EX280 Practice Test 10 — 10 Questions

Question 1

A cluster administrator needs to inspect the current bindings and capacities of all PersistentVolumes across the entire OpenShift cluster. Which CLI command should be used?

Accepted Answer

oc get pv. PersistentVolumes (PVs) are cluster-scoped resources in OpenShift/Kubernetes, so 'oc get pv' lists every PV in the cluster along with its capacity, access modes, reclaim policy, status, and claim binding. Because PVs are not namespaced, no --all-namespaces flag is needed or accepted. This single command gives the administrator the complete cluster-wide view of bindings and capacities requested.

Answer

oc get pvc --all-namespaces

Answer

oc describe storage

Answer

oc get volume

Question 2

A cluster operator is reviewing the volume snapshot implementation in an OpenShift 4.14 environment. Which THREE components or resources are required to successfully perform and manage volume snapshots? (Choose THREE)

Accepted Answer

A CSI driver that implements snapshot/restore GRPC services. Option A is correct because volume snapshots in OpenShift depend on a CSI driver that implements the snapshot/restore gRPC services (the external-snapshotter sidecar and CSI snapshotter capability), which actually creates and restores the snapshots on the storage backend. Option B is correct because a VolumeSnapshotClass defines the CSI driver and deletion policy used when provisioning a VolumeSnapshot, and it must exist for the snapshot to be dynamically created. Option D is correct because the VolumeSnapshot object is the user-facing resource that requests the snapshot and tracks its status and restore point. Option C is not required, since snapshot operations are governed by RBAC on the snapshot resources rather than a default ClusterRoleBinding for system:authenticated users. Option E is not required, as NetworkPolicy controls pod network traffic and is unrelated to provisioning or managing volume snapshots.

Answer

A default ClusterRoleBinding for system:authenticated users

Answer

NetworkPolicy resources restricting snapshot traffic

Question 3

A stateful application needs its PersistentVolume to be bound only after the pod requesting it is assigned to a specific worker node, to avoid topology mismatch issues. Which StorageClass parameter achieves this?

Accepted Answer

volumeBindingMode: WaitForFirstConsumer. The volumeBindingMode: WaitForFirstConsumer parameter in a StorageClass delays volume binding until a pod using the PVC is scheduled. This ensures that the PersistentVolume is provisioned in the same topology zone as the node where the pod runs, preventing topology mismatch. It is the correct setting for stateful applications that require node-local or zone-specific storage.

Answer

allowVolumeExpansion: true

Answer

volumeBindingMode: Immediate

Answer

bindingMode: Late

Question 4

An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?

Accepted Answer

In the 'openshift-config' namespace as a Secret referenced by the OAuth configuration. When configuring an LDAP identity provider in OpenShift, the bind DN password must be stored as a Secret in the 'openshift-config' namespace and referenced in the OAuth configuration. This is the required location for sensitive credentials used by the OAuth server to authenticate against LDAP.

Answer

On each worker node at '/etc/origin/master/ldap.pass'

Answer

As an environment variable on the oauth-openshift deployment

Answer

In the 'openshift-authentication' namespace as a ConfigMap

Question 5

An administrator is troubleshooting a certificate signing request (CSR) that is stuck in the Pending state for a newly added worker node. Which command should they use to approve the pending CSR?

Accepted Answer

oc adm certificate approve . `oc adm certificate approve ` is the documented OpenShift command to approve a pending CSR, which triggers the signer controller to issue the node client certificate. It is the standard administrative action for unblocking node bootstrap. The command is idempotent and safe to re-run.

Answer

oc cluster-version approve-csr <csr-name>

Answer

oc patch csr <csr-name> --type=json -p='[{"op": "replace", "path": "/status/conditions", "value": "Approved"}]'

Answer

oc approve csr <csr-name>

Question 6

Which command is used to create a new cluster role named 'storage-reader' that permits getting and listing PersistentVolumes cluster-wide?

Accepted Answer

oc create clusterrole storage-reader --verb=get,list --resource=persistentvolumes. The correct command is `oc create clusterrole storage-reader --verb=get,list --resource=persistentvolumes`. This uses the `oc create clusterrole` subcommand, which is the standard OpenShift/Kubernetes imperative command for creating a ClusterRole resource. The `--verb` flag specifies the allowed actions (get, list), and `--resource` specifies the target resource type (persistentvolumes). This directly creates a ClusterRole named 'storage-reader' with the desired permissions cluster-wide.

