Red Hat · Free Practice Questions · Last reviewed May 2026
42 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A developer reports they cannot deploy applications because their deployment quota is exhausted. Upon inspecting the 'LimitRange' object in the namespace, you notice default limits are set. However, a specific container in their deployment YAML fails validation during creation with an admission webhook error stating 'container exceeds minimum cpu request'. Where must the adjustment be made to allow this specific deployment?
Update the container resource requests in the deployment YAML to meet or exceed the LimitRange minimums, or adjust the LimitRange object.
Admission validation compares each container's requests against the LimitRange minimums, so the fix lies either in raising the container's cpu request in the deployment spec or lowering the LimitRange floor; the LimitRange alone does not grant the pod.
Modify the ClusterQuota object to increase the CPU limit.
Create a ClusterRoleBinding giving the developer cluster-admin rights to bypass admission webhooks.
Add the developer to the 'system:masters' group to override resource constraints.
You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?
oc auth can-i list deployments --as=system:serviceaccount:ci-cd:cicd-bot -n ci-cd
The --as flag performs user impersonation, letting you evaluate RBAC as the service account system:serviceaccount:ci-cd:cicd-bot. Combined with -n ci-cd, this tests whether that account can list deployments in its own namespace, satisfying the effective-permissions check.
oc adm policy who-can get deployments -n ci-cd
oc describe serviceaccount cicd-bot -n ci-cd
oc get rolebindings --serviceaccount=cicd-bot
A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?
Modify the 'pod-debugger' ClusterRole directly to include a namespace selector for 'app-dev'.
Create a Role in the 'app-dev' namespace and assign it to the 'pod-debugger' subject.
Create a RoleBinding in the 'app-dev' namespace referencing the 'pod-debugger' ClusterRole and the 'development' group.
A RoleBinding in the 'app-dev' namespace grants the 'pod-debugger' ClusterRole's permissions solely within that project, satisfying the constraint that only the 'development' group may execute commands in pods there. Unlike a ClusterRoleBinding, which would extend access cluster-wide, this namespace-scoped binding correctly limits the group's permissions to 'app-dev'.
Create a ClusterRoleBinding for the 'development' group pointing to 'pod-debugger'.
An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?
A SecurityContextConstraints object assigned to the ServiceAccount
A ClusterRole and a RoleBinding in the monitoring namespace
A ClusterRole and a ClusterRoleBinding
A ClusterRole defines permissions cluster-wide, and binding it via ClusterRoleBinding to the 'monitor-sa' service account grants read-only pod access across every namespace. A Role with RoleBinding would only apply within the 'monitoring' namespace, failing the all-namespaces constraint.
A Role and a RoleBinding in the monitoring namespace
Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?
edit
view
cluster-admin
admin
The `admin` cluster role grants full management of resources within a project, including roles and bindings, when bound through a RoleBinding. It is the default role intended for project administrators, unlike `edit` or `view`, which omit permission management.
A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?
Configure a LimitRange object in the 'data-tier' namespace with max storage constraints for persistent volume claims.
A LimitRange with a `max` storage constraint on `persistentvolumeclaim` enforces the 50Gi ceiling at admission time within the 'data-tier' namespace, rejecting oversized PVCs while permitting smaller requests. This satisfies the per-namespace, per-group restriction without altering cluster-wide quota behaviour.
Set a StorageClass default size restriction.
Apply a ClusterRole restricting PVC creation sizes.
Configure an egress firewall rule blocking large volume attachments.
Want more User And RBAC Management practice?
