EX280 Practice Test 12 — 15 Questions

Question 1

Which TWO tasks are typically performed by an OpenShift cluster administrator when managing worker node lifecycles? (Choose TWO)

Accepted Answer

Cordoning and draining nodes for operating system maintenance.. Option D is correct because cordoning a node marks it as unschedulable (kubectl cordon) and draining it evicts running pods (kubectl drain) so the node can safely undergo OS patching, reboots, or other maintenance without disrupting workloads. Option E is correct because node labels are the mechanism that determines which nodes belong to a given MachineConfigPool, allowing the administrator to target specific MachineConfig updates to defined groups of worker nodes. Option A is not a typical administrator task, since etcd data files on control plane nodes are managed by the etcd operator and should not be edited directly. Option B is incorrect because OpenShift manages the OS via immutable RHCOS and MachineConfig, not by manually compiling kernels over SSH. Option C is incorrect because writing Kubernetes API server source code is upstream development work, not cluster administration.

Answer

Directly editing etcd data files on control plane nodes.

Answer

Manually compiling custom Linux kernel binaries on every node via SSH.

Answer

Writing custom source code for the Kubernetes API server.

Question 2

Which TWO of the following are valid deployment strategies supported by OpenShift?

Accepted Answer

Recreate. Options D (Rolling) and C (Recreate) are the two deployment strategies natively supported by OpenShift's DeploymentConfig/Deployment resources. Rolling performs a gradual, zero-downtime replacement of pods using a rolling update with configurable maxUnavailable and maxSurge parameters, while Recreate terminates all existing pods before starting new ones, causing a brief outage but avoiding version overlap. Both are explicitly defined strategy types in OpenShift's deployment configuration API. Options A (Parallel), B (Sequential), and E (Canary) are not built-in OpenShift deployment strategies; canary-style rollouts can be approximated via custom techniques or routes but are not a native strategy type.

Answer

Parallel

Answer

Sequential

Answer

Canary

Question 3

Which OpenShift 4.14 command allows an administrator to gather cluster-wide diagnostic logs and configuration data for support cases?

Accepted Answer

oc adm must-gather. The command 'oc adm must-gather' collects a comprehensive set of cluster diagnostics, including logs, resource definitions, and configuration data from all relevant components. It is the standard tool for gathering information for Red Hat support cases. It runs a pod on the cluster that collects data and saves it to a local directory.

Answer

oc adm collect-logs

Answer

oc support dump

Answer

oc cluster-debug bundle

Question 4

Which THREE network-related objects are namespaced in OpenShift? (Choose THREE)

Accepted Answer

NetworkPolicy. NetworkPolicy (C) is namespaced because it is a Kubernetes resource scoped to a namespace, where its podSelector and ingress/egress rules apply only to pods within that namespace. Service (D) is namespaced since a Service is a namespaced Kubernetes object that provides a stable virtual IP and DNS name for pods in the same namespace. Route (E) is namespaced because OpenShift Routes are namespace-scoped resources that expose a Service from within that namespace to external clients. ClusterNetwork (A) is cluster-scoped, as it defines the overall pod network CIDR configuration for the entire cluster. IngressController (B) is also cluster-scoped, since it configures the ingress controller operator for the whole OpenShift cluster rather than a single namespace.

Answer

ClusterNetwork

Answer

IngressController

Question 5

An administrator is configuring a ResourceQuota named 'quota-dev' in the 'development' namespace. Which TWO of the following resource types can be directly tracked and limited by this ResourceQuota? (Choose TWO)

Accepted Answer

persistentvolumeclaims. Option A (persistentvolumeclaims) is correct because Kubernetes ResourceQuota objects support the persistentvolumeclaims field, which limits the number of PVCs that can exist in the namespace, as well as requests.storage to cap total storage requested. Option C (pods) is correct because ResourceQuota natively supports the pods field, allowing the administrator to limit the total number of Pods created in the 'development' namespace. Options B (clusterroles), D (namespaces), and E (nodes) are incorrect because they are cluster-scoped resources, not namespaced resources; ResourceQuota only applies to namespaced objects within the namespace where the quota is defined, so it cannot track or limit ClusterRoles, Namespaces, or Nodes.

