Networking And Network Policies

A cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?

An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?

An administrator wants to expose a Deployment via a NodePort service. What is the default port range allocated for NodePort services in OpenShift if not explicitly configured otherwise?

An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?

An administrator created a Route but external clients receive a 503 Service Unavailable error when attempting to access it. Upon checking the endpoints of the Service referenced by the Route, the administrator discovers there are zero endpoints listed. What is the most likely cause?

An administrator wants to view the public URL assigned to an existing Route named 'webapp'. Which oc command is best suited to extract only the host URL value?

An administrator needs to modify the default Ingress controller configuration to change its replica count and adjust the router deployment parameters. Which resource should the administrator edit?

An administrator configures a LoadBalancer service on an OpenShift cluster running on a cloud provider. However, the EXTERNAL-IP remains in a <pending> state indefinitely. What is the most likely reason?

An administrator needs to create a passthrough Route that preserves client certificates and forwards encrypted traffic directly to the backend pod. Which spec configuration is required?

An administrator wants to configure a NetworkPolicy that allows incoming traffic only from pods with the label 'role=frontend' residing in any namespace, provided those namespaces have the label 'environment=production'. How should the namespaceSelector and podSelector be combined?

An administrator wants to test network connectivity from a pod named 'app-pod-1' to a service port on 'backend-service' using TCP. Which tool is commonly available and ideal for testing TCP port connectivity inside a container?

An administrator creates a NetworkPolicy that restricts egress traffic from a namespace. However, DNS resolution for external services immediately stops working. What is the cause of this behavior?

An administrator needs to configure a custom default certificate for all routes created in the cluster without specifying a certificate on every individual Route object. Where should this wildcard certificate be configured?

An administrator needs to list all Services across all namespaces in the OpenShift cluster. Which command should be used?

An OpenShift administrator needs to inspect how OVN-Kubernetes handles network flows and packet drops on a specific node. Which debugging utility installed in the OVN node container is most effective for viewing OpenFlow rules?

An administrator notices that client source IP addresses are lost when traffic hits a Service of type NodePort, appearing instead as a node IP. Which field in the Service specification should be changed to 'Local' to preserve client source IPs?

An administrator needs to create a Route that handles multiple subdomains or redirects insecure HTTP traffic to HTTPS automatically. Where is the insecure traffic redirect configured?

A developer deploys a headless service (ClusterIP set to None) in OpenShift. What is the primary characteristic of a headless service?

An administrator configures an EgressFirewall in a namespace to deny all external traffic except for a specific CIDR block. In what order are the rules in an EgressFirewall evaluated?

An administrator needs to expose an existing deployment using a quick command without writing a YAML manifest. Which command exposes port 8080 of a deployment named 'my-app' as a Service?

An administrator needs to test DNS resolution from inside a running pod. Which command run inside a container uses the standard Linux DNS lookup utility?

An administrator troubleshoots a failing NetworkPolicy and wants to verify if the OpenShift SDN or OVN-Kubernetes controller has successfully applied the rules. Where are the controller operator logs examined?

An administrator needs to delete a Service named 'old-service' in the 'test' namespace. Which command accomplishes this?

An administrator needs to configure a Route that handles encrypted communication both from the client to the router AND from the router to the backend pod. Which termination type is required?

An administrator wants to check the status of all cluster operators, specifically verifying that the Network and DNS operators are healthy. Which command should be run?

An administrator observes that pods in a specific namespace are unable to resolve external domain names (e.g., www.redhat.com) while internal service resolution works perfectly. What is the most likely cause of this issue in CoreDNS configuration?

