EX280 Practice Test 13 — 15 Questions

Question 1

When using OIDC for authentication, what does the 'issuer' field in the configuration represent?

Accepted Answer

The URL of the OIDC provider. In OpenShift's OIDC identity provider configuration, the 'issuer' field is the URL of the OIDC identity provider (IdP) that OpenShift will trust for authentication. OpenShift uses this URL to discover the provider's OIDC metadata via the /.well-known/openid-configuration endpoint, which supplies the authorization, token, and JWKS endpoints. The issuer value must exactly match the 'iss' claim in the tokens the IdP issues, otherwise token validation fails.

Answer

The secret key for the OIDC provider

Answer

The client ID of the OpenShift cluster

Answer

The hostname of the OpenShift API

Question 2

An administrator is troubleshooting a certificate expiration issue that has broken communication between the kubelet and the API server. Where are the kubelet client certificates stored on a worker node that can be inspected via an oc debug session?

Accepted Answer

/var/lib/kubelet/pki/. On a worker node, kubelet client certificates used to authenticate to the API server are stored under /var/lib/kubelet/pki/. This directory contains kubelet-client-current.pem and related files. Inspecting this path via 'oc debug node/<node>' confirms certificate presence, expiry, and rotation state, which is directly relevant to kubelet-to-API-server communication failures.

Answer

/var/lib/etcd/cert

Answer

/etc/origin/node/certificates

Answer

/etc/kubernetes/pki

Question 3

An OpenShift administrator needs to investigate a pod that is failing with an 'OOMKilled' exit code. Which command reveals the memory limit configuration and historical usage right before the crash?

Accepted Answer

oc describe pod . 'oc describe pod ' shows the container's resource requests and limits (including memory limit), the last state with the OOMKilled reason, and the exit code 137. It also displays events and the node the pod ran on, giving the administrator the configuration and crash context in one view. This is the standard first command for diagnosing OOMKilled pods.

Answer

oc top pod <pod-name> --containers

Answer

oc get pod <pod-name> -o yaml

Answer

oc adm diagnostics

Question 4

When creating a build using S2I, what does the 'assemble' script do?

Accepted Answer

Builds the application artifacts. In Source-to-Image (S2I), the assemble script is responsible for building the application artifacts from the source code. It runs after the source code is copied into the builder image and performs the necessary build steps, such as compiling code, installing dependencies, and preparing the application for execution. This is a core part of the S2I build process.

Answer

Sets up the user environment

Answer

Starts the application

Answer

Downloads the base image

Question 5

You want to automate the application lifecycle so that every time a code change is pushed, the build and deployment occur automatically. Which combination of features should you use?

Accepted Answer

BuildConfig Webhook and ImageStream triggers. In OpenShift, BuildConfig webhooks (GitHub, GitLab, Bitbucket, or generic) allow external code repositories to trigger a new build automatically when a change is pushed. ImageStream triggers then detect when a new image is pushed to an ImageStream and automatically start a new deployment (via DeploymentConfig or Deployment). Together, they create a fully automated CI/CD pipeline from code push to deployment. This is the standard OpenShift-native approach for automating the application lifecycle.

Answer

Only cron jobs

Answer

Manual build and manual rollout

Answer

DeploymentConfigs only

Question 6

What is the result of using a 'Recreate' strategy during a deployment?

Accepted Answer

Temporary service outage. The Recreate strategy terminates all existing Pods before creating new ones, which necessarily causes a temporary service outage because there is a period with zero running Pods. This is in contrast to RollingUpdate, which maintains availability by incrementally replacing Pods. The Recreate strategy is used when the application cannot run multiple versions concurrently.

Answer

Zero downtime deployment

Answer

Rolling update

Answer

Instant switch

Question 7

You need to terminate TLS for a route using a custom certificate. Which object must contain the TLS key and certificate?

Accepted Answer

A Secret in the same namespace as the route. In OpenShift, TLS termination for a Route is configured by referencing a TLS certificate and key stored in a Kubernetes Secret. The Secret must reside in the same namespace as the Route because Routes are namespace-scoped resources and can only reference Secrets within their own namespace. The Secret must be of type kubernetes.io/tls and contain tls.crt and tls.key. This design ensures isolation and proper RBAC control.

Answer

A ConfigMap in the 'openshift-config' namespace

Answer

A custom resource definition of type TLS

Answer

The ingress controller configuration

Question 8

An OpenShift cluster administrator notices that API requests are taking an excessively long time to complete. They suspect etcd database bloat due to excessive ConfigMap creations. Which etcd maintenance command can be run inside an etcd pod to reclaim storage space after compaction?

Accepted Answer

etcdctl defrag. After etcd compaction removes superseded revisions, the on-disk database file still contains the freed space until defragmentation. Running `etcdctl defrag` inside the etcd pod rewrites the data file and reclaims that storage, reducing the database size and improving API latency caused by bloat. This is the correct maintenance command to run after compaction.