Practice this domainAn OpenShift administrator needs to investigate a pod that is failing with an 'OOMKilled' exit code. Which command reveals the memory limit configuration and historical usage right before the crash?
oc describe pod <pod-name>
`oc describe pod` reports the container's configured memory limit and requests from the pod spec, plus recent events including OOMKilled terminations. It satisfies the need to see the limit that was exceeded, though historical usage immediately before the crash requires metrics tooling rather than describe output alone.
oc top pod <pod-name> --containers
oc get pod <pod-name> -o yaml
oc adm diagnostics
An administrator is troubleshooting a failing MachineConfig update in an OpenShift cluster. The MachineConfigPool 'worker' is degraded and reports that a node is failing to apply the rendered-worker configuration. Which log stream is critical for determining why the Machine Config Daemon failed to update system files on the target node?
oc describe machineconfigpool worker
oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon
The Machine Config Daemon runs as a DaemonSet pod on each node, and its container logs record exactly why it failed to write system files during a rendered-worker update. Querying the daemonset in the openshift-machine-config-operator namespace surfaces the per-node error, satisfying the need to diagnose the degraded MachineConfigPool.
oc logs -n openshift-cluster-version-operator deployment/cluster-version-operator
journalctl -u kubelet -e
An administrator wants to view the logs of a specific container named 'backend' inside a pod with multiple containers. Which command should be used?
oc logs pod/my-pod backend
oc rsh pod/my-pod backend
oc describe pod/my-pod -c backend
oc logs pod/my-pod -c backend
Using `-c backend` selects the named container within the multi-container pod, which is the constraint the stem specifies. Without it, `oc logs` defaults to the first container, returning the wrong output. The `pod/my-pod` resource syntax is valid for OpenShift's `oc logs` command.
An administrator needs to collect cluster-wide diagnostic information from an OpenShift 4.14 cluster for a Red Hat support case. Which command should be executed?
oc adm diagnose
oc adm must-gather
must-gather aggregates cluster-wide diagnostics — node, pod, operator and etcd data — into a single archive for Red Hat support. It satisfies the requirement to collect cluster-wide diagnostic information, unlike narrower commands that capture only one resource's state.
oc cluster-info dump
oc get clusteroperators -o yaml
An application pod is failing its liveness probe and continuously restarting. Where can an administrator quickly check the reason for the liveness probe failure?
oc get routes
oc get pod <pod-name> -o json
oc adm diagnostics
oc describe pod <pod-name>
oc describe pod reports container statuses, including liveness probe failures with their exit codes, events and restart counts, giving the fastest diagnostic view. Logs show application output rather than probe mechanics, and oc get pod shows only status, so describe is the appropriate first check.
An administrator notices that the Cluster Version Operator (CVO) is blocked during an upgrade because a cluster operator is missing version annotations. Which command allows checking the current status and payload version of the CVO?
oc get clusterversion
`oc get clusterversion` reads the ClusterVersion resource, whose status reports the CVO's current payload version and conditions, including any operator blocking progress. This directly satisfies the stem's requirement to check CVO status and payload version during the stalled upgrade.
oc adm upgrade status
oc get clusteroperators
oc version
Want more Troubleshooting And Diagnostics practice?
Practice this domainA cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?
openshift.io/cluster-monitoring=true
security.openshift.io/scc=restricted
A custom label defined in the namespaceSelector of the NetworkPolicy spec
A namespaceSelector matches namespaces by their labels, so the frontend namespace must carry the exact custom label key and value declared in the policy's namespaceSelector. Without that label, the selector never matches and traffic stays dropped.
kubernetes.io/metadata.name matching the namespace name
An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?
By querying the OpenShift API server directly on port 6443 for DNS records
Through an environment variable named CLUSTER_DNS injected into every container
By parsing the /etc/hosts file updated dynamically by the OpenShift SDN controller
Via the /etc/resolv.conf file automatically managed inside the pod container
The kubelet writes the pod's /etc/resolv.conf at creation, pointing nameserver at the CoreDNS ClusterIP service and setting search domains and ndots. Applications read this file to obtain cluster DNS resolution, so no manual configuration or API query is needed.
An administrator wants to expose a Deployment via a NodePort service. What is the default port range allocated for NodePort services in OpenShift if not explicitly configured otherwise?
1024-65535
80-443
30000-32767
OpenShift's default NodePort allocation is 30000-32767, inherited from Kubernetes' service-node-port-range. Unless the administrator edits that range in the kubelet or apiserver configuration, every NodePort service receives a port within these bounds, so this range is the correct default.