Which TWO of the following are valid Service types supported natively in OpenShift? (Choose TWO)

Which THREE of the following components are part of the standard OpenShift Ingress architecture? (Choose THREE)

Which TWO options describe characteristics of OVN-Kubernetes compared to the legacy OpenShift SDN? (Choose TWO)

Which THREE troubleshooting steps should an administrator take when a newly created Route fails to resolve or connect? (Choose THREE)

Which TWO tools or protocols can an administrator use to verify internal cluster DNS resolution from a pod? (Choose TWO)

Which TWO commands are used to check the health and status of the cluster networking operator? (Choose TWO)

Which THREE actions can be performed using the IngressController custom resource? (Choose THREE)

Which THREE network-related objects are namespaced in OpenShift? (Choose THREE)

Which TWO statements are true regarding OpenShift Services of type LoadBalancer? (Choose TWO)

Which TWO methods can an administrator use to troubleshoot why a pod cannot connect to a remote Service? (Choose TWO)

Which THREE conditions must be met for a NetworkPolicy to successfully allow traffic from another pod? (Choose THREE)

An administrator needs to expose an internal application running on port 8080 via an OpenShift Route using edge termination. Which object configuration correctly defines this Route?

A developer reports that pods in the namespace 'project-a' cannot resolve services located in the namespace 'project-b' using standard internal DNS names. What is the correct way to query 'project-b' service 'backend' from 'project-a'?

An administrator must configure a NetworkPolicy in the 'secure-zone' namespace to explicitly deny all ingress traffic except for TCP traffic coming from pods labeled 'tier=frontend' in the 'frontend-zone' namespace. Which NetworkPolicy specification achieves this?

An administrator needs to create a service that exposes an application externally via an IP address allocated from an external cloud provider load balancer. Which service type must be used?

A cluster administrator needs to inspect the current default CNI network provider configured in an OpenShift 4.14 cluster. Which command or resource should the administrator check?

An application pod needs to discover other pods behind the same headless service. What characteristic defines a headless service?

An administrator needs to modify the timeout values for the default OpenShift Ingress Controller (Router). Where should this change be applied?

A developer wants to expose an application using a secure Route that terminates TLS on the pod itself, avoiding decryption at the router layer. Which TLS termination type should be selected?

An OpenShift administrator needs to restrict external access to a specific application Route by limiting access to a predefined list of allowed client IP addresses. How can this be accomplished?

An administrator notices that pods on different worker nodes cannot communicate with each other. Upon checking the cluster network operator, it appears the MTU settings between the underlying physical network and the cluster overlay network mismatch. Which OpenShift command checks the cluster network operator status?

A service of type NodePort has been created in OpenShift. Within what default port range are NodePort services typically allocated on the worker nodes?

Which TWO of the following are valid OpenShift Service types? (Choose TWO)

Which THREE actions can be performed when managing Route objects in OpenShift? (Choose THREE)

Which TWO options are valid methods to check service endpoints in OpenShift? (Choose TWO)

When configuring a NetworkPolicy in OpenShift, which THREE options represent valid components or fields within a NetworkPolicy specification? (Choose THREE)

Which TWO components are core parts of the OpenShift DNS architecture for cluster resolution? (Choose TWO)

Which THREE statements are true regarding Ingress controllers in OpenShift? (Choose THREE)

An administrator needs to restrict ingress traffic to pods in the 'frontend' namespace so that only pods labeled role=api in the 'backend' namespace can connect on TCP port 8080. All other traffic must be denied. Which NetworkPolicy configuration achieves this?

A developer reports that a Service in the project `webapp` is not exposing the expected endpoints, even though the Deployment shows all replicas Running. The administrator inspects the Service and sees the selector is `app: web-frontend`. Which command should the administrator run to verify whether the Pods actually carry the labels the Service selector expects?

An administrator is troubleshooting why a Pod in namespace `app-a` cannot reach a Pod in namespace `app-b` on TCP port 3306, even though both Pods are Running and the Services resolve correctly. A NetworkPolicy in `app-b` allows ingress only from Pods labeled `tier: frontend` in `app-a`. The source Pod in `app-a` has the label `tier: backend`. What is the most likely cause?