EX280 Practice Test 13 — 15 Questions

Question 1

An administrator needs to collect cluster-wide diagnostic information from an OpenShift 4.14 cluster for a Red Hat support case. Which command should be executed?

Accepted Answer

oc adm must-gather. The oc adm must-gather command collects debugging information from the cluster, including logs, cluster operator status, and node details, packaging them into a compressed archive for Red Hat Support.

Answer

oc adm diagnose

Answer

oc cluster-info dump

Answer

oc get clusteroperators -o yaml

Question 2

An administrator wants to view the logs of a specific container named 'backend' inside a pod with multiple containers. Which command should be used?

Accepted Answer

oc logs pod/my-pod -c backend. When a pod has multiple containers, the container name must be explicitly specified with the -c flag in the oc logs command.

Answer

oc logs pod/my-pod backend

Answer

oc rsh pod/my-pod backend

Answer

oc describe pod/my-pod -c backend

Question 3

A container inside a pod is failing with 'ImagePullBackOff'. The administrator verifies the image tag exists. What is the next most logical troubleshooting step to check authentication or registry access?

Accepted Answer

Check if a pull secret is correctly configured and bound to the service account.. Checking the ImageStream or Secret associated with image pull credentials (such as dockercfg secrets) is necessary when pulling from private registries.

Answer

Inspect the etcd cluster operator status.

Answer

Run 'oc debug' to inspect the container file system.

Answer

Restart the cluster version operator.

Question 4

The cluster monitoring stack is failing because Prometheus pods in the openshift-monitoring namespace are crashing due to disk space exhaustion on the Prometheus PersistentVolume. How can the administrator inspect the current disk usage inside the Prometheus container?

Accepted Answer

oc exec -n openshift-monitoring prometheus-k8s-0 -c prometheus -- df -h. Using oc exec to run df -h inside the Prometheus container allows checking mount point disk space utilization.

Answer

oc debug node/<node-name> -- df -h

Answer

oc logs -n openshift-monitoring deployment/prometheus-adapter

Answer

oc adm top volume

Question 5

An administrator notices that the Ingress Operator is failing to deploy routers because of a persistent validation error in the Default IngressController resource. How can the administrator inspect the exact validation schema failure reported by the operator?

Accepted Answer

oc describe ingresscontroller default -n openshift-ingress-operator. Describing the ingresscontroller custom resource in the openshift-ingress-operator namespace reveals reconciliation status errors and validation messages.

Answer

oc logs -n openshift-ingress deployment/router-default

Answer

oc adm inspect router

Answer

oc get validatingwebhookconfigurations

Question 6

An OpenShift cluster node has experienced kernel panics due to a faulty third-party kernel module. The administrator needs to review the kernel crash logs (vmcore or kdump logs) stored on the node. Where are these logs typically written on a CoreOS worker node?

Accepted Answer

/var/crash. Red Hat Enterprise Linux CoreOS (RHCOS) configures kdump to write crash dumps to /var/crash when kernel panics occur.

Answer

/run/log/journal

Answer

/var/lib/kubelet/pods

Answer

/var/log/audit/audit.log

Question 7

A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?

Accepted Answer

Create a RoleBinding in the 'app-dev' namespace referencing the 'pod-debugger' ClusterRole and the 'development' group.. A RoleBinding created within the 'app-dev' project referencing the 'pod-debugger' ClusterRole and the 'development' group correctly scopes the cluster-wide permissions to that single namespace.

Answer

Modify the 'pod-debugger' ClusterRole directly to include a namespace selector for 'app-dev'.

Answer

Create a Role in the 'app-dev' namespace and assign it to the 'pod-debugger' subject.

Answer

Create a ClusterRoleBinding for the 'development' group pointing to 'pod-debugger'.

Question 8

An application pod is failing its liveness probe and continuously restarting. Where can an administrator quickly check the reason for the liveness probe failure?

Accepted Answer

oc describe pod <pod-name>. oc describe pod displays container events, including recent liveness and readiness probe failures and exit statuses.

