EX280 Practice Test 15 — 15 Questions

Question 1

A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add 'system:serviceaccount:app-ns:app-sa' to the 'users' list inside the 'restricted-custom' SCC object.. SCCs are cluster-scoped resources that grant permissions by referencing either users, groups, or service accounts directly within the SCC's 'users' or 'groups' lists, or by binding a ClusterRole/Role that allows the 'use' verb on the specific SCC resource.

Answer

Create a RoleBinding in 'app-ns' linking 'app-sa' to a ClusterRole that permits 'use' on the 'restricted-custom' SCC.

Answer

Add an annotation to the 'app-sa' ServiceAccount object referencing the SCC name.

Answer

Create a ProjectRequest template that injects the SCC into the namespace.

Question 2

An administrator is troubleshooting a certificate signing request (CSR) that is stuck in the Pending state for a newly added worker node. Which command should they use to approve the pending CSR?

Accepted Answer

oc adm certificate approve . oc adm certificate approve is the standard command to approve kubelet client or server TLS bootstrap CSRs.

Answer

oc cluster-version approve-csr <csr-name>

Answer

oc patch csr <csr-name> --type=json -p='[{"op": "replace", "path": "/status/conditions", "value": "Approved"}]'

Answer

oc approve csr <csr-name>

Question 3

An administrator wants to check the status of all api-server instances in the cluster. Which TWO commands are helpful? (Choose TWO)

Accepted Answer

oc get pods -n openshift-kube-apiserver. Checking the kube-apiserver cluster operator and listing API server pods provides status information.

Answer

oc get storageclass

Answer

oc adm top storage

Answer

oc get routes --all-namespaces

Question 4

An administrator wants to inspect cluster events filtered by warning type. Which TWO commands or techniques can help? (Choose TWO)

Accepted Answer

oc describe pod <pod-name> (to view recent warning events for that pod).. Filtering events via oc get events or inspecting descriptions helps identify cluster warnings.

Answer

oc get clusterversion --warnings

Answer

oc logs --warnings

Answer

oc adm must-gather --warnings-only

Question 5

An administrator needs to troubleshoot why an OLM (Operator Lifecycle Manager) managed operator installation is failing. Which THREE resources should be inspected? (Choose THREE)

Accepted Answer

oc get subscription <operator-name>. Checking Subscriptions, CSVs (ClusterServiceVersions), and InstallPlans diagnoses OLM operator installation issues.

Answer

oc get routes

Answer

oc get pv

Question 6

An administrator needs to grant a developer named 'alice' read-only access to all pods specifically within the 'development' namespace. Which command should be used to accomplish this while following the principle of least privilege?

Accepted Answer

oc create rolebinding alice-view --clusterrole=view --user=alice -n development. The view ClusterRole provides read-only access to most resource types within a project. Binding it via a RoleBinding in the specific namespace limits access strictly to that namespace.

Answer

oc create role alice-view --verb=get,list,watch --resource=pods --user=alice -n development

Answer

oc adm policy add-cluster-role-to-user cluster-admin alice

Answer

oc create clusterrolebinding alice-view --clusterrole=view --user=alice

Question 7

An administrator needs to provision a new user named 'sarah' using the HTPasswd identity provider. After updating the htpasswd file and secret, Sarah logs in successfully. What command should the administrator run to verify that OpenShift has successfully created the corresponding User object for Sarah?

Accepted Answer

oc get user sarah. When an identity provider successfully authenticates a user, OpenShift automatically creates a corresponding User object. You can verify this with 'oc get user sarah'.

Answer

oc get account sarah

Answer

oc get identity htp:sarah

Answer

oc describe htpasswd-user sarah

Question 8

An organization requires that specific projects created by developers automatically receive a default ResourceQuota and LimitRange. How can an administrator achieve this in OpenShift?

Accepted Answer

Define a template in the 'openshift-config' namespace and reference it in the Cluster operator configuration for project requests.. Template-based project requests via the Project CR allow specifying an administrative template that is instantiated whenever a user creates a new project.

Answer

Configure the cluster-admin settings in the 'cluster' resource config map.

Answer

Write an admission controller webhook daemonset to inject them.

Answer

Use a ClusterRoleBinding with auto-provisioning flags.

Question 9

You need to create a new project named 'secure-store' with a specified display name and description, and assign 'jane' as the project admin using the OpenShift CLI. Which command should you execute?

Accepted Answer

oc new-project secure-store --display-name='Secure Store' --description='Secure storage project'. The 'oc new-project' command creates a project and automatically assigns the creator as admin. To assign a specific user post-creation or manage project requests, specific commands are used, but 'oc adm new-project' does not exist; instead, 'oc adm create-project-request' or standard project requests are handled via 'oc new-project'. Alternatively, creating a Namespace and a RoleBinding is standard, but OpenShift provides the 'oc new-project' helper.

Answer

oc create projectsecure secure-store --user=jane

Answer

oc create namespace secure-store --admin=jane

Answer

oc adm project secure-store --set-admin=jane

Question 10

An OpenShift cluster integrates with an LDAP server where user attribute names differ from default settings (e.g., mail instead of preferredUsername). Where are these LDAP attribute mappings configured?

Accepted Answer

In the LDAP identity provider specification under the 'attributes' mapping fields. LDAP identity provider configuration in the cluster OAuth resource includes an 'mappingMethod' and attribute mapping fields (like id, preferredUsername, name, email).

Answer

In the kube-apiserver ConfigMap under LDAP settings

Answer

In the GroupSync CRD resource settings

Answer

In the project request template annotations

Question 11

Which TWO of the following commands can an administrator use to verify the identity and permissions of the currently logged-in user? (Choose TWO)

Accepted Answer

oc whoami. The 'oc whoami' and 'oc auth can-i' commands check user identity and permissions.

Answer

oc get user --current

Answer

oc adm who-can-i

Answer

oc describe authentication

Question 12

An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?

Accepted Answer

A ClusterRole and a ClusterRoleBinding. A ClusterRole grants cluster-wide permissions, and a ClusterRoleBinding is required to bind this ClusterRole to a ServiceAccount located in a specific namespace.

Answer

A SecurityContextConstraints object assigned to the ServiceAccount

Answer

A ClusterRole and a RoleBinding in the monitoring namespace

Answer

A Role and a RoleBinding in the monitoring namespace

Question 13

An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?

Accepted Answer

oc describe user alex@example.com. The 'oc describe user alex@example.com' command displays the user object details, including identities and groups associated with the user.

Answer

oc auth can-i --list --user=alex@example.com

Answer

oc get groups --user=alex@example.com

Answer

oc get identity alex@example.com

Question 14

A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?

Accepted Answer

Configure a LimitRange object in the 'data-tier' namespace with max storage constraints for persistent volume claims.. ResourceQuotas can enforce storage request limits (e.g., 'requests.storage') across a namespace. To enforce a maximum size per individual PVC, a ResourceQuota with scope selectors or specific limits can be used, but OpenShift ResourceQuotas can also track max storage per PVC using standard quota objects.

Answer

Set a StorageClass default size restriction.

Answer

Apply a ClusterRole restricting PVC creation sizes.

Answer

Configure an egress firewall rule blocking large volume attachments.

Question 15

An administrator needs to prevent developers from consuming more than 10 CPU cores and 40Gi of memory collectively across all pods running in the 'production' namespace. Which object satisfies this requirement?

Accepted Answer

ResourceQuota. A ResourceQuota object sets hard resource consumption limits (such as limits.cpu and limits.memory) enforced per namespace.

Answer

ClusterResourceQuota

Answer

PodDisruptionBudget

Answer

LimitRange