EX280 Practice Test 2 — 10 Questions

Question 1

An administrator needs to restrict ingress traffic to pods in the 'frontend' namespace so that only pods labeled role=api in the 'backend' namespace can connect on TCP port 8080. All other traffic must be denied. Which NetworkPolicy configuration achieves this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web, ingress from namespaceSelector matching name=backend and podSelector matching role=api, and ports TCP 8080.. A NetworkPolicy must be created in the namespace of the pods it protects (frontend) and use podSelector to select those pods. The ingress rule must combine namespaceSelector and podSelector to allow only pods in backend with role=api, and specify the port TCP 8080. Once any policy selects the frontend pods, all other ingress is denied by default.

Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web and ingress from ipBlock 10.0.0.0/8 on TCP 8080.

Answer

A NetworkPolicy in the backend namespace with podSelector matching role=api and egress to namespaceSelector matching name=frontend and port TCP 8080.

Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web and ingress from namespaceSelector matching name=backend without specifying ports.

Question 2

An administrator notices that a worker node is in a 'NotReady' state due to a storage failure. The administrator successfully replaces the underlying physical machine and wants to clear the old node object from the OpenShift 4.14 cluster. Which command should be used?

Accepted Answer

oc delete node worker-old. To remove a node object from an OpenShift cluster, the correct command is `oc delete node <node-name>`. This deletes the Node resource from the cluster, and if the node is managed by a MachineSet, the Machine object may also be deleted or replaced. In this scenario, the administrator has already replaced the physical machine, so deleting the old node object is appropriate.

Answer

oc adm cordon worker-old --purge

Answer

oc patch machine worker-old --type=merge -p '{"spec":{"deleted":true}}'

Answer

oc remove node-status worker-old

Question 3

You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?

Accepted Answer

oc auth can-i list deployments --as=system:serviceaccount:ci-cd:cicd-bot -n ci-cd. `oc auth can-i` performs a SubjectAccessReview against the OpenShift API server, and the `--as=system:serviceaccount::` flag impersonates the service account so the answer reflects that SA's effective RBAC permissions rather than the current user's. Adding `-n ci-cd` scopes the check to the ci-cd namespace, which is required because RoleBindings are namespace-scoped. This is the canonical way to verify whether a specific SA can perform a verb on a resource.

Answer

oc adm policy who-can get deployments -n ci-cd

Answer

oc describe serviceaccount cicd-bot -n ci-cd

Answer

oc get rolebindings --serviceaccount=cicd-bot

Question 4

What is the primary difference between PersistentVolumes (PVs) and PersistentVolumeClaims (PVCs)?

Accepted Answer

PVs represent actual cluster storage resources, while PVCs represent user requests for storage.. PersistentVolumes (PVs) are cluster-level storage objects that represent the actual backing storage (NFS, iSCSI, cloud disk, etc.) provisioned by an admin or dynamically by a StorageClass. PersistentVolumeClaims (PVCs) are namespace-scoped requests from a user/pod for a certain size and access mode, which the control plane binds to a matching PV. This separation of 'supply' (PV) from 'demand' (PVC) is the core abstraction in Kubernetes/OpenShift storage.

Answer

PVs only support block mode, while PVCs only support filesystem mode.

Answer

PVs are created by developers, while PVCs are created by cluster administrators.

Answer

PVs are namespace-scoped, while PVCs are cluster-scoped.

Question 5

An OpenShift administrator needs to allow users to expand the storage capacity of existing PersistentVolumeClaims without restarting their applications. Which action must be taken first to enable this capability?

Accepted Answer

Edit the StorageClass to set allowVolumeExpansion: true.. Online volume expansion in Kubernetes/OpenShift is gated by the StorageClass field allowVolumeExpansion. Until that field is set to true on the StorageClass backing the PVC, the API server will reject any attempt to increase the PVC's requested storage, so it must be enabled first.

Answer

Restart the csi-provisioner controller deployment in the openshift-cluster-storage-operator namespace.

Answer

Add the expansion-enabled annotation directly to each active Pod object.

Answer

Convert all existing static PersistentVolumes into dynamically provisioned volumes.

Question 6

An administrator wants to check why a specific MachineConfigPool is taking a long time to complete an update. Which status condition on the MachineConfigPool indicates that nodes are currently being updated?