8000-9000
An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?
backend.production.pod.cluster.local
backend.production.router.default.svc
svc.production.backend.cluster.local
backend.production.svc.cluster.local
backend.production.svc.cluster.local follows Kubernetes' cluster DNS schema: service, namespace, "svc", then the cluster domain. It satisfies the stem's requirement for a fully qualified name resolving the 'backend' service in the 'production' namespace from any debug pod, without relying on search-domain expansion.
An administrator created a Route but external clients receive a 503 Service Unavailable error when attempting to access it. Upon checking the endpoints of the Service referenced by the Route, the administrator discovers there are zero endpoints listed. What is the most likely cause?
The Route YAML has an invalid TLS certificate format.
The Ingress controller pods have crashed across all worker nodes.
The cluster DNS operator is degraded.
The Service selector labels do not match any active Pod labels.
A Service with zero endpoints means its selector matches no running Pod labels, so the router has no backend to forward to and returns 503; correcting the selector or Pod labels restores endpoints and traffic.
An administrator wants to view the public URL assigned to an existing Route named 'webapp'. Which oc command is best suited to extract only the host URL value?
oc get route webapp --show-url
oc describe route webapp --url
oc extract route/webapp --field=host
oc get route webapp -o jsonpath='{.spec.host}'
The jsonpath output flag extracts only the host field from the Route object, returning the bare URL without headers or extra fields. This satisfies the requirement to isolate the host value rather than dumping the full YAML or JSON definition.
Want more Networking And Network Policies practice?
Practice this domainWhich component in OpenShift 4.14 is responsible for orchestrating the upgrade of the entire cluster from one minor version to another?
Machine Config Operator (MCO)
Cluster Version Operator (CVO)
The Cluster Version Operator continuously reconciles the cluster's desired OpenShift version against its actual state, driving the minor-version upgrade orchestration. It satisfies the stem's requirement for the component responsible for orchestrating the entire cluster upgrade, coordinating ClusterOperators through the release image.
Cluster Infrastructure Operator (CIO)
Operator Lifecycle Manager (OLM)
An administrator wants to apply kernel arguments to all worker nodes in an OpenShift 4.14 cluster using the Machine Config Operator. After creating a new MachineConfig object, the administrator notices that the worker nodes are not updating and the MachineConfigPool status shows 'Updating=False'. What is the most likely cause?
The administrator forgot to run 'oc adm upgrade --force' to trigger node reboots.
The MachineConfig object lacks the correct labels required to associate it with the target MachineConfigPool.
The Machine Config Operator selects MachineConfigs by the machineconfiguration.openshift.io/role label, which binds each object to a MachineConfigPool. Without the matching worker role label, the rendered config never merges into that pool, so nodes stay put and the pool reports Updating=False.
The Cluster Version Operator must be manually restarted to detect new MachineConfig definitions.
The cluster storage provider must be re-initialized to support kernel argument persistence.
An administrator needs to temporarily prevent the Machine Config Operator from applying pending MachineConfig changes to the worker nodes while performing troubleshooting. How should the administrator accomplish this?
Patch the worker MachineConfigPool to set 'spec.paused: true'.
Setting spec.paused to true on the worker MachineConfigPool halts the Machine Config Operator's rollout to those nodes, so pending MachineConfig changes are not applied during troubleshooting. Unpausing resumes rendering and application of the queued configurations.
Delete all pending MachineConfig objects from the cluster.
Scale down the machine-config-operator deployment in openshift-machine-config-operator to zero replicas.
Annotate all worker nodes with 'machineconfiguration.openshift.io/paused=true'.
An administrator running OpenShift 4.14 wants to configure automatic approval for an Operator subscription updates using the Operator Lifecycle Manager. Which field and value in the Subscription resource must be set?
Set 'spec.installPlanApproval: Automatic'
Setting `spec.installPlanApproval: Automatic` on the Subscription resource satisfies the stem's requirement for automatic approval of Operator updates. The Operator Lifecycle Manager reads this field and installs each new InstallPlan without manual intervention, whereas the default `Manual` value requires an administrator to approve every upgrade.
