EX280 Practice Test 19 — 15 Questions

Question 1

An administrator needs to configure re-encrypt TLS termination on a Route. In addition to the router certificate, what other certificate component must typically be provided in the route configuration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The destination CA certificate to validate the backend pod's TLS certificate. In re-encrypt TLS termination, the router decrypts incoming traffic and then re-encrypts it before forwarding to the backend pod. To validate the backend pod's certificate during this second TLS handshake, the router must trust the CA that signed the pod's certificate. Therefore, the destination CA certificate is required in the Route configuration, in addition to the router's own certificate.

Answer

A base64 encoded kubeconfig file for the ingress operator

Answer

An identity provider public key for JSON Web Token validation

Answer

A client certificate for mutual TLS authentication against the OAuth server

Question 2

An administrator wants to check the detailed configuration and current status of a specific Route named 'my-app-route'. Which command provides this?

Accepted Answer

oc describe route my-app-route. The `oc describe route my-app-route` command provides detailed configuration and current status of a specific Route, including host, path, TLS settings, and the router's admission status. It is the standard way to inspect a single OpenShift resource in depth.

Answer

oc get route my-app-route --status

Answer

oc show route my-app-route

Answer

oc adm route-status my-app-route

Question 3

Which field in a PersistentVolumeClaim specifies the minimum amount of storage space required by the workload?

Accepted Answer

spec.resources.requests.storage. In a PVC, the requested storage size is specified under spec.resources.requests.storage, following the standard Kubernetes resource requirements schema. This value is matched against a PV's capacity during binding, and the resulting PV must be at least this size. It is the same pattern used for CPU and memory requests in pod specs.

Answer

spec.storageSize

Answer

spec.capacity.storage

Answer

spec.volumeSize

Question 4

Which TWO of the following steps are required when configuring an HTPasswd identity provider in OpenShift? (Choose TWO)

Accepted Answer

Create a Secret containing the htpasswd file in the 'openshift-config' namespace.. Option D is correct because OpenShift requires the htpasswd file to be stored as a Secret in the 'openshift-config' namespace, which the OAuth server mounts and reads; the file cannot be referenced from an arbitrary path on the nodes. Option E is correct because after creating the Secret you must edit the cluster-scoped OAuth custom resource (oc edit oauth cluster) to add an identityProviders entry of type HTPasswd that references that Secret by name, which triggers the OAuth server to reconfigure. Option A is not required: HTPasswd users are not automatically granted any cluster role, and creating a ClusterRoleBinding for all users is an optional authorization step, not part of identity provider configuration. Option B is incorrect because the htpasswd file is not placed directly on control plane nodes at '/etc/origin/master/'; that legacy path is not how modern OpenShift consumes the file. Option C is incorrect because you do not manually restart kube-apiserver static pods; the OAuth server (an operator-managed deployment) redeploys automatically when the OAuth configuration changes.

Answer

Create a ClusterRoleBinding for all users in the htpasswd file.

Answer

Place the htpasswd file directly on every control plane node at '/etc/origin/master/'.

Answer

Restart the kube-apiserver static pods manually across all masters.

Question 5

When configuring an OAuth identity provider of type HTPasswd, which object type must be created to store the username and hashed password pairs?

Accepted Answer

A Secret containing the htpasswd flat-file data. In OpenShift, the HTPasswd identity provider requires a Secret of type Opaque that contains a key named 'htpasswd' holding the flat-file data generated by the htpasswd command. This Secret is created in the openshift-config namespace and referenced in the OAuth custom resource. The Secret stores the username and bcrypt-hashed password pairs, which the OAuth server uses to authenticate users.

