58 questions · Storage And Configuration topic · All types, answers revealed
Which THREE commands are valid when inspecting or managing Podman storage volumes? (Choose THREE)
Inspects volume details.
Why this answer
'podman volume create', 'podman volume inspect', and 'podman volume rm' are valid volume commands.
Which subcommand deletes one or more specific named volumes?
'rm' is the subcommand for removing volumes.
Why this answer
'podman volume rm' removes specified named volumes.
A container needs read-only access to a host configuration directory located at /etc/appconfig. Which Podman volume flag configuration correctly achieves this?
Correct. The :ro suffix applies read-only permissions.
Why this answer
Appending :ro to a volume mount specifier ensures the mount is read-only inside the container.
Which THREE formatting options or commands can be used with 'podman volume ls' to customize or filter output? (Choose THREE)
Filters output based on conditions (e.g., driver, name).
Why this answer
'podman volume ls' supports flags such as --filter, --format, and --no-trunc.
You need to pass sensitive database credentials to a Podman container securely without storing them in plaintext environment variables. Which sequence of commands correctly creates and injects the secret?
Correct. The secret is created and then mounted using the appropriate options.
Why this answer
Secrets must first be created via 'podman secret create' and then injected using the '--secret' flag during container creation.
A container using a named volume needs to be deleted, but you want to ensure the persistent volume data is preserved for future containers. Which command should you execute?
Correct. Running podman rm without volume removal flags leaves named volumes intact.
Why this answer
The standard podman rm command deletes the container, but volume data persists unless the -v or --rm --volumes flags are specified.
You are configuring a container to consume a Podman secret named db_password. By default, where within the container's file system will this secret be mounted if no destination path is specified?
Correct. Podman mounts secrets in /run/secrets/ by default.
Why this answer
Podman secrets are mounted into the container under /run/secrets/ by default if an explicit target is not provided.
An application requires a secret to be exposed as an environment variable inside the container instead of a file mount. Which option achieves this with '--secret'?
type=env configures the secret to be loaded as an environment variable.
Why this answer
Using the 'type=env' option with '--secret' injects the secret value directly into an environment variable.
An engineer needs to mount a host directory using the advanced '--mount' syntax instead of '-v'. Which syntax correctly specifies a bind mount?
This is the correct key-value syntax for the --mount flag.
Why this answer
The '--mount' flag uses comma-separated key-value pairs like type=bind,source=...,destination=...
An administrator runs a container with an SELinux-enforced host bind mount, but the container processes fail to write to the directory due to permission errors. Which volume option resolves this by sharing the SELinux content label?
Correct. The :z option shares the SELinux label among multiple containers.
Why this answer
The :Z option instructs Podman to relabel the host path specifically for the container, while :z shares it across multiple containers.
Which TWO options can be specified when mounting a Podman secret into a container? (Choose TWO)
Injects the secret into an environment variable.
Why this answer
Secrets can be mounted as files or injected as environment variables using options like type=mount or type=env.
A container needs to read a secret named 'api_key' injected as a file at '/run/secrets/api_key'. What is the default destination path inside the container when mounting a secret without specifying a target?
Secrets are mounted under /run/secrets/ by default.
Why this answer
By default, Podman mounts secrets into /run/secrets/ inside the container using the secret's name as the filename.
You need to inspect the disk space usage and detailed metadata of all managed volumes currently configured in Podman. Which command provides this information?
Correct. podman volume inspect provides detailed volume configuration and metadata.
Why this answer
The podman volume inspect command displays detailed metadata for one or more volumes.
An administrator wants to create a named volume using a specific volume driver instead of the default local driver. Which flag should be used with 'podman volume create'?
The --driver flag specifies non-default volume drivers.
Why this answer
The --driver (or -d) flag specifies the volume driver to use for managing the volume.
Which TWO flags can be used to mount volumes or bind mounts when running a container? (Choose TWO)
The advanced key-value mount attachment flag.
Why this answer
The '-v' / '--volume' and '--mount' flags are used to attach storage to containers.
Which TWO methods can be used to supply environment variables to a Podman container? (Choose TWO)
Passes individual environment variables.
Why this answer
Environment variables can be supplied individually via '-e' / '--env' or in batch via '--env-file'.
A developer wants to mount a host directory into a container with read-only permissions to prevent accidental data modification. Which volume option flag achieves this?
The ':ro' suffix configures the mount as read-only.
Why this answer
Appending ':ro' to a volume or bind mount specification tells Podman to mount the source path in read-only mode inside the container.
An administrator is managing Podman secrets and needs to interact with the secret store. Which THREE commands or operations are valid when working with podman secret? (Choose three.)
Correct. Lists all available secrets.
Why this answer
Podman secrets support creation, listing, inspection, and removal.
