EX188 Practice Questions

Question 1

An administrator needs to pause all processes inside a running container named db_master without stopping it. Which command accomplishes this?

Accepted Answer

podman pause db_master. The `podman pause` command sends the SIGSTOP signal to all processes inside the specified container, freezing their execution without terminating the container or its processes. This allows the container to be resumed later with `podman unpause`, which sends SIGCONT. Unlike stopping, the container's state and memory are preserved.

Answer

podman suspend db_master

Answer

podman freeze db_master

Answer

podman hold db_master

Question 2

Which flag can be passed to 'podman run' to automatically remove the container and its anonymous volumes upon exit?

Accepted Answer

podman run --rm. The --rm flag in podman run tells Podman to automatically remove the container and its anonymous volumes when the container exits. This is equivalent to the --rm flag in Docker and is commonly used for ephemeral containers. It helps keep the system clean by removing stopped containers and their associated anonymous volumes.

Answer

podman run --delete-on-exit

Answer

podman run --clean

Answer

podman run --purge

Question 3

A container named 'metrics' has been running for several hours, and an engineer needs to inspect its current resource consumption (CPU, memory, and network I/O usage). Which Podman command provides a live-updating stream of resource usage statistics for running containers?

Accepted Answer

podman stats metrics. `podman stats` is the Podman equivalent of `docker stats` and provides a live, continuously updating stream of CPU, memory, network I/O, and block I/O statistics for one or more running containers. When a container name is passed (e.g., `podman stats metrics`), it filters the output to just that container and refreshes on an interval until interrupted.

Answer

podman inspect metrics

Answer

podman top metrics

Answer

podman system df metrics

Question 4

A user needs to log out from a private container registry to remove stored credentials from their local machine. Which command accomplishes this?

Accepted Answer

podman logout registry.example.com. 'podman logout' removes stored credentials for a registry.

Answer

podman rm auth registry.example.com

Answer

podman clear-credentials registry.example.com

Answer

podman disconnect registry.example.com

Question 5

A security engineer is troubleshooting why signature verification fails when pulling an image from a trusted registry. The policy file (/etc/containers/policy.json) specifies 'signedBy' using a GPG key, but the transport uses 'dir://'. Where must the public GPG key be imported for Podman to successfully verify the signature?

Accepted Answer

Into the local GnuPG keyring using 'gpg --import'. For the dir:// transport, Podman verifies signatures using keys in the local GnuPG keyring, so the public key must be imported with 'gpg --import' into the user's keyring (or root's, depending on context). The signedBy field in policy.json references a key fingerprint that Podman looks up in that keyring during verification.

Answer

Into ~/.config/containers/policy.d/keys/

Answer

Into /etc/containers/certs.d/keys/

Answer

Into /var/lib/containers/sigstore/

Question 6

You are designing a container image that runs an executable web server. You want to provide default arguments to the executable that can be easily overridden by a user passing arguments directly to 'podman run'. Which instruction combination is best?

Accepted Answer

Use ENTRYPOINT for the binary and CMD for the default arguments.. Using ENTRYPOINT for the binary and CMD for the default arguments is the best practice. When a user runs 'podman run ', the arguments passed on the command line override the CMD instruction, while the ENTRYPOINT remains the executable. This allows the user to easily override default arguments without changing the binary.

Answer

Use ENV for the binary and WORKDIR for the arguments.

Answer

Use RUN for both the binary and the arguments.

Answer

Use CMD for the binary and ENTRYPOINT for the default arguments.

Question 7

A system administrator is auditing containers and notices one running with the option '--security-opt label=disable'. What does this flag do?

Accepted Answer

It turns off SELinux separation and labeling for the container.. The '--security-opt label=disable' flag in Podman disables SELinux labeling for the container. This means that the container processes are not confined by SELinux policies, and the container can access files without SELinux context restrictions. This is often used when SELinux is causing permission issues, but it reduces security. The flag specifically turns off SELinux separation, not seccomp, user namespaces, or AppArmor.

Answer

It disables seccomp system call filtering.

Answer

It disables user namespace mapping.

Answer

It disables AppArmor enforcement.

Question 8

An administrator needs to create a persistent storage volume that Podman can manage independently of any specific container lifecycle. Which command accomplishes this?

Accepted Answer

podman volume create mydata. `podman volume create mydata` is the correct command to create a named volume that Podman manages independently of any container's lifecycle. Named volumes persist after containers are removed and can be mounted into multiple containers, making them ideal for persistent data. This is the direct Podman equivalent of `docker volume create`.

Answer

podman volume init mydata

Answer

podman storage volume-add mydata

Answer

podman create volume --name mydata

Question 9

Which TWO files or backend network management utilities are heavily relied upon by Podman for container networking stack configuration on modern Linux distributions? (Choose two.)