Accepted Answer

Updating=True. The MachineConfigPool (MCP) status includes a condition of type 'Updating'. When this condition's status is 'True', it explicitly indicates that the pool is actively applying configuration changes to its nodes. This is the standard condition used by the Machine Config Operator (MCO) to signal that an update is in progress. Therefore, option A is correct.

Answer

RollingOut=Running

Answer

Reconciling=Pending

Answer

Progressing=Active

Question 7

An OpenShift cluster upgrade has failed because a MachineConfigPool is degraded. Which THREE actions or commands can an administrator perform to diagnose the root cause of the MachineConfigPool degradation? (Choose THREE)

Accepted Answer

oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon. Option E is correct because `oc describe machineconfigpool ` shows the pool's status conditions, including Degraded, Updated, Updating, and the reason/message fields that identify why the pool is degraded. Option C is correct because listing MachineConfigs with the label `machineconfiguration.openshift.io/role=` shows the rendered and role-specific configs applied to that pool, helping spot a bad or mismatched MachineConfig. Option A is correct because `oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon` retrieves the Machine Config Daemon logs, where the actual node-level failure (e.g., failed systemd unit, file write, or reboot issue) is recorded. Option B is wrong because scaling the cluster-version-operator deployment does not diagnose a degraded MachineConfigPool and is not a supported troubleshooting step. Option D is wrong because `oc adm upgrade cancel` only cancels an in-progress cluster upgrade and does not reveal the root cause of the MachineConfigPool degradation.

Answer

oc scale deployment/cluster-version-operator --replicas=3

Answer

oc adm upgrade cancel

Question 8

Which THREE parameters or fields are valid when configuring a StorageClass object in OpenShift 4.14+?

Accepted Answer

provisioner. Option B (provisioner) is correct because every StorageClass must specify the provisioner field, which identifies the volume plugin (e.g., kubernetes.io/aws-ebs, ebs.csi.aws.com, or kubernetes.io/no-provisioner) used to dynamically provision PersistentVolumes. Option C (volumeBindingMode) is correct because it is a valid StorageClass field that controls when volume binding and dynamic provisioning occur, with supported values Immediate and WaitForFirstConsumer. Option E (reclaimPolicy) is correct because StorageClass supports the reclaimPolicy field to define the default PersistentVolume reclaim behavior for dynamically provisioned volumes, with valid values Delete and Retain. Option A (containerRuntime) is not a StorageClass parameter; it relates to container runtime configuration (e.g., CRI-O) and is not part of the storage.k8s.io/v1 StorageClass schema. Option D (nodeSelector) is not a StorageClass field; node selection for storage is handled via allowedTopologies or in PersistentVolume nodeAffinity, not a nodeSelector key on StorageClass.

Answer

containerRuntime

Answer

nodeSelector

Question 9

When creating a custom SCC, what is the best practice for assigning it to users?

Accepted Answer

Bind the SCC to a specific service account in a specific namespace. Binding a custom SCC to a specific service account in a specific namespace follows the principle of least privilege and is the OpenShift best practice. SCCs are applied to service accounts (or users/groups) via RBAC role bindings, and scoping to a specific service account in a specific namespace ensures the elevated permissions are granted only where needed, minimizing the blast radius of a compromised pod.

Answer

Bind the SCC to the 'cluster-admin' user

Answer

Bind the SCC to the 'system:authenticated' group

Answer

Assign the SCC to the namespace object directly

Question 10

An administrator needs to troubleshoot why an OLM (Operator Lifecycle Manager) managed operator installation is failing. Which THREE resources should be inspected? (Choose THREE)

Accepted Answer

oc get subscription . Option A, `oc get subscription `, is correct because the Subscription is the OLM resource that declares which operator and channel to install and records the resolution state, so its status reveals whether the operator was resolved and any resolution failures. Option B, `oc get installplan`, is correct because the InstallPlan is generated by OLM to enumerate the CSVs and approval requirements needed to install or upgrade an operator, and its status shows whether the plan is pending approval or has failed to execute. Option E, `oc get csv`, is correct because the ClusterServiceVersion represents the actual running operator deployment and its status/phase (e.g., Failed, Pending) exposes installation errors such as unmet dependencies or failed deployments. Option C, `oc get routes`, is not relevant because Routes only expose services externally and are not part of the OLM installation pipeline. Option D, `oc get pv`, is not relevant because PersistentVolumes relate to storage provisioning and are not OLM installation resources unless a specific storage issue is already suspected.

Answer

oc get routes

Answer

oc get pv