How should I use these Registry And Security practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Registry And Security questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Registry And Security domain.

EX188 · topic practice

Registry And Security practice questions

This domain covers Podman's registry and security plumbing: authenticating to private registries, configuring mirrors and signature policy in /etc/containers, and applying SELinux and capability controls to containers. Questions are task-shaped — pick the right command, TOML key, or security option and predict its effect on pulls and running containers.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Registry And Security

Practice 10 questions Browse domain →

What the exam tests

What to know about Registry And Security

Be able to authenticate and de-authenticate registries, write valid registries.conf mirror and policy.json signature stanzas, and explain what each security option changes at runtime. The critical point is matching the exact config file, TOML/JSON key, or CLI flag to the behavior asked about.

Using podman login and podman logout to store and remove registry credentials in auth.json

Editing /etc/containers/registries.conf TOML blocks to define registry mirrors and unqualified-search registries

Reading /etc/containers/policy.json signedBy rules and verifying image signatures with GPG keys

Applying --security-opt label=disable and related SELinux, capability, and user namespace options

Watch out for

Common Registry And Security exam traps

▸Assuming podman logout removes credentials globally — it only clears the entry for that registry from the local auth file.
▸Writing registries.conf mirror entries as plain key/value instead of the required TOML table array with location and prefix fields.
▸Believing label=disable turns off all container isolation, when it only disables SELinux label separation for that container.

Practice set

Registry And Security questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Registry And Security explanation →

An administrator needs to configure a custom search domain for short-name image pulls across all users on a RHEL 9 system. Which configuration file must be edited?

Trap 1: /etc/containers/storage.conf

storage.conf handles storage locations and drivers.

Trap 2: /etc/containers/policy.json

policy.json handles signature verification policies.

Trap 3: /etc/containers/registries.d/

registries.d/ contains signature and transport configurations per registry.

Study all Registry And Security common traps →

A
/etc/containers/storage.conf
Why it fails: storage.conf handles storage locations and drivers.
B
/etc/containers/policy.json
Why it fails: policy.json handles signature verification policies.
C
/etc/containers/registries.conf
Global registry settings like unqualified-search-registries are configured in /etc/containers/registries.conf.
D
/etc/containers/registries.d/
Why it fails: registries.d/ contains signature and transport configurations per registry.

Registry And Security practice questions

What to know about Registry And Security

Common Registry And Security exam traps

Registry And Security questions

An administrator needs to configure a custom search domain for short-name image pulls across all users on a RHEL 9 system. Which configuration file must be edited?

When configuring a secure private registry that uses a self-signed TLS certificate, a user receives an x509 certificate signed by an unknown authority error when pulling images. Where should the CA certificate file be placed on a RHEL system for system-wide trust?

A user wants to remove all unused container images that are not currently associated with an existing container from local storage. Which command should they execute?

A developer needs to pull an image from a private registry that requires credentials without running an interactive shell session. Where are the authentication credentials stored after a successful 'podman login' command?

An organization enforces that all container images must be signed using a local GPG key before they can be deployed in production. Which command generates a signature for an image stored in local storage using a specific signing key?

An administrator wants to prevent users from pulling images from any registry except 'registry.access.redhat.com'. Where should this restriction be configured?

An administrator needs to configure a local container registry mirror that redirects all requests for 'registry.redhat.io' to an internal caching proxy 'mirror.corp.local'. Which section of /etc/containers/registries.conf must be modified?

A security officer wants to disable all signature checking for a specific insecure test registry in /etc/containers/policy.json. What transport matching rule should be configured under 'transports'?

An administrator needs to set up a local directory to act as an OCI-compliant layout image store, and then push an image into it using Podman. Which transport prefix is used for local OCI layout directories?

Which TWO commands display information about container images present in local Podman storage? (Choose two.)

Which TWO settings or files are critical when configuring rootless Podman environments on RHEL 9? (Choose two.)

Which TWO parameters or directives can be configured inside '/etc/containers/registries.conf' to control how Podman interacts with container registries? (Choose two.)

Which TWO scenarios correctly describe when an administrator should use the ':z' SELinux mount option instead of ':Z'? (Choose two.)

Which THREE configuration directives or files are associated with customizing container storage backends and root directory locations in Podman? (Choose three.)

An administrator is configuring Podman on a RHEL 9 host to pull images from an internal, insecure container registry at registry.example.com:5000 using HTTP instead of TLS. Where should this registry address be added to allow unencrypted communication?

A rootless user runs a container that needs to write data to a host directory using podman run -v /home/user/data:/data:Z. When the container starts, permission denied errors occur when writing to /data. What is the cause of this SELinux issue in rootless mode?

An administrator is troubleshooting an issue where a rootless container cannot access a host file because of SELinux denials. Which THREE statements accurately describe how SELinux interacts with rootless Podman containers on RHEL 9? (Choose three.)

A container image stored in an OCI registry is signed with a GPG key. A rootless Podman user on a RHEL 9 system needs to validate that signature automatically during `podman pull`. Which file should the user edit to define the trust policy that Podman applies to the registry?

An administrator wants to prevent all users on a RHEL 9 system from pulling images from any registry except registry.access.redhat.com. Which configuration change achieves this?

Track your progress over time

Start a Registry And Security only practice session

Related EX188 topic practice pages

Container Image Building practice questions

Storage And Configuration practice questions

Registry And Security practice questions

Networking And Compose practice questions

Container Operations And Lifecycle practice questions

EX188 fundamentals practice questions

EX188 scenario practice questions

EX188 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid