EX280 Practice Test 18 — 15 Questions

Question 1

You are configuring an OAuth identity provider in OpenShift using the HTPasswdPasswordIdentityProvider method. Where must the generated htpasswd user credentials file be stored so the cluster authentication operator can read it?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the 'openshift-config' namespace as a Secret. In OpenShift 4, the OAuth configuration is defined in the cluster-scoped OAuth custom resource, and any referenced identity provider secrets must live in the openshift-config namespace. The authentication operator watches this namespace and mounts the referenced Secret into the openshift-authentication pods. Therefore, the htpasswd file must be uploaded as a Secret in openshift-config and referenced via the htpasswd.fileData.name field.

Answer

In the 'openshift-authentication' namespace as a ConfigMap

Answer

In the target user's project namespace as a Secret

Answer

On the master node filesystem at '/etc/origin/master/htpasswd'

Question 2

A pod fails to start, and the event log shows a Multi-Attach error for volume 'pvc-xyz'. What is the root cause of this error?

Accepted Answer

A ReadWriteOnce volume is attempting to be attached to a second node while still attached to the first.. The Multi-Attach error occurs when a ReadWriteOnce (RWO) volume is already attached to one node and a pod on another node tries to attach it. RWO volumes can only be attached to a single node at a time. This is common with block storage like AWS EBS or GCE PD.

Answer

The PVC storage class has volumeBindingMode set to Immediate.

Answer

The storage backend has run out of physical disk capacity.

Answer

The CSI driver pod has crashed on the master node.

Question 3

Which TWO of the following are valid OpenShift Service types? (Choose TWO)

Accepted Answer

ClusterIP. Option B, ClusterIP, is a valid OpenShift/Kubernetes Service type: it exposes the Service on an internal cluster IP reachable only from within the cluster, and it is in fact the default Service type. Option E, NodePort, is also a valid Service type: it allocates a static port on each node's IP (default range 30000-32767) so the Service is reachable from outside the cluster via :. The other options are not Service types: NetworkPort is not a Kubernetes/OpenShift Service type, RouteIP is not a Service type (OpenShift Routes are separate API objects that expose Services externally), and ContainerPort is a field within a Pod's container spec that declares the port the container listens on, not a Service type.

Answer

NetworkPort

Answer

RouteIP

Answer

ContainerPort

Question 4

Which THREE components are part of a Kustomize configuration?

Accepted Answer

kustomization.yaml. In Kustomize, the kustomization.yaml file (Option A) is the mandatory entry-point manifest that declares which resources, patches, and other directives Kustomize should process, so it is a core component of any Kustomize configuration. Resources (Option C) are the base Kubernetes manifests (Deployments, Services, ConfigMaps, etc.) listed under the resources field that Kustomize reads and composes. Patches (Option E) are the strategic-merge or JSON 6902 overlays declared under fields like patchesStrategicMerge and patches that customize those resources per environment. BuildConfigs (Option B) are OpenShift build objects, not Kustomize components, and Helm Charts (Option D) belong to the Helm package manager, which Kustomize can reference only via a helmCharts generator but is not itself a Kustomize component.

Answer

BuildConfigs

Answer

Helm Charts

Question 5

Which TWO of the following are valid Service types supported natively in OpenShift? (Choose TWO)

Accepted Answer

ClusterIP. Option B (ClusterIP) is correct because ClusterIP is the default Kubernetes/OpenShift Service type that exposes the Service on an internal cluster IP reachable only from within the cluster. Option D (NodePort) is correct because NodePort is a natively supported Service type that exposes the Service on each node's IP at a static port (default range 30000–32767), allowing external access via :. The other options are not Service types: VirtualIP (A) is not a Kubernetes/OpenShift Service type, IngressObject (C) is not a Service type (Ingress is a separate API resource for HTTP/HTTPS routing), and Route (E) is an OpenShift-specific resource that exposes Services externally but is not itself a Service type.

Answer

VirtualIP

Answer

IngressObject

Answer

Route

Question 6

Which THREE actions can be performed using the oc rollout subcommand in OpenShift? (Choose three.)