Set 'spec.channel.autoApprove: yes'
Set 'spec.autoUpgrade: true'
Set 'spec.approvalStrategy: Immediate'
An administrator needs to perform a graceful maintenance reboot on a worker node named worker-01 in an OpenShift 4.14 cluster without causing application downtime for stateless deployments. Which combination of actions should the administrator perform first?
Apply a MachineConfig to the worker MachineConfigPool pausing the updates, then reboot the node.
Run 'oc adm cordon worker-01' followed by 'oc adm drain worker-01 --delete-emptydir-data --ignore-daemonsets'.
Cordoning marks worker-01 unschedulable, preventing new pods from landing there, while draining evicts existing pods so their ReplicaSet controllers reschedule them onto remaining nodes. The `--ignore-daemonsets` flag permits eviction despite DaemonSet pods, and `--delete-emptydir-data` clears emptyDir volumes, satisfying the no-downtime constraint for stateless workloads.
Stop the kubelet service on worker-01 via systemctl and reboot the underlying operating system.
Run 'oc delete node worker-01' directly to force the cluster control plane to automatically reschedule workloads.
An OpenShift 4.14 cluster administrator has installed an Operator from OperatorHub into a custom namespace using a Subscription. The administrator notices that the Operator pod is not being created. Upon checking the Subscription, the installation mode is set to AllNamespaces, but the Operator target namespace is restricted. Which Operator Lifecycle Manager (OLM) object should the administrator inspect to troubleshoot why the CSV (ClusterServiceVersion) is not installing?
Check the MachineConfigPool for paused reconciliation flags.
Review the ClusterVersion resource status for pending updates.
Inspect the OperatorGroup in the target namespace to ensure its targetNamespaces match or support the Subscription scope.
The OperatorGroup defines which namespaces a CSV can target; a mismatch between its `targetNamespaces` and the Subscription's AllNamespaces scope blocks CSV resolution, so no Operator pod is created. Inspecting it in the target namespace reveals whether the group supports that scope, directly diagnosing the failed installation.
Inspect the KubeletConfig custom resource for validation errors.
Want more Cluster Installation And Management practice?
Practice this domainAn administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?
As an annotation on the cluster-scoped Namespace object
Inside the Route object spec under tls.imagePullSecret
In the Deployment configuration spec under template.spec.imagePullSecrets
Specifying imagePullSecrets inside the pod template spec ensures pods created by the deployment use the credentials.
As an environment variable named IMAGE_PULL_SECRET in the container specification
An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?
spec.endpoint.tls with base64 encoded string data
metadata.annotations containing openshift.io/tls-cert and openshift.io/tls-key
spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate
Edge termination places the certificate and private key on the router, so they belong in the Route's spec.tls fields: certificate, key and caCertificate. It satisfies the custom TLS certificate requirement, unlike re-encrypt or passthrough termination, which handle certificates differently.
status.ingress.tls for automatic cert-manager synchronization
An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?
A Secret named identity-provider in the openshift-authentication namespace
The cluster OAuth custom resource named cluster
The cluster OAuth custom resource configures identity providers for the web console, including LDAP, by defining the external directory connection and attribute mappings. Editing it satisfies the requirement to authenticate console users against the corporate directory.
An Authentication custom resource named cluster in the kube-system namespace
A ConfigMap named ldap-config in the openshift-config namespace
When configuring an OAuth identity provider of type HTPasswd, which object type must be created to store the username and hashed password pairs?
A ServiceAccount with special token annotations
A Secret containing the htpasswd flat-file data
HTPasswd identity providers read username and bcrypt-hashed password pairs from a flat file, so OpenShift stores that file's contents in a Secret and mounts it into the OAuth pods. A ConfigMap would expose the credentials in plain text, violating the requirement to hold hashed password data securely.
A ConfigMap containing plain-text user credentials
A custom resource of kind HTPasswdProvider in the openshift-config namespace
An administrator needs to configure re-encrypt TLS termination on a Route. In addition to the router certificate, what other certificate component must typically be provided in the route configuration?