What type of storage pattern is used by default when a container writes logs and temporary application state directly to its writable layer without any volumes attached?
Ephemeral storage is temporary and tied to the container lifecycle.
Why this answer
Ephemeral storage refers to temporary storage bound to the container's lifecycle and destroyed when the container is removed.
When using the '--mount' flag, what parameter specifies the type of mount being performed (e.g., bind, volume, tmpfs)?
'type=' defines the mount type.
Why this answer
The 'type=' key specifies whether the mount is a bind, volume, or tmpfs mount.
Which TWO statements are true regarding Podman bind mounts? (Choose TWO)
Bind mounts map host paths to container paths.
Why this answer
Bind mounts map a host directory or file into a container and depend on host path availability and permissions.
An engineer needs to inspect the content and metadata of an existing Podman secret named 'my_secret' without outputting the raw secret value in plain text if masked, or viewing its metadata. Which command inspects the secret?
'inspect' outputs secret metadata in JSON format.
Why this answer
'podman secret inspect' displays detailed metadata about the secret object.
Where are Podman named volumes typically stored on the host file system by default for a non-root user?
This is the standard location for rootless user managed volumes.
Why this answer
For non-root users, Podman stores managed volume data inside their home directory under ~/.local/share/containers/storage/volumes/.
Which TWO actions occur when a container is run with ephemeral storage (the default behavior without volume mounts)? (Choose TWO)
An overlay writable layer is provisioned for the running container instance.
Why this answer
Ephemeral storage means data written inside the container layer is temporary and discarded when the container is removed.
An administrator wants to pass custom options to a volume driver when creating a volume. Which flag should be used?
'--opt' supplies driver-specific options.
Why this answer
The --opt flag passes driver-specific options when creating a named volume.
Which TWO actions can be performed using the podman volume management command suite? (Choose two.)
Correct. 'podman volume inspect' outputs configuration details.
Why this answer
Podman volumes can be inspected and pruned using the volume subcommand suite.
An engineer needs to inspect the low-level configuration details, mount points, and driver options of a named volume named 'app_vol'. Which command provides this information in JSON format?
Inspect provides the detailed JSON metadata for the volume.
Why this answer
'podman volume inspect' retrieves detailed configuration and metadata for specified volumes.
An application container requires multiple configuration variables defined in a local file named 'app.env'. Which flag loads these variables into the container environment?
--env-file correctly parses key-value pairs from the file.
Why this answer
The --env-file flag reads environment variables line by line from the specified file and passes them into the container.
Which THREE characteristics describe Podman named volumes compared to bind mounts? (Choose THREE)
Volume data resides in paths like /var/lib/... or ~/.local/share/...
Why this answer
Named volumes are managed by Podman, stored in container storage areas, and persist independently of host path structures.
Which command displays disk space usage statistics for Podman storage, including volumes and containers?
'system df' shows disk usage summary similar to filesystem df.
Why this answer
'podman system df' reports storage consumption for containers, images, and volumes.
When configuring container mounts using the --mount flag, which THREE key-value pairs are valid parameters in the option string? (Choose three.)
Correct. 'destination' specifies the mount path inside the container.
Why this answer
The --mount flag accepts options such as type, source (or src), and destination (or dst/target).
Which command lists all named volumes currently managed by Podman?
'ls' outputs the list of volumes.
Why this answer
'podman volume ls' displays a list of all named volumes.
How can an administrator remove an existing Podman secret named 'old_secret'?
'rm' is the correct subcommand to remove a secret.
Why this answer
'podman secret rm' deletes the specified secret from storage.
Which THREE advanced features or driver options can be utilized when creating Podman named volumes with plugins or specialized drivers? (Choose THREE)
Allows integration with external storage drivers.
Why this answer
Named volumes support custom drivers, driver options via '--opt', and labels via '--label'.
An administrator needs to list all created Podman secrets on the system. Which command should they execute?
'ls' is the correct subcommand to display stored secrets.
Why this answer
'podman secret ls' lists all available secrets managed by Podman.
An administrator needs to pass a single environment variable directly on the command line when starting a container. Which flag accomplishes this?
The -e flag sets individual environment variables.
Why this answer
The --env or -e flag defines environment variables for the container.
Which THREE of the following are valid options or flags when working with Podman secrets? (Choose THREE)
Removes a secret.
Why this answer
'podman secret create', 'podman secret ls', and 'podman secret rm' are valid commands for secret management.
An administrator needs to create a persistent storage volume that Podman can manage independently of any specific container lifecycle. Which command accomplishes this?
Correct. This provisions a named managed volume.
Why this answer
The command podman volume create is used to provision a new managed volume in Podman's storage backend.
When configuring an environment file for use with '--env-file', how are comment lines designated?
The hash sign (#) designates comments in env files.