Answer

clusterroles

Answer

namespaces

Answer

nodes

Question 6

An administrator configures a Pod with a volume type of hostPath. What is a key security risk or operational limitation of using hostPath in a production multi-tenant OpenShift cluster?

Accepted Answer

Pods using hostPath can access node filesystems, breaking container isolation and posing security risks.. A hostPath volume mounts a directory or file from the node's filesystem directly into the pod. This breaks the container isolation boundary because the pod can read or write node-level files — including /etc, /var/lib/kubelet, or the container runtime socket — enabling privilege escalation, data exfiltration, or node compromise. In multi-tenant clusters this is a serious security risk.

Answer

hostPath volumes automatically expire and delete data after 24 hours.

Answer

hostPath requires an external CSI driver to be installed.

Answer

hostPath is incompatible with Linux nodes and only works on Windows worker nodes.

Question 7

An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?

Accepted Answer

backend.production.svc.cluster.local. In OpenShift/Kubernetes, the fully qualified domain name (FQDN) for a Service follows the pattern ..svc.cluster.local. For the service 'backend' in the 'production' namespace, the correct FQDN is backend.production.svc.cluster.local. This DNS name resolves to the ClusterIP of the service, allowing internal cluster communication.

Answer

backend.production.pod.cluster.local

Answer

backend.production.router.default.svc

Answer

svc.production.backend.cluster.local

Question 8

A cluster administrator needs to grant a Deployment in the production namespace permission to pull images from a private container registry. The image pull secret is named my-registry-secret. Which step must be performed so that pods created by this Deployment can successfully pull the image?

Accepted Answer

Patch the default ServiceAccount in the production namespace to include my-registry-secret in its imagePullSecrets array.. To allow pods created by a Deployment to pull from a private registry, the imagePullSecrets must be associated with the ServiceAccount used by the pods. By default, pods use the 'default' ServiceAccount in their namespace. Patching that ServiceAccount to include my-registry-secret in its imagePullSecrets array ensures that all pods using that ServiceAccount (including those from the Deployment) can authenticate to the registry.

Answer

Create a RoleBinding mapping the secret to the cluster-readers cluster role.

Answer

Annotate the Deployment resource with the full base64-encoded dockerconfigjson payload.

Answer

Run oc set data secrets/my-registry-secret --namespace=production.

Question 9

An administrator notices that a node has been automatically cordoned and drained by the cluster. Which THREE places should the administrator inspect to find the reason for the node eviction or failure? (Choose THREE)

Accepted Answer

oc describe node . Option B, `oc describe node `, is correct because the node's status conditions (such as Ready, MemoryPressure, DiskPressure, PIDPressure) and the associated events/taints like node.kubernetes.io/not-ready or node.kubernetes.io/unreachable reveal why the node was cordoned and drained. Option C, journalctl logs for the kubelet service on the affected node, is correct because the kubelet is the component that reports node status and applies eviction/taints; its logs contain the precise errors (e.g., failed to update node status, container runtime failures, certificate or resource issues) behind the eviction. Option E, `oc get events --field-selector reason=Evicted`, is correct because it filters cluster events specifically for the Evicted reason, showing which pods were evicted, from which node, and the eviction message (e.g., The node was low on resource: memory). Options A and D are incorrect because `oc get storageclass` and `oc get ingresscontroller` list storage and ingress configuration objects, which are unrelated to node cordon/drain/eviction diagnostics.

Answer

oc get storageclass

Answer

oc get ingresscontroller

Question 10

Where do you define the default image pull secrets for all service accounts in a namespace?

Accepted Answer

By linking the secret to the 'default' service account. Default image pull secrets for all service accounts in a namespace are defined by linking the secret to the 'default' service account. When a pod is created without specifying a service account, it uses the 'default' service account, and any image pull secrets attached to that service account are automatically used.