The destination CA certificate to validate the backend pod's TLS certificate
Re-encrypt termination means the router decrypts and then re-encrypts traffic to the backend, so it must trust the pod's serving certificate. Supplying the destination CA certificate lets the router validate that backend certificate, which passthrough and edge termination do not require.
A base64 encoded kubeconfig file for the ingress operator
An identity provider public key for JSON Web Token validation
A client certificate for mutual TLS authentication against the OAuth server
An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?
Create a dedicated ServiceAccount, a Role granting get and list on pods, and a RoleBinding linking them in the namespace
A dedicated ServiceAccount with a namespaced Role granting only get and list on pods, bound via RoleBinding, delivers exactly the API permissions required while honouring least privilege. ClusterRole or broader verbs would exceed the pod-status querying need.
Bind the cluster-admin ClusterRole to the default ServiceAccount in the namespace using a ClusterRoleBinding
Annotate the default ServiceAccount with rbac.authorization.k8s.io/authtype: reader
Grant the system:openshift:scc:restricted ClusterRole to the ServiceAccount using a RoleBinding
Want more Security And SCC practice?
Practice this domainA stateful application needs its PersistentVolume to be bound only after the pod requesting it is assigned to a specific worker node, to avoid topology mismatch issues. Which StorageClass parameter achieves this?
allowVolumeExpansion: true
volumeBindingMode: Immediate
bindingMode: Late
volumeBindingMode: WaitForFirstConsumer
volumeBindingMode: WaitForFirstConsumer delays PersistentVolume binding until a pod using the claim is scheduled, letting the provisioner create storage in the node's topology zone. This satisfies the requirement that binding occur only after node assignment, avoiding cross-zone mismatch.
You need to provide temporary scratch space for a container that shares the pod's lifetime and is cleared when the pod is deleted. Which volume type should you configure in the Pod specification?
persistentVolumeClaim
hostPath
nfs
emptyDir
emptyDir creates a directory tied to the pod's lifecycle, shared by its containers and deleted permanently when the pod is removed. hostPath and persistent volumes outlive the pod, so they fail the stem's scratch-space and lifetime constraints.
An administrator needs to increase the size of an existing PVC bound to a gp3 storage class in an OpenShift cluster. What is the mandatory first step before editing the PVC spec?
Ensure allowVolumeExpansion: true is set on the corresponding StorageClass.
Volume expansion only proceeds when the StorageClass permits it, so `allowVolumeExpansion: true` must be present on the gp3 StorageClass before the PVC spec can be edited. Without this field, the API server rejects the resize request, making it the mandatory prerequisite for this scenario.
Manually update the underlying cloud provider disk size via the AWS console.
Delete the PV and recreate it with the new size.
Scale down all pods using the PVC to zero replicas.
A cluster administrator wants to create a VolumeSnapshot of a database PVC. Which API group must the VolumeSnapshotClass belong to?
snapshot.storage.k8s.io
VolumeSnapshotClass resources are defined in the snapshot.storage.k8s.io API group, which the external-snapshotter project provides. This satisfies the stem's requirement for snapshotting a database PVC, since the CSI snapshot CRDs (VolumeSnapshot, VolumeSnapshotClass, VolumeSnapshotContent) all live in that group, not in storage.k8s.io or v1.
storage.k8s.io
csi.storage.k8s.io
volumesnapshot.openshift.io
You want to restore an existing VolumeSnapshot into a new PersistentVolumeClaim. Which field in the PVC specification must reference the VolumeSnapshot?
claimRef
snapshotName
dataSource
The dataSource field names the VolumeSnapshot as the source for provisioning, so the CSI driver restores its contents into the new PVC. Setting dataSource to a VolumeSnapshot kind satisfies the requirement to restore an existing snapshot rather than bind an empty volume.
volumeName
A cluster administrator notices that a PVC stuck in the Pending state references a StorageClass with volumeBindingMode set to WaitForFirstConsumer. What action will cause the PVC to bind?