Accepted Answer

aardvark-dns. Option E, netavark, is correct because it is the default OCI container network backend for Podman on modern Linux distributions, responsible for setting up container network interfaces, bridges, and firewall rules. Option A, aardvark-dns, is correct because it is the authoritative DNS server that Podman relies on to provide name resolution between containers on the same network, working alongside netavark. Together, netavark and aardvark-dns replaced the older CNI-based stack as Podman's default networking solution. Option B, libnetwork, is incorrect because it is Docker's networking library, not Podman's backend. Option C, docker-proxy, is incorrect because it is a Docker component for port forwarding, not used by Podman. Option D, iptables-nft, is incorrect because although Podman may interact with nftables through netavark, iptables-nft itself is not a Podman-specific networking utility relied upon for stack configuration.

Answer

libnetwork

Answer

docker-proxy

Answer

iptables-nft

Question 10

An administrator configures a mirror for a primary registry in /etc/containers/registries.conf. What is the correct TOML syntax format to define a registry block with a mirror?

Accepted Answer

[[registry]]
prefix = "registry.example.com"
location = "internal-mirror.example.com". Podman's `/etc/containers/registries.conf` uses TOML, and a registry block is defined with `[[registry]]` (an array of tables). The `prefix` field specifies the registry hostname to match, and `location` specifies the mirror to use instead, so `[[registry]]` with `prefix` and `location` is the correct syntax.

Answer

registry:
  name: registry.example.com
  mirror: internal-mirror.example.com

Answer

SERVER=registry.example.com
MIRROR=internal-mirror.example.com

Answer

[registry "registry.example.com"]
mirror = "internal-mirror.example.com"

Question 11

An administrator needs to attach to the terminal of a currently running container named backend_app to view its active console output interactively. Which command should be used?

Accepted Answer

podman attach backend_app. `podman attach` connects the current terminal's STDIN/STDOUT/STDERR to a running container's main process (PID 1), letting the administrator view live console output and interact with it. This is the direct equivalent of `docker attach` and is the correct tool for viewing an active console interactively.

Answer

podman console backend_app

Answer

podman connect backend_app

Answer

podman join backend_app

Question 12

Which TWO types of storage mechanisms are natively supported by Podman for container data persistence? (Choose two.)

Accepted Answer

Host bind mounts referencing directories on the host filesystem. Option B is correct because Podman natively supports host bind mounts, where a directory or file on the host filesystem is mapped directly into the container using the -v or --mount flag (e.g., -v /host/path:/container/path), making it a first-class persistence mechanism. Option D is correct because Podman also natively supports managed named volumes, which are created and tracked in Podman's own storage graph (typically under /var/lib/containers/storage/volumes for root or ~/.local/share/containers/storage/volumes for rootless users) and persist independently of container lifecycle. Option A is not a native Podman storage mechanism; NFS exports would have to be mounted on the host first and then exposed via a bind mount, and shared memory block devices are not a Podman persistence type. Option C is incorrect because direct Fibre Channel LUN mapping is a host-level storage concern handled by the OS, not something Podman natively provides to containers. Option E is incorrect because HDFS is a distributed filesystem service external to Podman and is not a natively supported container storage driver.

Answer

Shared memory block devices via NFS exports

Answer

Direct Fibre Channel LUN mapping inside containers

Answer

Distributed HDFS cluster mounts

Question 13

When writing a Containerfile, which instruction specifies the base image to be used for the subsequent build steps?

Accepted Answer

FROM. Every Containerfile must start with a FROM instruction to define the base image.

Answer

BASE

Answer

INIT

Answer

PARENT

Question 14

You are optimizing image build times and notice that a specific RUN instruction fetching dependencies is re-running on every build, even though the requirements.txt file has not changed. What is causing this behavior?

Accepted Answer

The COPY requirements.txt instruction was placed after an instruction that introduces non-deterministic data or the build context files have modified timestamps.. Docker/Podman layer caching invalidates a RUN layer when any preceding instruction's layer changes. If COPY requirements.txt comes after an instruction that produces non-deterministic output (e.g., a RUN that fetches latest packages or writes timestamps) or if build-context files have changed mtimes, the cache key for the COPY layer changes, invalidating all subsequent RUN layers including the dependency install.

Answer

The Containerfile lacks an explicit CACHE instruction at the top.

Answer

Podman disables caching by default for all RUN instructions containing package managers.

Answer

The USER instruction was set to root, which disables layer caching.

Question 15

An administrator wants to view a list of all running containers in a clean, tabular format without stopping containers or showing extra metadata. Which command should be used?

Accepted Answer

podman ps. podman ps lists running containers by default.

Answer

podman show running

Answer

podman list

Answer

podman containers

Red Hat Certified Specialist in Containers (EX188, Podman-based) EX188 practice test

Three ways to study

Study EX188 by domain

Study EX188 by topic

Container Image Building practice questions

Storage And Configuration practice questions

Registry And Security practice questions

Networking And Compose practice questions

Container Operations And Lifecycle practice questions

EX188 fundamentals practice questions

EX188 scenario practice questions

EX188 troubleshooting practice questions

Red Hat Certified Specialist in Containers (EX188, Podman-based) (EX188) practice questions