EX280 Practice Test 17 — 15 Questions

Question 1

An administrator needs to inspect the current update channel and version of an OpenShift 4.14 cluster. Which command provides this status directly?

Accepted Answer

oc get clusterversion. The `oc get clusterversion` command retrieves the ClusterVersion custom resource, which contains the cluster's current version and update channel. This resource is the authoritative source for OpenShift update status, including available updates and the desired channel. It directly answers the administrator's need to inspect both the update channel and version.

Answer

oc version --cluster

Answer

oc get nodes --version

Answer

oc describe operator cluster

Question 2

An administrator wants to prevent non-admin users from creating any new projects in the OpenShift cluster. How can this be accomplished?

Accepted Answer

Delete the 'self-provisioner' ClusterRoleBinding attached to the 'system:authenticated' group.. The ability for authenticated users to create projects is granted by the self-provisioner ClusterRole, which is bound to the system:authenticated group via a ClusterRoleBinding. Removing that binding revokes the self-provisioner capability cluster-wide, preventing non-admin users from creating new projects. This is the standard OpenShift method to disable self-provisioning.

Answer

Set the project request limit quota to zero globally.

Answer

Delete the 'cluster-admin' role from all users.

Answer

Modify the OAuth configuration to reject all login requests.

Question 3

An application pod requires concurrent read and write access to the same storage volume from multiple worker nodes simultaneously. Which access mode must be specified in the PersistentVolumeClaim to satisfy this requirement?

Accepted Answer

ReadWriteMany. ReadWriteMany (RWX) allows a volume to be mounted as read-write by many nodes simultaneously, which is required when multiple pods on different worker nodes need concurrent read/write access. It is supported by shared filesystems like NFS, CephFS, or GlusterFS, but not by block storage such as EBS or most local volumes.

Answer

ReadWriteOnce

Answer

ReadOnlyMany

Answer

WriteOncePod

Question 4

An administrator wants to modify the default kubelet parameters (such as maximum pods per core or eviction hard thresholds) across worker nodes. Which TWO steps or resources are involved in this process? (Choose TWO)

Accepted Answer

Create a KubeletConfig custom resource defining the desired kubelet parameters.. In OpenShift, kubelet parameters are customized by creating a KubeletConfig custom resource (option A), which is the supported API object for specifying values such as maxPods, podsPerCore, and evictionHard thresholds. To apply that KubeletConfig only to worker nodes, you must set the machineConfigPoolSelector field (option E) so the Machine Config Operator generates the corresponding MachineConfig and rolls it out to the targeted pool. Option B is wrong because directly editing kubelet.conf via SSH bypasses the Machine Config Operator and would be overwritten on the next rendered config sync. Option C is wrong because the MCO handles kubelet restarts automatically during the config rollout; manual systemctl restarts are neither required nor supported. Option D is wrong because ClusterVersion is used for cluster version and update channel management, not for kubelet flags.

Answer

Directly edit the kubelet.conf file on every node via SSH.

Answer

Restart the kubelet service manually on all nodes using systemctl.

Answer

Modify the ClusterVersion spec to include kubelet flags.

Question 5

Which THREE things can you configure in a BuildConfig?

Accepted Answer

Build Strategy. In OpenShift, a BuildConfig defines how a build is performed, and its spec includes the build strategy (for example Source, Docker, or Custom), so option A 'Build Strategy' is correct. It also includes the source configuration (spec.source), which specifies the Source Code Reference such as a Git repository URL and ref or a binary/context directory, making option B correct. Additionally, a BuildConfig can define triggers (spec.triggers) like ImageChange, ConfigChange, GitHub/GitLab webhooks, or generic webhooks to automatically start builds, so option D is correct. Option C 'Replicas' is not part of a BuildConfig; replica counts belong to workload controllers such as DeploymentConfigs or Deployments. Option E 'Route settings' is also not part of a BuildConfig; routes are configured via Route resources to expose services externally.

Answer

Replicas

Answer

Route settings

Question 6

An administrator troubleshoots a failing NetworkPolicy and wants to verify if the OpenShift SDN or OVN-Kubernetes controller has successfully applied the rules. Where are the controller operator logs examined?

Accepted Answer

In the openshift-network-operator or openshift-ovn-kubernetes namespaces. In OpenShift, the network controller components that apply NetworkPolicy rules run in specific namespaces: the network operator itself runs in openshift-network-operator, and the OVN-Kubernetes control plane runs in openshift-ovn-kubernetes. To verify if the controller has successfully applied NetworkPolicy rules, you must examine the logs of the operator and the ovn-kubernetes pods in these namespaces. The openshift-network-operator manages the overall network configuration, while the ovn-kubernetes pods (like ovnkube-master and ovnkube-node) handle the actual implementation of network policies.

