally the user group (or GID) to use when running the image and for any RUN, CMD and ENTRYPOINT instructions that follow it in the Containerfile.

Practice this question →

Multi-Selectmedium

Which THREE features or characteristics distinguish the ADD instruction from the COPY instruction in a Containerfile? (Choose three.)

Select 3 answers

A.ADD can automatically extract local compressed tar archive files into the destination directory.

B.ADD requires the source file to be located within a git repository, unlike COPY.

C.COPY supports remote URLs natively just like ADD.

D.ADD supports fetching files directly from remote URLs.

E.COPY is generally recommended over ADD for simple file copying due to its predictable, transparent behavior.

AnswersA, D, E

ADD auto-extracts tarballs.

Why this answer

ADD supports remote URLs, auto-extraction of tarballs, and local sources, whereas COPY only supports local sources.

Practice this question →

MCQmedium

A container image needs to automatically extract a local tar archive file named 'app.tar.gz' into the destination directory '/opt/app' during the build process. Which instruction should be used?

A.COPY app.tar.gz /opt/app/

B.EXTRACT app.tar.gz /opt/app/

C.ADD app.tar.gz /opt/app/

D.RUN tar -xzf app.tar.gz -C /opt/app/

AnswerC

ADD automatically recognizes local tar files and extracts them into the destination.

Why this answer

The ADD instruction automatically extracts local tar archives, whereas COPY does not.

Practice this question →

Multi-Selecteasy

Which TWO statements are true regarding the EXPOSE instruction in a Containerfile? (Choose two.)

Select 2 answers

A.It informs Podman that the container listens on the specified network ports at runtime.

B.It replaces the need to define environment variables for port configuration.

C.It enforces strict firewall rules inside the container network namespace, blocking unexposed ports.

D.It acts as a type of documentation between the image creator and container operator.

E.It automatically publishes all exposed ports to random host ports without needing the -p or -P flag.

AnswersA, D

EXPOSE documents network port usage.

Why this answer

EXPOSE serves as documentation and assists orchestration tools in understanding which ports to publish when using flags like -P.

Practice this question →

MCQhard

How does Podman's rootless build architecture handle volume mounts or privileged operations specified within a RUN instruction in a Containerfile?

A.Rootless builds cannot execute RUN instructions that install RPM packages using dnf.

B.Rootless builds execute within user namespaces, mapping root inside the container to an unprivileged user on the host, restricting certain host-level operations.

C.Rootless builds automatically elevate privileges via sudo when a RUN instruction requires root access.

D.Rootless builds require the buildah daemon to be running as root in systemd.

AnswerB

User namespaces map container root to a normal user on the host, preserving security.

Why this answer

Rootless Podman utilizes user namespaces and often relies on tools like buildah or fuse-overlayfs to perform builds without root privileges on the host.

Practice this question →

MCQmedium

You need to label your container image with maintainer details and version metadata according to OCI annotation standards. Which instruction should you use?

A.LABEL maintainer="admin@example.com" version="1.0"

B.METADATA maintainer="admin@example.com"

C.ANNOTATE maintainer="admin@example.com"

D.TAG maintainer="admin@example.com"

AnswerA

LABEL is the standard instruction for adding key-value metadata to an image.

Why this answer

The LABEL instruction adds metadata to an image as key-value pairs.

Practice this question →

Multi-Selectmedium

Which THREE statements are true concerning how Podman builds container images and utilizes the build context? (Choose three.)

Select 3 answers

A.A file named '.containerignore' (or '.dockerignore') can be used to exclude files from being sent to the build context.

B.Podman cannot accept a Containerfile via standard input (stdin); it must always read from a file on disk.

C.Files outside the build context directory can be freely copied into the image using standard COPY instructions without extra flags.

D.The build context is the set of files located in the specified directory or archive passed to 'podman build'.

E.Building an image sends the entire build context to the container storage daemon/engine.

AnswersA, D, E

.containerignore excludes files from the context.

Why this answer

The build context is sent to the builder, .containerignore excludes files, and standard stdin can be used.

Practice this question →

Multi-Selecteasy

Which TWO instructions in a Containerfile can be used to set metadata or default execution parameters that influence how a container runs? (Choose two.)

Select 2 answers

A.RUN

B.CMD

C.ENTRYPOINT

D.COPY

E.FROM

AnswersB, C

CMD sets default commands or arguments for the container execution.

Why this answer

CMD and ENTRYPOINT both define runtime execution behavior for containers.

Practice this question →

MCQeasy

When writing a Containerfile, which instruction specifies the base image to be used for the subsequent build steps?

A.BASE

B.INIT

C.FROM

D.PARENT

AnswerC

FROM initializes a new build stage and sets the Base Image.

Why this answer

Every Containerfile must start with a FROM instruction to define the base image.