Answer

etcdctl prune-storage

Answer

oc adm etcd-clean

Answer

etcdctl compact --vacuum

Question 9

An administrator installed an Operator via OperatorHub and selected a specific update channel. Later, the administrator wants to switch the Subscription to a different update channel. How should this be performed?

Accepted Answer

Edit the Subscription custom resource and modify the 'spec.channel' field to the new channel.. To switch an Operator's update channel, you edit the Subscription custom resource and change the spec.channel field to the desired channel name. The Operator Lifecycle Manager (OLM) then reconciles the Subscription and upgrades/downgrades the Operator to the latest version available in that channel. This is the supported and non-disruptive method.

Answer

Delete the Operator's CSV and reinstall the Operator from scratch via the CLI.

Answer

Modify the OperatorGroup target namespace to force a channel renegotiation.

Answer

Patch the ClusterServiceVersion directly with the new channel identifier.

Question 10

An administrator wants to verify node health and readiness across the cluster. Which TWO commands provide this information? (Choose TWO)

Accepted Answer

oc describe node . Option A, `oc describe node `, is correct because it dumps the full node object status, including Conditions such as Ready, MemoryPressure, DiskPressure, and PIDPressure, plus allocated resources, taints, and recent events — exactly the per-node health and readiness detail an administrator needs. Option B, `oc get nodes`, is correct because it lists every node in the cluster with its STATUS (Ready/NotReady/SchedulingDisabled), ROLES, AGE, and VERSION, giving a fast cluster-wide readiness overview. Option C, `oc get clusterversion`, only reports the OpenShift cluster version and update channel, not node health. Option D, `oc get routes`, lists exposed routes and their hosts/admission status, which is application networking, not node state. Option E, `oc adm top volume`, shows volume usage statistics, not node readiness or conditions.

Answer

oc get clusterversion

Answer

oc get routes

Answer

oc adm top volume

Question 11

An administrator needs to view the rollout history of a DeploymentConfig named web-frontend. Which command accomplishes this?

Accepted Answer

oc rollout history dc/web-frontend. The `oc rollout history` command is specifically designed to display the revision history of a DeploymentConfig (or Deployment). When used with the resource type and name (`dc/web-frontend`), it lists all revisions, their change causes, and the current active revision. This directly fulfills the requirement to view rollout history.

Answer

oc describe dc/web-frontend

Answer

oc get revisions dc/web-frontend

Answer

oc log rollout dc/web-frontend

Question 12

Which TWO of the following are valid ways to trigger a build in OpenShift?

Accepted Answer

Sending a HTTP POST to the webhook URL. Option B is correct because OpenShift BuildConfigs can expose generic, GitHub, or GitLab webhook endpoints, and issuing an HTTP POST to that webhook URL (e.g., via curl) triggers a new build of the associated BuildConfig. Option C is correct because the 'oc start-build' command is the standard CLI method to manually start a build, either by BuildConfig name (with options like --from-build, --follow, or --from-dir) or by referencing an existing build. Restarting the OpenShift cluster (A) is an administrative action that does not initiate builds, updating a ConfigMap (D) only changes configuration data and does not by itself start a build, and changing a Namespace (E) is a context/scope operation with no build-triggering semantics.

Answer

Restarting the OpenShift cluster

Answer

Updating a ConfigMap

Answer

Changing a Namespace

Question 13

Which namespace houses the core Cluster Version Operator (CVO) in an OpenShift 4.14 cluster?

Accepted Answer

openshift-cluster-version. The Cluster Version Operator (CVO) runs in the openshift-cluster-version namespace, where it manages cluster updates by orchestrating the rollout of new versions. This namespace is dedicated to the CVO and its associated resources, such as the ClusterVersion object.

Answer

openshift-machine-api

Answer

openshift-operator-lifecycle-manager

Answer

openshift-config

Question 14

Which object defines the parameters used by a storage provider to take snapshots of persistent volumes in OpenShift?

Accepted Answer

VolumeSnapshotClass. VolumeSnapshotClass is the cluster-scoped object that defines the CSI driver and deletion policy used when taking snapshots of PersistentVolumes. It plays the same role for snapshots that a StorageClass plays for provisioning — it tells the snapshot controller which driver to invoke and how to handle the resulting VolumeSnapshotContent.

Answer

SnapshotterConfiguration

Answer

StorageClass

Answer

VolumeSnapshotContent

Question 15

What is the primary function of the Machine Config Operator (MCO) in OpenShift 4.14?

Accepted Answer

Managing operating system configurations, file system changes, and software updates for cluster nodes.. The Machine Config Operator (MCO) is a core OpenShift component that manages the operating system configuration and updates of cluster nodes. It uses MachineConfig objects to apply changes such as systemd units, files, and kernel arguments, and it orchestrates rolling updates to nodes via the Machine Config Daemon. This ensures nodes are configured consistently and updated safely.

Answer

Handling external DNS records and cluster ingress routing.

Answer

Provisioning cloud provider virtual machines for cluster scaling.

Answer

Managing container image registries and secure image signing.