Delete the StorageClass and recreate it with Immediate binding mode.
Restart the kube-apiserver service on the control plane nodes.
Create and schedule a Pod that mounts the PVC.
With WaitForFirstConsumer, the volume binding decision is deferred until a Pod using the PVC is scheduled, letting the scheduler pick a node and then provision storage in that node's topology zone. Creating and scheduling a Pod that mounts the PVC triggers this provisioning, satisfying the delayed-binding constraint and moving the PVC from Pending to Bound.
Manually create a PV matching the exact size and labels of the PVC.
Want more Storage And Persistent Volumes practice?
Practice this domainAn OpenShift administrator needs to trigger a rollback of a Deployment to its previous working revision after a failed update. Which oc command should be used?
oc update deployment/my-app --revision=previous
oc rollout undo deployment/my-app
oc rollout undo reverts the Deployment to its previous revision, restoring the last working state after the failed update. It directly satisfies the rollback requirement by targeting the Deployment's revision history rather than editing or recreating the resource.
oc revert deployment/my-app
oc rollback deployment/my-app
A developer has created a Kustomization file that applies a namespace prefix and some patches to base Kubernetes manifests. How can the developer apply these manifests to an OpenShift cluster using standard oc tooling without installing standalone Kustomize?
oc create -f kustomization.yaml
oc run -k ./directory
oc apply -k ./directory
The -k flag tells oc to build and apply resources from a Kustomization directory, invoking the Kustomize functionality built into oc. This applies the namespace prefix and patches without installing standalone Kustomize, satisfying the standard-tooling constraint.
oc kustomize apply ./directory
A DeploymentConfig in OpenShift has a Rolling strategy defined. Which parameter in the strategy configuration controls the maximum number of pods that can be created above the desired replica count during the update?
interval
maxSurge
maxSurge defines how many pods may exceed the desired replica count during a rolling update, controlling extra capacity created above the target. maxUnavailable instead governs how many pods may be simultaneously unavailable, so maxSurge is the parameter requested.
updatePeriodSeconds
maxUnavailable
An administrator needs to deploy a Helm chart into an OpenShift cluster while overriding specific chart values using a local YAML file. Which Helm CLI command should be executed?
helm push my-chart --override overrides.yaml
helm install my-release my-chart --values overrides.yaml
The --values flag supplies a local YAML file whose keys override the chart's default values during installation, which is exactly the stated requirement. helm install my-release my-chart --values overrides.yaml therefore deploys the chart with those overrides applied.
helm deploy my-release my-chart --values overrides.yaml
helm apply -f overrides.yaml my-chart
An administrator needs to view the rollout history of a DeploymentConfig named web-frontend. Which command accomplishes this?
oc rollout history dc/web-frontend
The 'oc rollout history' command with the dc/web-frontend resource argument queries the deployment configuration's revision history, listing each rollout with its revision number and change cause, directly satisfying the administrator's need to view rollout history.
oc describe dc/web-frontend
oc get revisions dc/web-frontend
oc log rollout dc/web-frontend
A developer wants to track multiple versions and tags of container images within an OpenShift cluster efficiently. Which OpenShift resource provides this capability?
Route
ImageStream
ImageStreams abstract image references, tracking multiple versions and tags via image tags and history within OpenShift. This satisfies the developer's need to manage and reference changing container images without hardcoding registry paths, enabling triggers and rollbacks.
DeploymentConfig
BuildConfig
Want more Application Deployment And Lifecycle practice?
Practice this domainThe EX280 exam is performance-based — there are no multiple-choice questions. It is a hands-on lab exam completed within 180 minutes. You complete practical tasks in a live or simulated environment. Courseiva practice questions cover the underlying concepts.
Hands-on Linux administration tasks in a live RHEL environment.
The exam covers 7 domains: User And RBAC Management, Troubleshooting And Diagnostics, Networking And Network Policies, Cluster Installation And Management, Security And SCC, Storage And Persistent Volumes, Application Deployment And Lifecycle. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Red Hat EX280 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.