Practice this question →

MCQeasy

A developer wants to build a container image using podman build, but the Containerfile is named 'Customfile' and located in a subdirectory named 'dockerfiles'. Which command accomplishes this?

A.podman build -f dockerfiles/Customfile .

B.podman build --file-path dockerfiles/Customfile .

C.podman build -p dockerfiles/Customfile .

D.podman build --config dockerfiles/Customfile .

AnswerA

This correctly points the build command to the alternative Containerfile path.

Why this answer

The -f flag specifies the path to the Containerfile relative to the build context.

Practice this question →

MCQhard

You are optimizing image build times and notice that a specific RUN instruction fetching dependencies is re-running on every build, even though the requirements.txt file has not changed. What is causing this behavior?

A.The COPY requirements.txt instruction was placed after an instruction that introduces non-deterministic data or the build context files have modified timestamps.

B.The Containerfile lacks an explicit CACHE instruction at the top.

C.Podman disables caching by default for all RUN instructions containing package managers.

D.The USER instruction was set to root, which disables layer caching.

AnswerA

Podman checks file checksums and modification times (mtimes); if mtimes change without content changes, or if preceding instructions invalidate the cache, it re-runs.

Why this answer

If instructions preceding the COPY or cache-dependent instruction generate timestamps or non-deterministic content (like using ADD with a remote URL or changing ENV order), the cache is invalidated.

Practice this question →

MCQmedium

An administrator needs to execute a package update and install dependencies during the podman build process, ensuring these commands are committed as a new layer in the final image. Which instruction accomplishes this?

A.EXEC

B.START

C.CMD

D.RUN

AnswerD

RUN executes build-time commands and commits the result to a new image layer.

Why this answer

The RUN instruction executes any commands in a current layer on top of the current image and commits the results. The resulting committed image will be used for the next step in the Containerfile.

Practice this question →

MCQmedium

You want to build an image that has a build-time argument named 'VERSION'. How do you declare this variable inside the Containerfile so it can be used during the build steps?

A.DEFINE VERSION

B.ARG VERSION

C.ENV VERSION=1.0

D.VAR VERSION

AnswerB

ARG defines variables that are accessible during the build process.

Why this answer

The ARG instruction defines a variable that users can pass at build-time with podman build --build-arg <var>=<value>.

Practice this question →

MCQmedium

When writing a Containerfile, what is the difference between shell form and exec form for the CMD instruction?

A.There is no functional difference; they are syntactic aliases.

B.Exec form runs the executable directly without invoking a shell, making it receive Unix signals (like SIGTERM) properly as PID 1.

C.Shell form is required for multi-stage builds, while exec form is for single-stage builds.

D.Shell form runs the command as PID 1, while exec form spawns a bash shell wrapper.

AnswerB

Exec form executes the binary directly as process 1, allowing proper signal handling.

Why this answer

Exec form runs the command directly without a shell, whereas shell form runs the command inside a subshell (/bin/sh -c).

Practice this question →

MCQmedium

A developer needs to optimize image size by removing build caches and temporary package manager cache files within the same RUN instruction. Why must this be done in a single RUN instruction?

A.Because file deletions in separate layers do not reduce the final image size due to the layered filesystem.

B.Because package managers lock the database across different layers.

C.Because the container build engine will fail if cache cleanup happens in a separate layer.

D.To ensure environment variables persist between installation and cleanup.

AnswerA

Layers are additive; removing files in a subsequent layer just adds a whiteout file, leaving previous layers intact.

Why this answer

Docker/Podman image layers are read-only snapshots. Deleting a file in a later layer only hides it; it does not remove it from previous layers.

Practice this question →

Multi-Selectmedium

Which THREE statements are correct regarding the behavior and usage of the WORKDIR instruction? (Choose three.)

Select 3 answers

A.It permanently modifies the host machine's current working directory where 'podman build' was executed.

B.It can be used multiple times in a single Containerfile to change directories relative to previous WORKDIR paths or absolute paths.

C.If the directory specified does not exist, it will be created automatically, even if no instructions use it.

D.It replaces the need to specify absolute paths in COPY and ADD instructions.

E.It sets the working directory for any RUN, CMD, ENTRYPOINT, COPY, and ADD instructions that follow it.

AnswersB, C, E

Multiple WORKDIR instructions can be used sequentially.

Why this answer

WORKDIR sets the path, creates the directory if missing, and affects subsequent instructions.

Practice this question →

Multi-Selecthard

Which THREE practices are recommended when optimizing cache utilization during image builds with podman build?

Select 3 answers

A.Use the --no-cache flag on every routine build to ensure absolute freshness.

B.Always place COPY . . at the very top of the Containerfile before installing software dependencies.

C.Place instructions that change frequently, such as COPYing source code, near the end of the Containerfile.