Answer

In the openshift-apiserver namespace

Answer

In the kube-system namespace under core-dns logs

Answer

In the openshift-ingress namespace under router pods

Question 7

An administrator wants to check whether any worker nodes in an OpenShift 4.14 cluster are currently unschedulable (cordoned). Which command provides this information quickly?

Accepted Answer

oc get nodes. The `oc get nodes` command lists all nodes in the cluster along with their status, including a `SchedulingDisabled` flag that appears when a node is cordoned (unschedulable). This is the fastest and most direct way to check for cordoned worker nodes, as the output immediately shows which nodes have scheduling disabled. No additional flags or subcommands are needed.

Answer

oc get machineconfigpool --cordoned

Answer

oc describe clusteroperator scheduling

Answer

oc adm show-cordoned

Question 8

Which TWO namespaces are standard system namespaces in OpenShift 4.14 that contain core cluster operators and platform components? (Choose TWO)

Accepted Answer

openshift-cluster-version. Option C, openshift-cluster-version, is correct because it hosts the Cluster Version Operator (CVO) deployment, which reconciles the ClusterVersion resource and manages the update lifecycle of core cluster operators in OpenShift 4.14. Option D, openshift-machine-config-operator, is correct because it contains the Machine Config Operator, a core platform operator responsible for managing MachineConfig objects and node configuration (e.g., kubelet, CRI-O, and OS-level settings) across the cluster. Option A, openshift-user-workloads, is not a standard system namespace; user workload monitoring uses openshift-user-workload-monitoring, and application workloads typically run in user-created projects. Option B, kube-public-custom, is not a standard OpenShift namespace; the built-in one is kube-public, and the '-custom' suffix denotes a non-default name. Option E, openshift-custom-catalog, is not a standard namespace; catalog sources are typically placed in openshift-marketplace or user-defined namespaces.

Answer

openshift-user-workloads

Answer

kube-public-custom

Answer

openshift-custom-catalog

Question 9

Which TWO of the following are valid ways to secure a route?

Accepted Answer

Using 'edge' termination with a custom certificate. Option C is correct because configuring a route with 'edge' termination means TLS is terminated at the router (the ingress point), and supplying a custom certificate lets the router present a trusted certificate to external clients, which is a valid and common way to secure a route. Option E is correct because 'reencrypt' termination terminates TLS at the router and then re-encrypts the connection to the backend pod using a (possibly different) certificate, providing end-to-end encryption across the whole path, which is a valid secure route configuration. Option A is wrong because allowing all traffic on port 80 exposes plain HTTP with no encryption, so it does not secure the route. Option B is wrong because 'insecure edge termination' leaves the external connection unencrypted (or without proper certificate validation), defeating the purpose of securing the route. Option D is wrong because disabling TLS removes encryption entirely, which is the opposite of securing a route.

Answer

Allowing all traffic on port 80

Answer

Using insecure edge termination

Answer

Disabling TLS completely

Question 10

Which TWO actions can an administrator perform using the 'oc adm' command set related to cluster management? (Choose TWO)

Accepted Answer

Initiate and manage cluster upgrades.. Option B is correct because the 'oc adm upgrade' subcommand (e.g., 'oc adm upgrade --to=') lets administrators initiate, monitor, and manage OpenShift cluster upgrades, including viewing available update channels and approving upgrades. Option D is correct because 'oc adm cordon ' and 'oc adm drain ' are administrative commands used to mark nodes unschedulable and evict workloads for maintenance. Option A is incorrect because Dockerfiles are authored in a build context and built with tools like 'docker build' or 'oc new-build', not via 'oc adm' on cluster nodes. Option C is incorrect because project request limits are managed through ClusterResourceQuota or the project request template, not directly via 'oc adm'. Option E is incorrect because application deployments are created with 'oc new-app' or 'oc create', not through the 'oc adm' administrative command set.

Answer

Write custom container Dockerfiles on cluster nodes.

Answer

Manage user project request limits directly.

Answer

Create application deployments directly without YAML files.