Answer

oc get routes

Answer

oc get pod <pod-name> -o json

Answer

oc adm diagnostics

Question 9

An OpenShift cluster upgrade has failed because a MachineConfigPool is degraded. Which THREE actions or commands can an administrator perform to diagnose the root cause of the MachineConfigPool degradation? (Choose THREE)

Accepted Answer

oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon. Describing the MCP, checking MCD pod logs on nodes, and inspecting rendered machine configs help diagnose node configuration failures.

Answer

oc scale deployment/cluster-version-operator --replicas=3

Answer

oc adm upgrade cancel

Question 10

Which command allows an administrator to delete a user object named 'old-user' from the OpenShift cluster?

Accepted Answer

oc delete user old-user. The 'oc delete user old-user' command removes the user resource from the cluster database.

Answer

oc deactivate user old-user

Answer

oc purge user old-user --force

Answer

oc remove user old-user

Question 11

A pod fails to start, and the event log shows a Multi-Attach error for volume 'pvc-xyz'. What is the root cause of this error?

Accepted Answer

A ReadWriteOnce volume is attempting to be attached to a second node while still attached to the first.. A Multi-Attach error occurs when a volume with ReadWriteOnce access mode is already attached to one worker node and another node attempts to mount it simultaneously (often during pod rescheduling or rolling updates).

Answer

The PVC storage class has volumeBindingMode set to Immediate.

Answer

The storage backend has run out of physical disk capacity.

Answer

The CSI driver pod has crashed on the master node.

Question 12

An OpenShift administrator observes that the 'authentication' ClusterOperator is reporting Available=False, Progressing=True, and Degraded=True. During troubleshooting, they notice that the kube-apiserver cannot validate tokens because the OAuth server routes are unreachable due to a misconfigured ingress controller. Which log collection method is best suited to pinpoint the OAuth metadata retrieval failure?

Accepted Answer

oc logs -n openshift-authentication deployment/oauth-openshift. Checking the operator pods in openshift-authentication namespace using oc logs on the oauth-openshift deployment provides the exact HTTP communication errors.

Answer

oc get events -n openshift-config-managed

Answer

oc get clusteroperator authentication -o yaml

Answer

oc adm must-gather --image=quay.io/openshift-release-dev/ocp-v4.0-art-dev@sha256:...

Question 13

A cluster administrator suspects that an API rate-limiting issue is causing intermittent client timeouts. Which component logs should be inspected to confirm that clients are exceeding their API request limits?

Accepted Answer

oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>. The Kubernetes API server logs record throttling and rate-limiting events when clients exceed request limits.

Answer

oc get events --all-namespaces

Answer

oc logs -n openshift-ingress-operator deployment/ingress-operator

Answer

oc logs -n openshift-kube-apiserver-operator deployment/cluster-kube-apiserver-operator

Question 14

An OpenShift cluster experiences severe etcd latency spikes, causing leader elections to fail. Which metric or diagnostic tool should be used to inspect etcd peer round-trip times directly from the command line within the cluster?

Accepted Answer

oc rsh -n openshift-etcd pod/etcd-<node-name> etcdctl endpoint health. etcd provides built-in tooling and metrics. The etcdctl endpoint health or etcdctl check perf commands can be run from within an etcd pod to verify cluster performance.

Answer

oc adm inspect etcd

Answer

oc adm diagnostics etcd-latency

Answer

oc get etcd -o yaml

Question 15

An administrator needs to troubleshoot an application that fails to resolve internal cluster service names. They decide to run an interactive shell inside a temporary debugging pod with DNS tools installed. Which command creates this diagnostic pod?

Accepted Answer

oc run net-debug --rm -it --image=quay.io/openshift/origin-cli:latest -- /bin/bash. oc run with --rm -it allows spinning up an ephemeral container (such as busybox) for interactive network troubleshooting.

Answer

oc debug service/my-svc

Answer

oc adm tcp-dump

Answer

oc rsh net-debug