Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
What is the primary purpose of a container image?
Understand container image fundamentals
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Application examples from the Kubernetes project for practicing manifests and application behavior in a cluster.
Try it: Use a disposable cluster. Read a simple application's manifests, predict which Pods its Service selects, then change a label and use kubectl to diagnose the resulting connectivity problem.
Source is free. A local cluster uses your computer; hosted clusters may incur charges.
Guided tutorials for learning Kubernetes behavior and building practical skills beyond multiple-choice recall.
Try it: Complete a basic application tutorial. Repeat the task without the walkthrough, then explain the difference between declared configuration and observed cluster state.
Documentation is free. Your chosen cluster environment may have costs.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
What is the primary purpose of a container image?
To provide a runnable instance with application code and dependencies
To store persistent data for applications
To define network policies for pods
To manage user authentication in a cluster
Correct answer
To provide a runnable instance with application code and dependencies
A container image packages application code, runtime, libraries, and configuration into a single, portable artifact. It serves as the blueprint for running containers consistently across environments.
Which command lists all running containers on a host?
podman ps
docker images
podman images
docker ps
Correct answer
podman ps
The podman ps command displays currently running containers. It is analogous to docker ps in environments using Podman as the container engine.
What does a Kubernetes Pod primarily contain?
One or more containers that share storage and network
A single virtual machine instance
A complete cluster node configuration
Persistent volumes and secrets only
Correct answer
One or more containers that share storage and network
A Pod is the smallest deployable unit in Kubernetes and typically holds one or more tightly coupled containers that share network and storage resources.
Which storage type is ephemeral and tied to a container's lifecycle?
EmptyDir volume
PersistentVolumeClaim
Network storage mount
HostPath volume
Correct answer
EmptyDir volume
EmptyDir volumes are created when a Pod is assigned to a node and exist as long as that Pod runs. Data is removed when the Pod is deleted.
What is a common use case for a ConfigMap?
To inject configuration data into containers as environment variables or files
To store sensitive credentials securely
To define resource limits for containers
To schedule Pods across nodes
Correct answer
To inject configuration data into containers as environment variables or files
ConfigMaps allow you to decouple configuration artifacts from image content to keep containerized applications portable. They are not intended for sensitive data.
Which command creates a local container image from a Dockerfile?
podman build
docker build
podman run
docker create
Correct answer
podman build
The podman build command (or docker build) reads instructions from a Dockerfile to produce a new image. This question assumes Podman as the default engine.
What is the role of a container registry?
To store and distribute container images
To monitor application performance
To define network routing for services
To manage user permissions in a cluster
Correct answer
To store and distribute container images
A container registry serves as a central repository for storing, naming, and distributing container images. Examples include registries.redhat.io and local registries.
Which resource constraint can be set in a container to limit CPU usage?
cpu shares
memory requests
disk quota
network bandwidth limit
Correct answer
cpu shares
CPU shares (in Docker or Podman) and CPU requests (in Kubernetes) control how much CPU time a container can use relative to others.
What is a Service in Kubernetes used for?
To provide stable network access to a set of Pods
To build container images
To store container logs
To define security contexts for containers
Correct answer
To provide stable network access to a set of Pods
A Service abstracts access to Pods and provides a stable endpoint (IP and port) for network traffic, commonly used for load balancing across replicas.
Which file is typically used to define a container image build process?
Dockerfile
Containerfile
Makefile
Image.yaml
Correct answer
Dockerfile
A Dockerfile contains instructions to assemble a container image, such as base image, dependencies, and entrypoint. Containerfile is an alternative format with similar purpose.
What is the purpose of a readiness probe in Kubernetes?
To determine if a container is ready to serve traffic
To restart a container when it crashes
To allocate CPU resources
To store container logs
Correct answer
To determine if a container is ready to serve traffic
Readiness probes signal whether a container is prepared to accept requests. If the probe fails, the Pod is removed from Service endpoints.
Which command pulls an image from a remote registry?
podman pull
docker push
podman run
docker import
Correct answer
podman pull
The podman pull command downloads an image from a registry to the local system. Similar functionality exists in Docker with docker pull.
What is a common security practice for container images?
Scan images for vulnerabilities before deployment
Run containers as the root user by default
Share host network namespace with containers
Store secrets in image metadata
Correct answer
Scan images for vulnerabilities before deployment
Scanning images helps identify known vulnerabilities. Running as non-root and avoiding secrets in images are also strong security practices.
Which Kubernetes object manages the desired state for Pods?
Deployment
ConfigMap
Service
Namespace
Correct answer
ConfigMap
A Deployment manages ReplicaSets to ensure a specified number of Pod replicas are running and supports declarative updates.
What is a namespace in a container or Kubernetes environment?
A logical partition for organizing resources and isolating workloads
A physical server rack location
A type of container image
A storage volume format
Correct answer
A logical partition for organizing resources and isolating workloads
Namespaces provide scope for names and help organize cluster resources. They are commonly used to separate development, testing, and production workloads.
Recall the answer before opening each card.
To provide a portable, runnable snapshot that packages application code, runtime, libraries, and configuration into a single artifact for consistent deployment.
podman ps shows currently running containers; use podman ps -a to include stopped containers.
One or more containers that share the same network namespace, IP address, and storage volumes, enabling tight coupling.
EmptyDir volume: data exists only while the Pod runs; it is created empty and deleted when the Pod is removed.
To inject non-sensitive configuration data (e.g., environment variables, files) into containers, decoupling configuration from image content.
podman build reads the Dockerfile and its context to produce a new image tagged locally.
To store, version, and distribute container images so they can be pulled by users or deployment systems.
