Red Hat · Free Practice Questions · Last reviewed May 2026
42real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?
Set runAsUser.type to RunAsAny and add securityContext.runAsUser: 1000 in the pod spec
Configure fsGroup.type to MustRunAs with uid: 1000
Set privileged: true and map the container user via supplementalGroups
Set runAsUser.type to MustRunAs and specify uid: 1000 in the uidRange
Setting runAsUser.type to MustRunAs with the appropriate UID ensures the container always runs as the specified user ID.
A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?
allowHostPorts: true
Setting allowHostPorts to true allows pods to bind to ports on the host node, including privileged ports.
runAsUser.type: RunAsAny
allowPrivilegedContainer: true
privileged: true
An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?
As an annotation on the cluster-scoped Namespace object
Inside the Route object spec under tls.imagePullSecret
In the Deployment configuration spec under template.spec.imagePullSecrets
Specifying imagePullSecrets inside the pod template spec ensures pods created by the deployment use the credentials.
As an environment variable named IMAGE_PULL_SECRET in the container specification
An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?
pod-security.kubernetes.io/enforce: restricted
This label enforces the restricted Pod Security Standard, blocking non-compliant pods.
pod-security.openshift.io/standard: restricted
security.openshift.io/scc.enforce: restricted
openshift.io/cluster-monitoring: "true"
An administrator needs to configure a new project so that pods deployed within it run with the restricted-v2 Security Context Constraint by default. Which action should the administrator perform?
Annotate the Namespace with security.openshift.io/scc: restricted-v2
This annotation instructs the SCC admission plugin to assign restricted-v2 as the default for pods in the namespace.
Edit the default cluster-wide SCC object directly to set restricted-v2 as priority zero
Create a RoleBinding linking the restricted-v2 ClusterRole to the system:authenticated group
Patch the PodSecurity standards admission configuration in the APIServer resource
An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?
spec.endpoint.tls with base64 encoded string data
metadata.annotations containing openshift.io/tls-cert and openshift.io/tls-key
spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate
An edge-terminated route defines certificate, key, and optional CA certificate directly within the spec.tls object.
status.ingress.tls for automatic cert-manager synchronization
Want more Security And SCC practice?
Practice this domainAn OpenShift administrator observes that the 'authentication' ClusterOperator is reporting Available=False, Progressing=True, and Degraded=True. During troubleshooting, they notice that the kube-apiserver cannot validate tokens because the OAuth server routes are unreachable due to a misconfigured ingress controller. Which log collection method is best suited to pinpoint the OAuth metadata retrieval failure?
oc logs -n openshift-authentication deployment/oauth-openshift
The authentication operator deploys the OAuth server in the openshift-authentication namespace, where connectivity and token exchange logs reside.
oc get events -n openshift-config-managed
oc get clusteroperator authentication -o yaml
oc adm must-gather --image=quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:...
An OpenShift administrator needs to investigate a pod that is failing with an 'OOMKilled' exit code. Which command reveals the memory limit configuration and historical usage right before the crash?
oc describe pod <pod-name>
oc describe pod shows the termination reason, exit code 137, and resource limits set on the container.
oc top pod <pod-name> --containers
oc get pod <pod-name> -o yaml
oc adm diagnostics
An administrator is troubleshooting a failing MachineConfig update in an OpenShift cluster. The MachineConfigPool 'worker' is degraded and reports that a node is failing to apply the rendered-worker configuration. Which log stream is critical for determining why the Machine Config Daemon failed to update system files on the target node?
oc describe machineconfigpool worker
oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon
The machine-config-daemon DaemonSet pods run on every node and execute the actual file updates and systemd restarts.
oc logs -n openshift-cluster-version-operator deployment/cluster-version-operator
journalctl -u kubelet -e
A cluster administrator suspects that an API rate-limiting issue is causing intermittent client timeouts. Which component logs should be inspected to confirm that clients are exceeding their API request limits?
oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>
The kube-apiserver pods log client requests and can indicate request rejection due to rate limiting.
oc get events --all-namespaces
oc logs -n openshift-ingress-operator deployment/ingress-operator
oc logs -n openshift-kube-apiserver-operator deployment/cluster-kube-apiserver-operator
An administrator wants to view the logs of a specific container named 'backend' inside a pod with multiple containers. Which command should be used?
oc logs pod/my-pod backend
oc rsh pod/my-pod backend
oc describe pod/my-pod -c backend
oc logs pod/my-pod -c backend
The -c flag correctly specifies which container's logs to retrieve from a multi-container pod.