Accepted Answer

Pausing a rollout to make multiple configuration updates. Option A is correct because `oc rollout pause` suspends a deployment rollout so you can apply multiple configuration changes before resuming with `oc rollout resume`, preventing intermediate rollouts. Option C is correct because `oc rollout history` displays the revision history of a deployment or deployment config, including revision numbers and change causes. Option D is correct because `oc rollout status` reports the current status of an ongoing rollout, waiting until it completes or fails. Option B is not part of `oc rollout`; direct source builds from a local directory are performed with `oc start-build --from-dir` or `oc new-build`. Option E is not part of `oc rollout`; scaling replicas is done with `oc scale` (or `oc scale dc/deployment`).

Answer

Triggering a direct source build from a local directory

Answer

Scaling the number of replicas up or down

Question 7

An OpenShift administrator needs to inspect how OVN-Kubernetes handles network flows and packet drops on a specific node. Which debugging utility installed in the OVN node container is most effective for viewing OpenFlow rules?

Accepted Answer

ovs-ofctl. OVN-Kubernetes uses Open vSwitch (OVS) as its data plane, and ovs-ofctl is the standard utility for inspecting and managing OpenFlow rules in the OVS bridge. It allows administrators to dump flows, view packet counters, and debug how traffic is being handled on a specific node. This makes it the most effective tool for viewing OpenFlow rules in the OVN node container.

Answer

nmcli connection show

Answer

ethtool -S

Answer

ovn-trace

Question 8

A developer is using Kustomize to manage environment overlays (dev and prod) for an OpenShift application. Where should the common base resources be referenced in the prod/kustomization.yaml file?

Accepted Answer

Under the resources: key. In modern Kustomize (v3+ and the version bundled with OpenShift's `oc kustomize`), overlays reference their base directory using the `resources:` field in kustomization.yaml. The prod overlay lists `../../base` (or the base path) under `resources:`, which causes Kustomize to compose the base manifests with the prod-specific patches and transformations. This is the canonical way to build a layered configuration.

Answer

Under the includes: key

Answer

Under the bases: key

Answer

Under the overlays: key

Question 9

An administrator needs to set a default StorageClass for the entire OpenShift cluster so that PVCs without a storageClassName specified automatically use it. How is this configured?

Accepted Answer

By adding the annotation storageclass.kubernetes.io/is-default-class: "true" to the StorageClass object.. In Kubernetes and OpenShift, a StorageClass is marked as the cluster default by adding the annotation storageclass.kubernetes.io/is-default-class: "true" to its metadata. The PersistentVolumeClaim admission controller then automatically assigns that class to any PVC that omits storageClassName.

Answer

By modifying the kube-controller-manager operator configuration.

Answer

By naming the StorageClass 'default-sc' exactly.

Answer

By setting defaultStorageClass: true in the cluster-config ConfigMap.

Question 10

Which TWO of the following can be used to troubleshoot a failing deployment?

Accepted Answer

oc describe deployment. Option B, `oc describe deployment`, is correct because it surfaces the deployment's status conditions, replica counts, events, and the underlying ReplicaSet/pod status, which is exactly what you need to diagnose why a rollout is failing. Option C, `oc logs`, is correct because retrieving container logs from the failing pods (or build/deployment logs) reveals application-level errors, crash reasons, and startup failures that explain the deployment failure. Option A, `oc rollout undo`, is a remediation command that reverts to a previous revision rather than a troubleshooting tool, so it does not help diagnose the failure. Option D, `oc delete project`, destroys the namespace and all its resources, which is destructive and not a diagnostic step. Option E, `oc start-build`, triggers a new build and does not investigate why an existing deployment is failing.

Answer

oc rollout undo

Answer

oc delete project

Answer

oc start-build

Question 11

An administrator needs to increase the size of an existing PVC bound to a gp3 storage class in an OpenShift cluster. What is the mandatory first step before editing the PVC spec?

