Registry And Security

A system administrator logs into a RHEL 9 server as a regular non-root user and executes 'podman ps'. The command succeeds, but no containers are displayed. What architecture feature enables this user to run containers without root privileges?

A container running in rootless mode needs to map a user account on the host to a different user inside the container namespace. Which options configure UID and GID mapping?

An administrator needs to configure system-wide registry search shortcuts so that developers can run 'podman pull rhel9' and Podman automatically expands it to 'registry.access.redhat.com/rhel9'. Which configuration file and parameter accomplish this?

A user is running rootless Podman and needs to verify why a container cannot bind to TCP port 80. By default, unprivileged users cannot bind to ports below 1024. Which parameter controls the minimum unprivileged port that can be bound?

Which TWO actions can an administrator take to manage container image tags in local Podman storage? (Choose two.)

A security-conscious administrator runs a rootless Podman container that must bind-mount a directory from the host. The container process is denied access to the files even though the directory has world-readable permissions, and SELinux is enforcing. Which TWO steps will resolve the denial while keeping SELinux enforcing? (Choose two.)

A developer needs to push a locally built image to a private registry that requires authentication. The registry uses a self-signed certificate, and the developer wants Podman to trust that certificate for this registry only. Which action should be taken?

Which TWO commands allow a user to remove unwanted items from local Podman storage? (Choose two.)

A user wants to inspect the effective signature verification policy that Podman will apply when pulling images, without modifying any files. Which command displays the current policy configuration?

A user needs to download an image from Docker Hub named 'library/alpine' using its explicit transport prefix. Which command demonstrates the correct transport syntax?

A practitioner wants to view all container images currently stored in local storage, including their size, tag, and image ID. Which command should they execute?

A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?

A rootless Podman user must run a container that needs to write to a bind-mounted host directory. The container consistently fails with permission denied. The host directory is owned by the user and has mode 0775. SELinux is enforcing. Which action will allow the container to write to the directory without disabling SELinux?

An administrator wants to inspect the container storage configuration settings, such as graph root and storage driver, on a RHEL system. Which configuration file should they examine?

Which THREE methods or options can be used to authenticate or supply credentials when pulling images from a private registry that requires authentication? (Choose three.)

An organization mandates that all container images produced internally must be signed using local GPG keys before being pushed to the production registry. Which tool and configuration file must be used to enforce that Podman rejects unsigned images during a pull operation?

Which THREE mechanisms are part of Podman's image signature verification framework on RHEL 9? (Choose three.)

An administrator wants to configure Podman to pull images using a specific TLS client certificate for mutual TLS authentication against a secure private registry. Where should the client certificate and private key be placed?

Which THREE actions occur when an administrator runs a container with an SELinux volume mount suffix ':Z'? (Choose three.)

Which THREE tasks can be performed using the 'podman system' command set? (Choose three.)

Which TWO configuration files or directories are routinely modified when establishing secure private container registry trust and signature policies on RHEL 9? (Choose two.)

A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?

An auditor notices that a container running with SELinux enforcement needs to access a specific host directory with a private read-write security context. Which SELinux suffix should be applied to the volume mount if the content is exclusive to that single container and should not be shared?

A developer wants to push a locally built container image named webapp:v1 to a private container registry located at registry.local:5000/myteam/. Which sequence of commands correctly tags and pushes the image?

A user running a rootless container needs to inspect which subordinate UID and GID ranges have been allocated to their user account on the RHEL 9 host. Which files define these mappings?

After pushing an image to a registry, a developer wants to tag the local image 'myapp:v1' as 'registry.example.com/myteam/myapp:latest'. Which command accomplishes this?

A rootless user wants to run a container and mount a host directory into it. The container process reports permission denied errors when trying to write to the mounted volume. Which SELinux-related flag is typically appended to the volume mount option to resolve container volume permission issues in rootful mode, or handled via user namespaces in rootless mode?

An administrator configures rootless Podman on RHEL 9. For container user namespace mapping to function correctly for a specific user account, entries must be present in which two system files?

A user wants to save a locally stored container image to a tar archive file to transfer it across systems without a registry. Which command should they use?

A security administrator is implementing image signature verification on RHEL 9. Where is the default system-wide signature policy file located?

Which TWO conditions are typically required for rootless container users to successfully map UIDs and GIDs from host accounts to container accounts? (Choose two.)

An administrator needs to run a container that requires access to the host's network stack directly, bypassing network isolation. Which flag should be passed to 'podman run'?

A user needs to log out from a private container registry to remove stored credentials from their local machine. Which command accomplishes this?

When interacting with container registries using Podman, which THREE commands or tasks are valid operations supported natively by the Podman CLI? (Choose three.)

A user running rootless Podman wants to check the disk space consumed by images and containers in local storage. Which command provides this storage usage summary?

A developer wants to search for all available container images matching the term 'rhel9' across configured registries using Podman. Which command should they run?

An administrator needs to push a locally built Podman image named 'app:latest' to a remote container registry at 'registry.example.com/team'. Which command must be executed first to authenticate with the registry before pushing?

A security team requires that all container processes run with a specific SELinux type instead of the default container_t. How can an administrator specify a custom SELinux type when launching a container with 'podman run'?

Which TWO actions are required when configuring a secure container workflow to push a signed image to a registry using Podman? (Choose two.)

Which TWO commands are used to transfer container images via archive files without interacting with a network registry? (Choose two.)

A system administrator needs to load a container image from a previously generated tar archive named 'app.tar' into local Podman storage. Which command should be executed?

A user needs to remove a local container image that is no longer needed. Which command should be used?

An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?

A user running rootless Podman wants to pull an image from an insecure registry running over HTTP on port 5000. When running 'podman pull', the command fails with a connection error. Where must the administrator define this registry as insecure for the user?

A developer needs to pull a private image from quay.io. The registry requires authentication. Which command should the developer use to store credentials for quay.io so that subsequent `podman pull` operations succeed without prompting?

Which TWO methods can a user employ to verify that an image has been successfully downloaded to their local machine? (Choose two.)

A user wants to inspect the metadata and layers of an image stored locally without running it. Which Podman command should be used?