EX280 Practice Test 2 — 10 Questions

Question 1

An administrator needs to deploy a containerized web application using a Git repository as the source without writing a Dockerfile. Which OpenShift build strategy should be used?

Accepted Answer

Source-to-Image (S2I) strategy. The Source-to-Image (S2I) build strategy builds reproducible container images from source code without requiring a Dockerfile, injecting the source code into a builder image.

Answer

Docker strategy

Answer

Custom strategy

Answer

Pipeline strategy

Question 2

An administrator wants to pause rollouts on a DeploymentConfig named backend-api to make multiple configuration changes without triggering intermediate builds or rollouts. Which command pauses the rollout?

Accepted Answer

oc rollout pause dc/backend-api. The oc rollout pause command suspends rollout updates on a Deployment or DeploymentConfig.

Answer

oc patch dc/backend-api --type=json -p='[{"op": "add", "path": "/spec/paused", "value": true}]'

Answer

oc suspend dc/backend-api

Answer

oc stop rollout dc/backend-api

Question 3

An administrator needs to perform a canary deployment strategy using standard OpenShift Deployment resources (not DeploymentConfigs). What is the standard Kubernetes/OpenShift native mechanism to route a small percentage of traffic to the canary deployment?

Accepted Answer

Using an OpenShift Route with weighted backend services pointing to stable and canary Services. Standard Deployments do not have native percentage-based traffic splitting; an administrator must use a Service with multiple underlying selector labels alongside a Service Mesh, Ingress controller, or an OpenShift Route with weight configurations pointing to distinct Services. Specifically, OpenShift Routes support splitting traffic via weighted backends across multiple Services.

Answer

Setting the traffic-split annotation on the Deployment resource

Answer

Configuring weight parameters directly in the Deployment spec rollingUpdate strategy

Answer

Enabling canary mode in the ImageStream tag metadata

Question 4

Which TWO fields are mandatory when defining a standard Kubernetes NetworkPolicy object? (Choose TWO)

Accepted Answer

metadata. A NetworkPolicy requires 'apiVersion', 'kind', 'metadata', and 'spec' (with podSelector). From the specific choices, spec.podSelector and metadata are essential.

Answer

spec.ingress

Answer

spec.egress.to.ipBlock

Answer

metadata.namespace

Question 5

During an upgrade of an OpenShift 4.14 cluster using the Cluster Version Operator (CVO), the upgrade status stalls at a specific component. The administrator wants to check the detailed error messages and reconciling loops of the CVO itself. Where should the administrator look?

Accepted Answer

Review the logs of the cluster-version-operator deployment in the openshift-cluster-version namespace.. The Cluster Version Operator runs in the openshift-cluster-version namespace. Its logs provide detailed reconciliation status and errors during cluster upgrades.

Answer

Inspect the clusteroperators object using 'oc describe clusteroperator base-os'.

Answer

Check the cluster-wide events in the default namespace using 'oc get events'.

Answer

Inspect the MachineConfigPool status in the openshift-machine-api namespace.

Question 6

An administrator wants to add a custom CA certificate trust bundle to all worker nodes in an OpenShift 4.14 cluster so that internal container registries can be accessed securely. Which object should the administrator configure?

Accepted Answer

Create a ConfigMap in openshift-config containing the CA certificate and reference it in the cluster image configuration (imageregistry.config.openshift.io).. In OpenShift 4, administrators add custom CA bundles to the cluster-wide proxy or via a ConfigMap targeted by the image config, or by creating a MachineConfig injecting the CA certificate into /etc/pki/ca-trust/source/anchors/.

Answer

Modify the kube-dns ConfigMap to trust external TLS certificates.

Answer

Update the OAuth custom resource with the CA bundle path.

Answer

Restart the cluster proxy service with the '--ca-file' parameter.

Question 7

An administrator needs to create a passthrough Route that preserves client certificates and forwards encrypted traffic directly to the backend pod. Which spec configuration is required?

Accepted Answer

spec:
  tls:
    termination: passthrough. A passthrough route requires setting tls.termination to passthrough.

Answer

spec:
  tls:
    termination: reencrypt

Answer

spec:
  tls:
    termination: edge

Answer

spec:
  tls:
    insecureEdgeTerminationPolicy: Allow

Question 8

An administrator observes that pods in a specific namespace are unable to resolve external domain names (e.g., www.redhat.com) while internal service resolution works perfectly. What is the most likely cause of this issue in CoreDNS configuration?

Accepted Answer

The Corefile in the cluster DNS operator configuration has incorrect or missing forward plugins for external resolvers.. CoreDNS forwards external queries to upstream forwarders (like corporate DNS or public resolvers). If the forwarding block in the Corefile is misconfigured, external resolution fails.

Answer

The API server service is missing endpoint IPs.

Answer

NodePort range exhaustion prevents external DNS packets from traversing worker nodes.

Answer

The cluster ingress controller is blocking external UDP port 53.

Question 9

An administrator is configuring a DeploymentConfig in OpenShift and wants to set up automated triggers for new rollouts. Which TWO trigger types are natively supported in a DeploymentConfig spec? (Choose two.)

Accepted Answer

ConfigChange. DeploymentConfigs support ConfigChange (triggering when the DeploymentConfig template changes) and ImageChange (triggering when a referenced ImageStream tag updates).

Answer

PeriodicTrigger

Answer

WebhookTrigger

Answer

GitTrigger

Question 10

You have modified a set of Kubernetes manifests using Kustomize and want to preview the exact output that will be applied to your OpenShift cluster without actually executing the changes. Which command should you run?

Accepted Answer

oc kustomize .. The 'oc kustomize' command builds the Kustomize overlay and outputs the resulting raw manifests to stdout.

Answer

oc diff -f kustomization.yaml

Answer

oc convert -k .

Answer

oc apply -k . --dry-run=client