Why this answer
Lines beginning with the hash character (#) are treated as comments in Podman environment files.
Which TWO commands help clean up unused or dangling Podman storage resources? (Choose TWO)
Removes unused containers, networks, and images.
Why this answer
'podman volume prune' and 'podman system prune' are used to clean up unused resources.
An administrator wants to bind mount a host file directly into a container as a configuration file. Is this supported in Podman?
Bind mounts can target individual files as well as directories.
Why this answer
Podman supports bind mounting both directories and individual files from the host into a container.
You have a file named config.env containing multiple KEY=VALUE pairs. Which flag allows you to load these configurations into a container as environment variables?
Correct. --env-file reads environment variables from a file.
Why this answer
The --env-file flag parses a file line by line and passes the key-value pairs into the container as environment variables.
A Podman secret named 'db_password' has been created. How is this secret made accessible inside a running container?
The --secret flag mounts or injects the secret into the container.
Why this answer
The --secret flag allows mounting or injecting a secret into the container filesystem or environment.
An administrator needs to create a temporary filesystem mount stored purely in host memory for high-performance temporary data inside a container. Which mount type should be used?
The --tmpfs flag mounts an ephemeral memory-backed filesystem.
Why this answer
A tmpfs mount stores data in host system memory (RAM), providing high-speed temporary storage.
Which flag can be passed to 'podman run' to automatically remove the container and its anonymous volumes upon exit?
'--rm' automatically deletes the container upon exit.
Why this answer
The --rm flag removes the container and any associated anonymous volumes when the container stops.
Which TWO types of storage mechanisms are natively supported by Podman for container data persistence? (Choose two.)
Correct. Bind mounts map host paths directly into containers.
Why this answer
Podman natively supports named managed volumes and host bind mounts.
Which THREE inspection or cleanup actions can be performed on Podman secrets? (Choose THREE)
Lists stored secrets.
Why this answer
Secrets can be listed, inspected for metadata, and removed.
Which TWO SELinux relabeling suffixes can be appended to a Podman volume or bind mount? (Choose TWO)
Makes content private to a single container.
Why this answer
The 'z' and 'Z' suffixes control SELinux shared and private relabeling on host mounts.
Which TWO commands or flags are valid for managing Podman named volumes? (Choose TWO)
Creates a named volume.
Why this answer
'podman volume create' and 'podman volume ls' are standard and correct subcommands for managing named volumes.
Which THREE storage-related items can be inspected using 'podman system df'? (Choose THREE)
Image disk usage is reported.
Why this answer
'podman system df' reports disk usage for containers, images, and volumes.
An administrator needs to create a Podman secret from a file on disk named 'secret.txt'. Which command correctly performs this action?
This syntax creates a secret named 'db_secret' populated from 'secret.txt'.
Why this answer
'podman secret create' takes a secret name and a file path containing the secret data.
An administrator wants to ensure that a bind-mounted directory allows propagation of mounts from the host into the container. Which mount option configures mount propagation mode?
The ':shared' suffix configures mount propagation.
Why this answer
Mount propagation (shared, slave, private) can be configured using propagation options like 'shared' or 'slave'.
An administrator needs to create a persistent storage area managed completely by Podman that does not rely on a specific host directory path. Which command should be used?
This command creates a managed named volume that Podman controls.
Why this answer
Podman named volumes are managed by the container engine and stored in a host directory managed by Podman, unlike bind mounts which bind to a specific user-defined host path.
Which TWO conditions are required for a non-root (rootless) user to successfully bind mount a host directory into a container? (Choose TWO)
Host filesystem permissions apply to rootless users.
Why this answer
Rootless users must have read/write permissions to the host path on the host filesystem and proper permissions/SELinux context.
How can an administrator remove all unused, dangling Podman volumes that are not currently attached to any container?
Prune specifically deletes unused and dangling volumes.
Why this answer
'podman volume prune' removes all volumes that are not actively used by any container.
Which TWO commands are used to manage Podman secrets? (Choose TWO)
Creates a secret.
Why this answer
'podman secret create' and 'podman secret ls' are valid secret management commands.
Which flag is used with 'podman run' to create an ephemeral, writable container layer scratchpad that is automatically destroyed when the container stops?
Default container storage is temporary and discarded upon removal unless committed or mounted.
Why this answer
Standard containers created with 'podman run' are ephemeral by default unless volumes or mounts are attached.
An administrator runs a container with a SELinux-relabeled host directory mount using the Z option, but multiple containers need to share write access to this exact same volume. Which option should be used instead?
Lowercase z relabels content so multiple containers can share the volume.
Why this answer
The z option (lowercase z) shares SELinux content among multiple containers, whereas Z (uppercase Z) treats the content as private and unshared.
Ready to test yourself?
Try a timed practice session using only Storage And Configuration questions.