Answer

oc new clusterrole storage-reader --permissions=pv:get,list

Answer

oc create role storage-reader --cluster --verb=get,list --resource=persistentvolumes

Answer

oc adm create-role storage-reader --cluster-wide --verbs=get,list --resources=pv

Question 7

A cluster administrator needs to inspect the current default CNI network provider configured in an OpenShift 4.14 cluster. Which command or resource should the administrator check?

Accepted Answer

oc get networks.config/cluster -o jsonpath='{.spec.networkType}'. In OpenShift 4.x, the cluster-wide network configuration is stored in the networks.config.openshift.io/cluster resource, and the CNI plugin in use is exposed in the spec.networkType field. Running `oc get networks.config/cluster -o jsonpath='{.spec.networkType}'` returns the configured network plugin, typically OpenShiftSDN or OVNKubernetes. This is the authoritative place to inspect the default CNI provider.

Answer

oc get dns cluster -o jsonpath='{.spec.baseDomain}'

Answer

oc get proxy cluster -o jsonpath='{.spec.httpProxy}'

Answer

oc get clusterversion version -o jsonpath='{.status.capabilities}'

Question 8

Which TWO of the following characteristics apply to OpenShift SecurityContextConstraints (SCCs)? (Choose TWO)

Accepted Answer

SCCs evaluate and can mutate pod specifications during admission control.. Option B is correct because SCCs are enforced by the OpenShift admission controller: when a pod is created, the SCC admission plugin evaluates the pod's security context (runAsUser, SELinux context, capabilities, volumes, etc.) against the SCCs available to the requesting service account, and can mutate the pod specification to apply defaults such as allowed UID ranges or SELinux labels. Option D is correct because SecurityContextConstraints are cluster-scoped API resources (like ClusterRoles), defined once for the whole cluster rather than within a namespace, and are bound to users, groups, or service accounts via cluster-scoped RBAC (ClusterRole/ClusterRoleBinding or the scc-specific user/group fields). Option A is wrong because SCCs govern pod security context and admission, not network traffic; NetworkPolicies are a separate Kubernetes mechanism and SCCs do not replace them. Option C is wrong because SCCs are not namespaced resources and cannot be granted through ordinary namespaced RoleBindings; access is granted via cluster-scoped bindings or the SCC's users/groups fields. Option E is wrong because SCCs apply to all pods regardless of workload type, including Deployments, Jobs, and standalone pods, not only stateful workloads or DaemonSets.

Answer

SCCs replace Kubernetes NetworkPolicies entirely.

Answer

SCCs can be created as namespaced resources using standard RoleBindings.

Answer

SCCs apply only to stateful workloads and daemonsets.

Question 9

Which THREE of the following components are part of the standard OpenShift Ingress architecture? (Choose THREE)

Accepted Answer

IngressController Custom Resource. Option A (IngressController Custom Resource) is correct because the Ingress Operator manages one or more IngressController custom resources that define how the OpenShift router is deployed and configured, including replicas, node placement, and endpoint publishing strategy. Option B (HAProxy-based router pods) is correct because the default OpenShift ingress data plane is implemented by router pods running HAProxy, which terminate and route external HTTP/HTTPS traffic to Services based on Routes and Ingress objects. Option D (Ingress Operator) is correct because it is the cluster operator responsible for deploying, configuring, and reconciling the IngressController resources and their backing router deployments. Option C (ClusterNetwork operator) does not belong because it manages the cluster's pod network (OVN-Kubernetes/CNI, network plugin configuration), not the ingress routing layer. Option E (EgressFirewall controller) does not belong because it enforces egress traffic policies for namespaces, which is unrelated to the standard ingress architecture.

Answer

ClusterNetwork operator

Answer

EgressFirewall controller

Question 10

You need to verify whether a particular ServiceAccount in your project has permissions to read Secrets. Which command tests this authorization?

Accepted Answer

oc auth can-i get secrets --as=system:serviceaccount::. `oc auth can-i get secrets --as=system:serviceaccount::` submits a SubjectAccessReview to the API server impersonating the named service account, returning the effective allow/deny decision for the `get` verb on `secrets`. This is the only command among the options that actually evaluates RBAC rather than merely displaying configuration. It works regardless of whether the permission comes from a RoleBinding, ClusterRoleBinding, or an aggregated role.

Answer

oc describe rolebinding --serviceaccount=<serviceaccount-name>

Answer

oc check secrets --serviceaccount=<serviceaccount-name>

Answer

oc adm verify-sa <serviceaccount-name>