A developer reports that their pod is unable to start because it cannot mount a persistent volume claim (PVC). Where should the administrator look to diagnose volume attachment issues related to the CSI driver?
oc get events -n openshift-storage
oc describe pvc my-pvc
Describe PVC provides immediate feedback on binding status, events, and CSI mount errors.
oc debug node/worker-0
oc logs -n openshift-cluster-storage-operator deployment/csi-snapshot-controller-operator
Want more Troubleshooting And Diagnostics practice?
Practice this domainAn OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?
oc auth can-i --list --user=alex@example.com
oc get groups --user=alex@example.com
oc get identity alex@example.com
oc describe user alex@example.com
Describing the user resource reveals their UID, identities, and associated group memberships.
A developer reports they cannot deploy applications because their deployment quota is exhausted. Upon inspecting the 'LimitRange' object in the namespace, you notice default limits are set. However, a specific container in their deployment YAML fails validation during creation with an admission webhook error stating 'container exceeds minimum cpu request'. Where must the adjustment be made to allow this specific deployment?
Update the container resource requests in the deployment YAML to meet or exceed the LimitRange minimums, or adjust the LimitRange object.
LimitRanges validate individual container resource requests against defined minimums and maximums at admission time.
Modify the ClusterQuota object to increase the CPU limit.
Create a ClusterRoleBinding giving the developer cluster-admin rights to bypass admission webhooks.
Add the developer to the 'system:masters' group to override resource constraints.
You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?
oc auth can-i list deployments --as=system:serviceaccount:ci-cd:cicd-bot -n ci-cd
This command correctly evaluates whether the specified service account possesses permission to list deployments in the given namespace.
oc adm policy who-can get deployments -n ci-cd
oc describe serviceaccount cicd-bot -n ci-cd
oc get rolebindings --serviceaccount=cicd-bot
A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?
Modify the 'pod-debugger' ClusterRole directly to include a namespace selector for 'app-dev'.
Create a Role in the 'app-dev' namespace and assign it to the 'pod-debugger' subject.
Create a RoleBinding in the 'app-dev' namespace referencing the 'pod-debugger' ClusterRole and the 'development' group.
Referencing a ClusterRole in a namespace-scoped RoleBinding effectively grants those permissions only within that specific namespace.
Create a ClusterRoleBinding for the 'development' group pointing to 'pod-debugger'.
An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?
A SecurityContextConstraints object assigned to the ServiceAccount
A ClusterRole and a RoleBinding in the monitoring namespace
A ClusterRole and a ClusterRoleBinding
ClusterRoles combined with ClusterRoleBindings provide cluster-wide permissions such as reading pods in all namespaces.
A Role and a RoleBinding in the monitoring namespace
Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?
edit
view
cluster-admin
admin
The 'admin' role allows a user to view, modify, and delete most resources within a project.
Want more User And RBAC Management practice?
Practice this domainAn administrator needs to modify the SSH key used for debugging worker nodes across an OpenShift 4.14 cluster. Which resource type should the administrator edit or create to apply this change cluster-wide to all worker nodes?
Modify the ClusterVersion custom resource spec field.
Edit the kubelet configuration map in the kube-system namespace.
Update the authentication.config.openshift.io cluster operator resource.
Create or modify a MachineConfig object that targets the worker role and specifies the sshKey field.
MachineConfig resources are specifically designed by the Machine Config Operator to deliver OS-level settings like SSH keys.
Which component in OpenShift 4.14 is responsible for orchestrating the upgrade of the entire cluster from one minor version to another?
Machine Config Operator (MCO)
Cluster Version Operator (CVO)
The CVO is the core operator responsible for driving OpenShift cluster installation and version updates.
Cluster Infrastructure Operator (CIO)
Operator Lifecycle Manager (OLM)
An administrator wants to apply kernel arguments to all worker nodes in an OpenShift 4.14 cluster using the Machine Config Operator. After creating a new MachineConfig object, the administrator notices that the worker nodes are not updating and the MachineConfigPool status shows 'Updating=False'. What is the most likely cause?
The administrator forgot to run 'oc adm upgrade --force' to trigger node reboots.
The MachineConfig object lacks the correct labels required to associate it with the target MachineConfigPool.
MachineConfigs rely on labels to link themselves to specific MachineConfigPools; without them, the pool ignores the config.
The Cluster Version Operator must be manually restarted to detect new MachineConfig definitions.
The cluster storage provider must be re-initialized to support kernel argument persistence.