Question 11

An administrator is managing operator subscriptions and wants to ensure that an operator is automatically updated when new versions are released in the channel. Which THREE conditions or configuration settings must be satisfied? (Choose THREE)

Accepted Answer

The OperatorGroup must correctly encompass the target namespace scope.. Option A is correct because the OperatorGroup defines the set of target namespaces (its spec.targetNamespaces or the namespace it resides in) that the operator's CSV will be deployed to, and OLM will not resolve or upgrade a Subscription whose OperatorGroup scope does not cover the intended namespace. Option B is correct because OLM resolves available operator versions from the package manifests served by a CatalogSource; if that CatalogSource is unhealthy or missing, no new bundles are discovered and no upgrade can be triggered. Option C is correct because spec.installPlanApproval: Automatic on the Subscription causes OLM to automatically approve the generated InstallPlan when a newer bundle appears in the channel, which is exactly what enables unattended updates. Option D is not correct because the Cluster Version Operator manages OpenShift platform components, not third-party OLM operators, and has no auto-upgrade setting governing them. Option E is not correct because deleting the global pull secret would break image pulls from authenticated registries; OLM uses the existing pull secrets and does not require unauthenticated catalog access.

Answer

The Cluster Version Operator must have auto-upgrade enabled for third-party operators.

Answer

The global pull secret must be deleted so OLM can fetch unauthenticated updates.

Question 12

An administrator wants to check the status of Machine API provisioning and verify that all machines are in a running state. Which TWO commands or resource inspections should the administrator perform? (Choose TWO)

Accepted Answer

Run 'oc get machines -A' to list all provisioned machines across namespaces.. Option C is correct because 'oc get machines -A' lists all Machine objects across all namespaces, letting the administrator inspect each machine's PHASE (e.g., Running, Provisioned, Provisioning) to confirm they are in a running state. Option D is correct because 'oc get machinesets -A' shows each MachineSet's DESIRED, CURRENT, and READY replica counts, which verifies that the desired number of machines has been provisioned and is healthy. Option A is wrong because 'oc adm machine-status' is not a valid oc adm subcommand. Option B is wrong because 'oc get clusteroperators' does not accept a '--machines' flag and reports ClusterOperator status, not Machine API provisioning. Option E is wrong because 'oc get machineconfigpools' does not accept a '--machines' flag and reports MachineConfigPool node configuration status, not Machine provisioning state.

Answer

Run 'oc adm machine-status'.

Answer

Run 'oc get clusteroperators --machines'.

Answer

Run 'oc get machineconfigpools --machines'.

Question 13

An administrator wants members of the LDAP-backed group 'cn=auditors,ou=groups,dc=corp' to have read-only access to every project in the cluster, including future ones, without granting them any write capability. Which action achieves this?

Accepted Answer

Create a ClusterRoleBinding that binds the group to the 'view' ClusterRole.. A ClusterRoleBinding to the 'view' ClusterRole is the correct mechanism because it applies cluster-wide and automatically covers namespaces created later. It grants only read verbs, satisfying the no-write constraint, and binding a group means all LDAP members inherit the access without per-user configuration.

Answer

Create a ClusterRoleBinding that binds the group to the 'edit' ClusterRole.

Answer

Create a RoleBinding in each namespace that binds the group to the 'view' ClusterRole.

Answer

Create a ClusterRoleBinding that binds the group to the 'cluster-admin' ClusterRole.

Question 14

Which THREE factors influence whether a pod requesting a storage volume can be successfully scheduled to a specific worker node when using topology-aware storage?

Accepted Answer

Volume accessibility constraints reported by the CSI driver. Option B is correct because topology-aware scheduling depends on the accessibility constraints the CSI driver reports through CSI topology keys (for example, via the CSINode object and CSIStorageCapacity), which tell the scheduler which nodes can actually reach the volume. Option D is correct because a StorageClass with volumeBindingMode: WaitForFirstConsumer delays PersistentVolume binding until the pod is scheduled, allowing the scheduler to co-locate the pod with the volume's topology instead of binding prematurely. Option E is correct because node topology labels such as topology.kubernetes.io/zone (or the older failure-domain.beta.kubernetes.io/zone) are the actual topology domains the scheduler matches against the volume's node affinity requirements. Option A is not relevant because OAuth token expiration affects API authentication, not volume topology or scheduling decisions. Option C is not relevant because the number of image layers affects image pull time and storage, not whether a topology-constrained volume can be scheduled to a node.

Answer

The cluster OAuth token expiration time

Answer

The number of container image layers in the pod spec

Question 15

Where are PersistentVolumeClaims located in terms of OpenShift's API scope?

Accepted Answer

They are namespaced resources.. PersistentVolumeClaims (PVCs) are namespaced resources in OpenShift, meaning they exist within a specific project (namespace) and are scoped to that namespace. This allows different projects to have their own PVCs with the same name.

Answer

They are node-scoped resources.

Answer

They are global resources shared across all clusters in a fleet.

Answer

They are cluster-scoped resources.