Accepted Answer

Ensure allowVolumeExpansion: true is set on the corresponding StorageClass.. Before a PVC can be expanded, the StorageClass that provisioned it must have 'allowVolumeExpansion: true' set. Without this field, the PVC's spec.resources.requests.storage cannot be increased — the API server will reject the edit or the resize will never complete. This is the mandatory first step.

Answer

Manually update the underlying cloud provider disk size via the AWS console.

Answer

Delete the PV and recreate it with the new size.

Answer

Scale down all pods using the PVC to zero replicas.

Question 12

An application running in OpenShift requires scratch space that lives and dies strictly with the Pod lifecycle, but needs to be mounted from a high-performance cluster-managed storage backend rather than local ephemeral node storage. Which feature should an administrator configure?

Accepted Answer

Generic ephemeral inline volumes via a volume template in the Pod specification. Generic ephemeral inline volumes allow a Pod to specify a volume template that dynamically provisions a PersistentVolumeClaim (PVC) for the Pod's lifetime. The resulting PVC and its backing PersistentVolume (PV) are automatically deleted when the Pod is deleted, satisfying the 'lives and dies with the Pod' requirement. Because the volume is backed by a cluster-managed StorageClass, it can use high-performance storage backends (e.g., NVMe, Ceph RBD) rather than local node storage. This is the only option that combines Pod-lifecycle-bound ephemeral semantics with cluster-managed persistent storage.

Answer

HostPath volumes mapped to a local directory on the worker node

Answer

A standard dynamically provisioned PVC with reclaimPolicy set to Delete

Answer

emptyDir with medium: Memory

Question 13

Which custom resource defines a group of nodes (such as all worker nodes or a custom compute pool) that share a common MachineConfig in OpenShift 4.14?

Accepted Answer

MachineConfigPool. A MachineConfigPool (MCP) groups nodes that share the same MachineConfig, such as all worker nodes (the 'worker' pool) or a custom pool like 'infra'. The Machine Config Operator (MCO) applies MachineConfigs to nodes based on their pool membership, and each pool has its own rendered MachineConfig. This is the resource that defines a set of nodes with a common configuration.

Answer

NodeGroup

Answer

MachineSet

Answer

ConfigMap

Question 14

An administrator configures an EgressFirewall in a namespace to deny all external traffic except for a specific CIDR block. In what order are the rules in an EgressFirewall evaluated?

Accepted Answer

In sequential order (top to bottom), stopping at the first matching rule.. EgressFirewall rules are evaluated in sequential order from top to bottom, and the first rule that matches the traffic is applied. Once a match is found, no further rules are evaluated. This is similar to firewall rule processing in traditional firewalls. Therefore, the order of rules is critical for achieving the desired allow/deny behavior.

Answer

Allow rules are evaluated first, followed by deny rules.

Answer

Deny rules always take precedence over allow rules regardless of order.

Answer

Alphabetically by rule description.

Question 15

An administrator needs to configure secure access to a private registry for both node image pulls and OLM operator deployments. Which THREE actions or resources are required across the cluster? (Choose THREE)

Accepted Answer

Update the global pull secret in openshift-config/pull-secret with registry credentials.. Option A is correct because the global pull secret stored in the openshift-config namespace as pull-secret must contain the private registry credentials so that all nodes and the internal registry can authenticate when pulling images. Option B is correct because when the registry uses a custom or self-signed CA, the CA certificate must be distributed to nodes via a ConfigMap referenced in the cluster-wide image config (image.config.openshift.io/cluster) so that CRI-O and related components trust the registry's TLS certificate. Option E is correct because ImageContentSourcePolicy (or the newer ImageTagMirrorSet/ImageDigestMirrorSet) resources redirect image pulls from upstream references to the private registry mirror, which is required for both node image pulls and OLM operator deployments to resolve images correctly. Option C is incorrect because disabling TLS verification globally via ClusterVersion is not a supported or secure practice and would undermine the secure access requirement. Option D is incorrect because scaling the Machine API operator to zero is unrelated to registry credential or trust configuration and would disrupt cluster machine management.

Answer

Modify the ClusterVersion spec to disable TLS verification globally.

Answer

Scale the Machine API operator to zero during credential updates.