During an upgrade of an OpenShift 4.14 cluster using the Cluster Version Operator (CVO), the upgrade status stalls at a specific component. The administrator wants to check the detailed error messages and reconciling loops of the CVO itself. Where should the administrator look?
Inspect the clusteroperators object using 'oc describe clusteroperator base-os'.
Review the logs of the cluster-version-operator deployment in the openshift-cluster-version namespace.
The CVO pod in openshift-cluster-version manages cluster upgrades and logs all synchronization errors.
Check the cluster-wide events in the default namespace using 'oc get events'.
Inspect the MachineConfigPool status in the openshift-machine-api namespace.
An administrator needs to temporarily prevent the Machine Config Operator from applying pending MachineConfig changes to the worker nodes while performing troubleshooting. How should the administrator accomplish this?
Patch the worker MachineConfigPool to set 'spec.paused: true'.
Setting paused to true on a MachineConfigPool stops the MCO from rolling out new configurations to that pool.
Delete all pending MachineConfig objects from the cluster.
Scale down the machine-config-operator deployment in openshift-machine-config-operator to zero replicas.
Annotate all worker nodes with 'machineconfiguration.openshift.io/paused=true'.
An administrator running OpenShift 4.14 wants to configure automatic approval for an Operator subscription updates using the Operator Lifecycle Manager. Which field and value in the Subscription resource must be set?
Set 'spec.installPlanApproval: Automatic'
The installPlanApproval field controls whether OLM automatically approves new install plans or requires manual intervention.
Set 'spec.channel.autoApprove: yes'
Set 'spec.autoUpgrade: true'
Set 'spec.approvalStrategy: Immediate'
Want more Cluster Installation And Management practice?
Practice this domainA cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?
openshift.io/cluster-monitoring=true
security.openshift.io/scc=restricted
A custom label defined in the namespaceSelector of the NetworkPolicy spec
The namespace must carry the exact key-value pair specified in the namespaceSelector of the ingress rule.
kubernetes.io/metadata.name matching the namespace name
An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?
By querying the OpenShift API server directly on port 6443 for DNS records
Through an environment variable named CLUSTER_DNS injected into every container
By parsing the /etc/hosts file updated dynamically by the OpenShift SDN controller
Via the /etc/resolv.conf file automatically managed inside the pod container
Kubelet configures the /etc/resolv.conf file for each pod to point to the cluster DNS service IP address.
An administrator wants to expose a Deployment via a NodePort service. What is the default port range allocated for NodePort services in OpenShift if not explicitly configured otherwise?
1024-65535
80-443
30000-32767
The default NodePort range in Kubernetes/OpenShift is 30000 to 32767.
8000-9000
An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?
backend.production.pod.cluster.local
backend.production.router.default.svc
svc.production.backend.cluster.local
backend.production.svc.cluster.local
This is the correct fully qualified domain name structure for internal cluster services.
An administrator created a Route but external clients receive a 503 Service Unavailable error when attempting to access it. Upon checking the endpoints of the Service referenced by the Route, the administrator discovers there are zero endpoints listed. What is the most likely cause?
The Route YAML has an invalid TLS certificate format.
The Ingress controller pods have crashed across all worker nodes.
The cluster DNS operator is degraded.
The Service selector labels do not match any active Pod labels.
If selectors do not match pods, no endpoints are generated, causing the router to return a 503 error.
An OVN-Kubernetes clustered environment requires configuring egress IP functionality for a specific namespace so that all outgoing traffic from pods in that namespace appears to originate from a designated external IP address. Which custom resource must be configured?
ClusterNetwork
HostSubnet
EgressRouter
EgressIP
The EgressIP custom resource is used by OVN-Kubernetes to assign dedicated IPs for egress traffic.
Want more Networking And Network Policies practice?
Practice this domainAn OpenShift administrator needs to trigger a rollback of a Deployment to its previous working revision after a failed update. Which oc command should be used?
oc update deployment/my-app --revision=previous
oc rollout undo deployment/my-app
oc rollout undo reverts the deployment to the previous or specified revision.
oc revert deployment/my-app
oc rollback deployment/my-app
A developer has created a Kustomization file that applies a namespace prefix and some patches to base Kubernetes manifests. How can the developer apply these manifests to an OpenShift cluster using standard oc tooling without installing standalone Kustomize?
oc create -f kustomization.yaml
oc run -k ./directory
oc apply -k ./directory
oc apply -k directs the client to build and apply the Kustomize package from the directory.