Answer

A ServiceAccount with special token annotations

Answer

A ConfigMap containing plain-text user credentials

Answer

A custom resource of kind HTPasswdProvider in the openshift-config namespace

Question 6

An administrator is troubleshooting a storage performance issue on an OpenShift cluster using Container Storage Interface (CSI) drivers. Which THREE actions or diagnostic commands are effective for investigating CSI driver health and provisioner issues? (Choose THREE)

Accepted Answer

Verify the CSI driver configuration by checking the CSIDriver and CSINode cluster resources.. Option A is correct because the CSIDriver and CSINode cluster resources define how the CSI driver is registered and which nodes it is available on; inspecting them with oc get csidriver and oc get csinode (or oc describe) reveals misconfigurations such as missing node registration or incorrect attach/detach behavior that cause provisioning failures. Option B is correct because oc describe pvc <pvc-name> surfaces Kubernetes events on the pending PVC, including provisioner errors, topology/volume binding failures, and storage class issues, which are the fastest way to identify why a volume is not being dynamically provisioned. Option E is correct because the external CSI provisioner (typically the csi-provisioner sidecar in the driver controller deployment) emits logs that show gRPC errors, storage backend API failures, and leader-election or RBAC problems directly tied to provisioning issues. Option C is not correct because kubelet storage timeout values are not the standard diagnostic or remediation for CSI provisioner problems, and modifying control plane kubelet config does not address CSI controller-side provisioning. Option D is not correct because there is no systemctl unit named csi-driver on worker nodes; CSI drivers run as DaemonSets/Deployments in OpenShift, so restarting pods via oc rollout restart or oc delete pod is the proper approach.

Answer

Modify the kubelet configuration file on control plane nodes to increase storage timeout values.

Answer

Run systemctl restart csi-driver on every worker node to force reconnection to the storage array.

Question 7

You notice that your builds are failing due to a lack of memory. Where can you set resource limits for the build process?

Accepted Answer

In the BuildConfig resources field. Build resource limits are configured in the `resources` field of the BuildConfig's `spec`, which is passed to the build pod that executes the build. This lets you cap CPU and memory for the build container so that memory-hungry builds (for example, large Maven or Node builds) don't get OOM-killed. The values follow standard Kubernetes resource requests/limits syntax.

Answer

In the LimitRange

Answer

In the project Quota

Answer

In the Deployment object

Question 8

An administrator wants to check the status of all Certificate Signing Requests (CSRs) in an OpenShift 4.14 cluster, specifically looking for pending node certificates. Which command should be used?

Accepted Answer

oc get csr. The `oc get csr` command lists all Certificate Signing Requests in the cluster, showing their NAME, AGE, SIGNERNAME, REQUESTEDDURATION, and CONDITION. Pending node CSRs appear with a CONDITION of Pending, which is exactly what an administrator needs to identify certificates awaiting approval. This is the standard OpenShift 4.x command for inspecting CSR status.

Answer

oc adm certificate-status

Answer

oc describe clusteroperator pkcs

Answer

oc get certificates --all-namespaces

Question 9

An administrator needs to ensure that if a worker node freezes or becomes unresponsive for more than 5 minutes, the cluster automatically remediates it by deleting and recreating the underlying virtual machine instance. Which OpenShift 4.14 feature should the administrator configure?

Accepted Answer

MachineHealthCheck. MachineHealthCheck (MHC) is the OpenShift 4.x feature that monitors node conditions and, when a node is unhealthy beyond a configured timeout, triggers remediation by deleting the Machine object so the Machine API Operator recreates the underlying VM. Configuring 'maxUnhealthy' and 'nodeStartupTimeout' plus a selector for worker nodes achieves the 5-minute freeze remediation described.

Answer

NodeAutoscaler

Answer

MachineConfigPool

Answer

ClusterAutoscaler

Question 10

An administrator needs to back up application data stored on an OpenShift PVC. Which object must be created to initiate the snapshot process via the CSI driver?

Accepted Answer

VolumeSnapshot. The VolumeSnapshot object is the user-facing custom resource that requests a snapshot of a PersistentVolumeClaim (PVC) when using a CSI driver that supports snapshotting. It is created by the administrator to initiate the snapshot process, and it triggers the creation of a VolumeSnapshotContent object that represents the actual snapshot on the storage backend. This is part of the Kubernetes CSI snapshot API, which OpenShift supports.