CPU shares (relative weight) or CPU count (absolute limit). In Podman, use --cpus to throttle CPU time.
To provide a stable network endpoint (IP and port) that load-balances traffic across a set of Pods matching a label selector.
Dockerfile (or Containerfile) contains instructions like FROM, RUN, and CMD to assemble the image layers.
To determine if a container is ready to accept traffic; if it fails, the Pod is removed from Service endpoints.
podman pull downloads an image from a registry (e.g., registry.redhat.io) to the local system.
Scan images for vulnerabilities before deployment and avoid running containers as root inside the container.
Deployment controls ReplicaSets to ensure a specified number of Pod replicas are running and supports rolling updates.
A logical partition that organizes resources and isolates workloads within a cluster, providing scope for names.
Podman supports running containers without root using user namespaces, mapping the container’s root to an unprivileged user.
Deployment is for stateless applications with identical replicas; StatefulSet manages stateful applications with unique identities and stable storage.
Use hostPort in the Pod spec or port forwarding (kubectl port-forward) for direct access, but a Service is preferred for production.
podman history shows the history of layers and commands used to build the image.
A PVC requests storage resources from a PersistentVolume, providing durable storage that survives Pod restarts and rescheduling.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Understanding what a container image is and how it is created and distributed forms the bedrock of containerized environments. The practice bank tests the primary purpose of an image as a portable artifact packaging code, runtime, and dependencies. You must know how to build an image from a Dockerfile using podman build and pull images from a registry with podman pull. The role of a container registry as a storage and distribution point is also assessed. These concepts are prerequisites for consistent deployment across different environments and align with Red Hat's container strategy.
Proficiency with the Podman command line is essential for day-to-day container administration. The practice bank covers listing running containers (podman ps), building images, and pulling images. These commands are analogous to Docker commands and are central to Red Hat's container tooling. You must be able to create containers, manage their lifecycle, and inspect their status quickly. Understanding the options for resource constraints (e.g., CPU shares) and state management prepares you for real-world administration tasks.
Kubernetes orchestrates containers at scale, and the practice bank tests core building blocks. A Pod is the smallest deployable unit that can contain one or more containers sharing network and storage. Services provide stable endpoints for accessing Pods, enabling load balancing and service discovery. Deployments manage the desired state of Pods through ReplicaSets, supporting rolling updates and rollbacks. Readiness probes determine if a container is ready to serve traffic, which is crucial for high-availability applications.
Effective containerized applications depend on decoupled configuration, appropriate storage, and security measures. ConfigMaps inject non-sensitive data as environment variables or files. EmptyDir volumes provide ephemeral storage tied to a Pod's lifecycle. Security practices such as scanning images for vulnerabilities and avoiding running containers as root are emphasized. Namespaces logically isolate workloads within a Kubernetes cluster. Understanding these concepts ensures that applications are portable, resilient, and secure.
Study workflow
Practice using podman run, ps, build, pull, and push in a lab environment. Create Dockerfiles and build images with different base images. Use podman ps -a to list all containers including stopped ones. Set resource limits with --cpus and --memory to understand constraints. This hands-on experience solidifies the command syntax tested in the exam.
Create a Deployment YAML that runs multiple replicas of a container image. Expose the Deployment using a Service (ClusterIP, NodePort, or LoadBalancer). Verify that the Service load-balances traffic across Pods. Add readiness and liveness probes to the Pod spec and observe how they affect Pod status in kubectl get pods.
Create a ConfigMap from literal values or files and mount it as volumes or environment variables in a Pod. Distinguish between ConfigMap and Secret usage. Practice updating a ConfigMap and checking if Pods pick up the changes (they may need a restart). This reinforces decoupling configuration from images.
In Kubernetes, create a Pod with an EmptyDir volume and write data to it; delete and recreate the Pod to confirm data loss. Then create a PersistentVolumeClaim (PVC) and use it in a Pod to persist data across Pod restarts. Understand the lifecycle differences and when to use each storage type.
Install a vulnerability scanner (e.g., Red Hat's docker registry scanning or Skopeo) and scan an image from a public registry. Review the report. Also, modify a Dockerfile to run the application as a non-root user and rebuild. Test that the container runs without privilege escalation. This practice aligns with the exam's security emphasis.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Podman is often the default container engine on Red Hat Enterprise Linux 8 and later, but its CLI syntax is almost identical to Docker. The exam may use either, so familiarity with both is recommended. Commands like podman ps, build, pull, and run work the same way as their docker counterparts.
EmptyDir volumes exist only while a Pod occupies a node. They are created fresh when a Pod starts and discarded when the Pod is deleted. Use EmptyDir for temporary scratch space, cache, or shared data between containers in the same Pod. For persistent data, use PersistentVolumeClaims.
ConfigMaps store non-sensitive configuration data as key-value pairs, while Secrets store sensitive data like passwords or SSH keys. Secrets are encoded (not encrypted by default) and can be mounted as volumes or environment variables. Both allow decoupling configuration from container images, but Secrets have additional RBAC controls.
A readiness probe determines if a Pod is ready to serve traffic. If the probe fails, the Pod is removed from the Service's endpoints, so no requests are routed to it. This prevents serving traffic to Pods that are still initializing or overwhelmed. The liveness probe, in contrast, restarts unhealthy containers.
Namespaces logically divide a Kubernetes cluster into virtual sub-clusters. They provide isolation for resources (Pods, Services, etc.) and are used to separate environments (e.g., dev, test, prod) or teams. In Red Hat's OpenShift, projects are namespaces with additional annotations. Understanding namespaces is critical for multi-tenancy and resource quotas.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