oc kustomize apply ./directory
A DeploymentConfig in OpenShift has a Rolling strategy defined. Which parameter in the strategy configuration controls the maximum number of pods that can be created above the desired replica count during the update?
interval
maxSurge
maxSurge specifies the maximum number of extra pods allowed during the rollout.
updatePeriodSeconds
maxUnavailable
An administrator needs to deploy a Helm chart into an OpenShift cluster while overriding specific chart values using a local YAML file. Which Helm CLI command should be executed?
helm push my-chart --override overrides.yaml
helm install my-release my-chart --values overrides.yaml
helm install creates a release from a chart and accepts custom values files via --values.
helm deploy my-release my-chart --values overrides.yaml
helm apply -f overrides.yaml my-chart
An administrator needs to view the rollout history of a DeploymentConfig named web-frontend. Which command accomplishes this?
oc rollout history dc/web-frontend
oc rollout history lists past revisions and configurations for the specified deployment resource.
oc describe dc/web-frontend
oc get revisions dc/web-frontend
oc log rollout dc/web-frontend
A BuildConfig uses an S2I strategy and needs to pull private base images from a secured external container registry. Where must the administrator configure the pull credentials so the builder pod can authenticate?
In the ImageStream tag policy
In the Route resource annotations
In the global cluster OAuth configuration
In the BuildConfig spec under strategy.dockerStrategy.pullSecret or source/strategy configuration
Build configs support pullSecret configurations to authenticate against private registries during image pulls.
Want more Application Deployment And Lifecycle practice?
Practice this domainA developer requests a PersistentVolumeClaim using ReadWriteMany access mode. Which default storage type in a standard AWS ODF (OpenShift Data Foundation) deployment natively supports RWX?
openshift-storage.rbd.csi.ceph.com
gp2-csi.storage.k8s.io
ebs.csi.aws.com
openshift-storage.cephfs.csi.ceph.com
CephFS natively supports RWX access modes across pods and nodes.
A user creates a VolumeSnapshot and notices that the resulting VolumeSnapshotContent status is marked as readyToUse: false. What is the most likely cause?
The VolumeSnapshot object must be manually promoted before it becomes ready.
The PVC being snapshotted has active writes and the storage backend is still synchronizing snapshot data.
Asynchronous storage backends or heavy write loads can delay the readiness of a snapshot.
The VolumeSnapshotClass is missing the deletionPolicy parameter.
The PVC must be unmounted from all running pods before a snapshot can be marked ready.
A stateful application needs its PersistentVolume to be bound only after the pod requesting it is assigned to a specific worker node, to avoid topology mismatch issues. Which StorageClass parameter achieves this?
allowVolumeExpansion: true
volumeBindingMode: Immediate
bindingMode: Late
volumeBindingMode: WaitForFirstConsumer
This mode ensures topology-aware provisioning by waiting for pod scheduling.
You need to provide temporary scratch space for a container that shares the pod's lifetime and is cleared when the pod is deleted. Which volume type should you configure in the Pod specification?
persistentVolumeClaim
hostPath
nfs
emptyDir
emptyDir provides ephemeral storage tied strictly to the lifecycle of the pod.
An administrator needs to provision persistent storage dynamically using an NFS server. Which provisioner is required in the StorageClass definition since OpenShift removed the in-tree NFS provisioner?
nfs.csi.k8s.io
kubernetes.io/nfs
sig-storage.k8s.io/nfs-subdir-external-provisioner
This external provisioner correctly supports dynamic NFS provisioning via subdirectories.
openshift.io/nfs-dynamic
An administrator needs to increase the size of an existing PVC bound to a gp3 storage class in an OpenShift cluster. What is the mandatory first step before editing the PVC spec?
Ensure allowVolumeExpansion: true is set on the corresponding StorageClass.
Volume expansion will fail unless explicitly enabled on the StorageClass.
Manually update the underlying cloud provider disk size via the AWS console.
Delete the PV and recreate it with the new size.
Scale down all pods using the PVC to zero replicas.
Want more Storage And Persistent Volumes practice?
Practice this domainThe EX280 exam is performance-based — there are no multiple-choice questions. It is a hands-on lab exam completed within 120 minutes. You complete practical tasks in a live or simulated environment. Courseiva practice questions cover the underlying concepts.
Hands-on Linux administration tasks in a live RHEL environment.
The exam covers 7 domains: Security And SCC, Troubleshooting And Diagnostics, User And RBAC Management, Cluster Installation And Management, Networking And Network Policies, Application Deployment And Lifecycle, Storage And Persistent Volumes. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Red Hat EX280 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.