D.Combine related package installation and cleanup steps into a single RUN instruction.

E.Order Containerfile instructions from least frequently changed to most frequently changed.

AnswersC, D, E

Delaying frequent changes prevents invalidating the cache for upstream setup layers.

Why this answer

To maximize cache efficiency, place instructions that change frequently (like copying source code) lower down in the Containerfile, group related installation steps into single RUN commands, and order instructions from least frequently changed to most frequently changed.

Practice this question →

MCQmedium

You need to ensure that a file copied into your image via the COPY instruction is owned by a specific user 'developer' and group 'devgroup'. How can this be achieved efficiently?

A.COPY app.py /app/app.py && chown developer:devgroup /app/app.py

B.COPY --chown=developer:devgroup app.py /app/app.py

C.COPY --user=developer:devgroup app.py /app/app.py

D.ADD --owner=developer app.py /app/app.py

AnswerB

--chown sets the user and group ownership directly during the COPY step.

Why this answer

The COPY instruction supports the --chown flag to set ownership during the copy operation.

Practice this question →

MCQhard

When creating multi-architecture container images using podman build, how can you ensure that architecture-specific binaries are correctly handled when using instructions like COPY?

A.By setting the ARCH environment variable in the base image.

B.By manually editing the Containerfile to include architecture-specific IF/ELSE statements.

C.By running podman build separately for each architecture and combining them with podman manifest.

D.By utilizing automatic build arguments such as TARGETOS and TARGETARCH provided in multi-arch build stages.

AnswerC, D

Using podman manifest is the standard way to combine single-arch images into a multi-arch list.

Why this answer

Podman supports building for multiple architectures using buildah/podman features, where TARGETPLATFORM, TARGETOS, and TARGETARCH build args are automatically available.

Practice this question →

MCQmedium

A developer has written a Containerfile with multiple COPY instructions for static configuration files that change frequently, placed near the top of the Containerfile before the application code installation. Why is this considered a bad practice for build caching?

A.It invalidates the build cache for all subsequent instructions whenever those configuration files change, slowing down builds.

B.It violates OCI container image specification limits on COPY counts.

C.It causes the ENTRYPOINT instruction to fail at runtime.

D.It causes Podman to store duplicate layers in local storage, exhausting disk space.

AnswerA

Layer caching depends on the order of instructions and changes to files being copied.

Why this answer

Changing a file earlier in the Containerfile invalidates the cache for all subsequent instructions, forcing unnecessary rebuilds of heavy steps.

Practice this question →

MCQhard

You need to copy local application source code from your build context into the /app directory inside the container image, automatically unpacking it if it is a local tar archive. Which instruction should you select?

A.FETCH

B.TRANSFER

C.COPY

D.ADD

AnswerD

ADD supports copying files and automatically unpacking local tar archives.

Why this answer

The ADD instruction copies new files, directories, or remote file URLs from <src> and adds them to the filesystem of the container at the path <dest>. A key feature distinguishing ADD from COPY is its ability to automatically extract local tar archives.

Practice this question →

Multi-Selecteasy

Which TWO options are valid flags for the 'podman build' command to specify build arguments and tags? (Choose two.)

Select 2 answers

A.--volume

B.--publish

C.--build-arg

D.-t / --tag

E.--env-file

AnswersC, D

--build-arg passes build-time variables into the Containerfile.

Why this answer

--build-arg and --tag (-t) are standard options for podman build.

Practice this question →

MCQmedium

An auditor reviewing your Containerfile notices an EXPOSE instruction for port 80. What is the primary function of the EXPOSE instruction?

A.It documents which ports the container listens on at runtime.

B.It opens firewall ports on the underlying RHEL host system permanently.

C.It encrypts network traffic entering the specified container port.

D.It automatically publishes all exposed ports to random host ports without flags.

AnswerA

EXPOSE acts as metadata/documentation indicating intended network ports.

Why this answer

The EXPOSE instruction informs Podman that the container listens on the specified network ports at runtime. It functions as a type of documentation between the person who builds the image and the person who runs the container, though ports can still be published manually via flags.

Practice this question →

MCQhard

A developer wants to pass a secret API key during the container build process without leaving the secret exposed in image layers or history. Which Podman feature should be used?

A.ARG API_KEY=secret_value

B.ENV API_KEY=secret_value

C.podman build --secret id=mysecret,src=/path/to/key.txt . with RUN --mount=type=secret,id=mysecret ...

D.ADD /path/to/key.txt /app/key.txt followed by RUN rm /app/key.txt

AnswerC

The --secret build flag combined with RUN --mount=type=secret allows secure, non-persistent access to secrets during build.

Why this answer

Podman supports build-time secrets using the --secret flag and the --mount=type=secret directive in the Containerfile.

Practice this question →