Answer

BackupCR

Answer

VolumeSnapshotContent

Answer

StorageSnapshot

Question 11

You are using Kustomize to manage environment-specific configurations. Which file must be present in the base directory to define resources?

Accepted Answer

kustomization.yaml. Every Kustomize directory — base or overlay — must contain a kustomization.yaml file, which declares the resources, patches, and transformations for that layer. In the base directory, this file lists the Kubernetes manifests (Deployments, Services, ConfigMaps) that make up the common configuration. Without it, 'kubectl kustomize' or 'oc apply -k' cannot resolve the directory.

Answer

base.yaml

Answer

overlay.yaml

Answer

resources.yaml

Question 12

An administrator notices that the Cluster Version Operator (CVO) is blocked during an upgrade because a cluster operator is missing version annotations. Which command allows checking the current status and payload version of the CVO?

Accepted Answer

oc get clusterversion. 'oc get clusterversion' displays the ClusterVersion resource, which shows the current cluster version, the desired version, the upgrade channel, and the status of the CVO — including conditions like Failing, Progressing, and Available. This is the command that reveals whether the CVO is blocked and what payload version it is targeting.

Answer

oc adm upgrade status

Answer

oc get clusteroperators

Answer

oc version

Question 13

You need to ensure that your application deployment always maintains at least 80% of its desired pod count during a rolling update. Which strategy parameter should you configure?

Accepted Answer

maxUnavailable: 20%. In a rolling update strategy, maxUnavailable defines the maximum number of Pods that can be unavailable during the update. Setting maxUnavailable: 20% ensures that at least 80% of the desired Pod count remains available at all times, satisfying the requirement. This parameter directly controls the availability floor during the rollout.

Answer

minReadySeconds: 20

Answer

maxSurge: 20%

Answer

rollingUpdatePeriod: 20%

Question 14

An administrator creates a new custom Security Context Constraint (SCC) named restrict-root. After creating the SCC resource, users complain that pods using a ServiceAccount tied to this SCC are still falling back to the restricted-v2 SCC. What is the most likely cause?

Accepted Answer

The ServiceAccount lacks the RBAC permission to use the restrict-root SCC via a ClusterRoleBinding or RoleBinding to the system:openshift:scc:restrict-root ClusterRole.. In OpenShift, an SCC is only usable by a ServiceAccount if that ServiceAccount has been granted permission to use it. This is done by binding the ServiceAccount to the ClusterRole named system:openshift:scc:<scc-name> (or the equivalent RoleBinding in the namespace). Without that RBAC binding, the SCC admission controller ignores the custom SCC and the pod falls back to the default SCC assigned to the ServiceAccount (restricted-v2 in OCP 4.x).

Answer

The SCC object is missing the metadata.labels.openshift.io/scc label set to restrict-root.

Answer

Custom SCCs are disabled by default in OpenShift Container Platform 4.14 and require an operator configuration change.

Answer

The Pod Security Standards admission plugin is blocking custom SCC creation at the namespace level.

Question 15

An administrator needs to perform a canary deployment strategy using standard OpenShift Deployment resources (not DeploymentConfigs). What is the standard Kubernetes/OpenShift native mechanism to route a small percentage of traffic to the canary deployment?

Accepted Answer

Using an OpenShift Route with weighted backend services pointing to stable and canary Services. OpenShift Routes support weighted backends via the 'alternateBackends' field with a 'weight' value, allowing a single Route to split traffic between a stable Service and a canary Service. This is the native mechanism for canary traffic splitting without a service mesh, and it works with standard Deployments behind each Service.

Answer

Setting the traffic-split annotation on the Deployment resource

Answer

Configuring weight parameters directly in the Deployment spec rollingUpdate strategy

Answer

Enabling canary mode in the ImageStream tag metadata