Answer

In the ClusterOperator configuration

Answer

In the Namespace metadata

Answer

In the project configuration object

Question 11

A developer wants to inspect the generated Kubernetes manifests from a Helm chart without actually installing the chart into the OpenShift cluster. Which Helm command should be used?

Accepted Answer

helm template my-release my-chart. 'helm template' renders a chart's templates locally and prints the resulting Kubernetes manifests to stdout without contacting the cluster or installing anything. It is the canonical command for inspecting what a chart would produce, and it accepts a release name and chart reference. This lets developers review, diff, or pipe the output before committing to an install.

Answer

helm dry-run my-release my-chart

Answer

helm show chart my-chart

Answer

helm inspect values my-chart

Question 12

A cluster administrator notices that a PVC stuck in the Pending state references a StorageClass with volumeBindingMode set to WaitForFirstConsumer. What action will cause the PVC to bind?

Accepted Answer

Create and schedule a Pod that mounts the PVC.. With volumeBindingMode: WaitForFirstConsumer, the storage provisioner delays binding until a pod using the PVC is scheduled, allowing the scheduler to pick a node and then provision storage in the correct topology zone. Creating and scheduling a pod that mounts the PVC triggers the provisioning and binding process. Until such a pod exists, the PVC remains Pending by design.

Answer

Delete the StorageClass and recreate it with Immediate binding mode.

Answer

Restart the kube-apiserver service on the control plane nodes.

Answer

Manually create a PV matching the exact size and labels of the PVC.

Question 13

Which command allows an administrator to delete a user object named 'old-user' from the OpenShift cluster?

Accepted Answer

oc delete user old-user. The correct command is 'oc delete user old-user'. This command removes the user object from the OpenShift cluster. OpenShift users are represented as cluster-scoped resources, and the standard 'oc delete' verb is used to remove them. Other options are not valid OpenShift commands.

Answer

oc deactivate user old-user

Answer

oc purge user old-user --force

Answer

oc remove user old-user

Question 14

An administrator is troubleshooting a deployment where pods fail to pull container images. Which TWO potential issues should be checked? (Choose TWO)

Accepted Answer

The image pull secret is missing or misconfigured in the service account.. Option B is correct because image pulls from private registries require valid credentials, and if the imagePullSecret referenced by the pod's service account is missing or has wrong registry credentials, the kubelet will fail with ImagePullBackOff or ErrImagePull. Option E is correct because a typo in the image repository path or a nonexistent tag (e.g., myapp:v2 when only v1 exists) causes the registry to return a manifest-not-found error, which also surfaces as ImagePullBackOff. Option A does not belong because a Pending PVC affects volume mounting and pod scheduling, not the image pull phase. Option C does not belong because an invalid route hostname is an OpenShift networking issue affecting external access, not kubelet image retrieval. Option D does not belong because a short liveness probe timeout causes container restarts after startup, not image pull failures.

Answer

The PersistentVolumeClaim is stuck in Pending.

Answer

The route hostname is invalid.

Answer

The liveness probe timeout is configured too short.

Question 15

An administrator configures a LoadBalancer service on an OpenShift cluster running on a cloud provider. However, the EXTERNAL-IP remains in a <pending> state indefinitely. What is the most likely reason?

Accepted Answer

The cloud controller manager or cloud credentials operator is not configured to provision external load balancers.. When a LoadBalancer service on a cloud provider remains in <pending> for EXTERNAL-IP, the most common cause is that the cloud controller manager (or the cloud credentials operator in OpenShift) is not properly configured to provision external load balancers. Without valid cloud credentials and a functioning CCM, OpenShift cannot create the underlying cloud LB resource, leaving the service without an external IP.

Answer

The cluster is missing a valid Ingress controller deployment.

Answer

The NetworkPolicy is blocking cloud provider traffic.

Answer

The NodePort range is exhausted.