EX280 Practice Test 20 — 15 Questions

Question 1

An administrator needs to configure custom container runtime parameters (such as the maximum pod log size or maximum number of processes per container) across all worker nodes in an OpenShift 4.14 cluster. Which custom resource should the administrator create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ContainerRuntimeConfig. The ContainerRuntimeConfig custom resource is specifically designed to modify container runtime settings such as maximum pod log size (logSizeMax) and maximum processes per container (pidsLimit) on OpenShift 4.x worker nodes. It works by generating a MachineConfig that updates the CRI-O configuration on the targeted nodes. This resource is part of the Machine Config Operator's API and is the correct way to apply runtime-level tuning across a node pool. KubeletConfig, while also a node-level configuration, handles kubelet parameters like pod density and eviction thresholds, not container runtime settings.

Answer

MachineHealthCheck

Answer

KubeletConfig

Answer

NodeNetworkConfigurationPolicy

Question 2

A cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?

Accepted Answer

A custom label defined in the namespaceSelector of the NetworkPolicy spec. In a NetworkPolicy, the `namespaceSelector` matches namespaces based on their labels. For traffic from the `frontend` namespace to be allowed, the `frontend` namespace must have the exact label key-value pair specified in the `namespaceSelector` of the NetworkPolicy. This label is arbitrary and defined by the administrator; it does not have to be a default OpenShift label.

Answer

openshift.io/cluster-monitoring=true

Answer

security.openshift.io/scc=restricted

Answer

kubernetes.io/metadata.name matching the namespace name

Question 3

The cluster monitoring stack is failing because Prometheus pods in the openshift-monitoring namespace are crashing due to disk space exhaustion on the Prometheus PersistentVolume. How can the administrator inspect the current disk usage inside the Prometheus container?

Accepted Answer

oc exec -n openshift-monitoring prometheus-k8s-0 -c prometheus -- df -h. The Prometheus pods run in the openshift-monitoring namespace, and to inspect disk usage inside a specific container you must exec into that container. Option A uses `oc exec` with the correct pod name (prometheus-k8s-0), namespace, and container (-c prometheus) to run `df -h`, which directly shows filesystem usage on the mounted PersistentVolume. This is the only option that targets the actual container's filesystem rather than the node or unrelated resources.

Answer

oc debug node/<node-name> -- df -h

Answer

oc logs -n openshift-monitoring deployment/prometheus-adapter

Answer

oc adm top volume

Question 4

An application pod is failing its liveness probe and continuously restarting. Where can an administrator quickly check the reason for the liveness probe failure?

Accepted Answer

oc describe pod . The `oc describe pod ` command shows detailed information about the pod, including events and container statuses. When a liveness probe fails, the events section typically records the probe failure and the reason, such as connection refused or HTTP status code. This is the quickest way to diagnose the issue.

Answer

oc get routes

Answer

oc get pod <pod-name> -o json

Answer

oc adm diagnostics

Question 5

An administrator wants to view the public URL assigned to an existing Route named 'webapp'. Which oc command is best suited to extract only the host URL value?

Accepted Answer

oc get route webapp -o jsonpath='{.spec.host}'. The `oc get route webapp -o jsonpath='{.spec.host}'` command uses JSONPath to extract exactly the value of the `spec.host` field from the Route object, which is the public URL assigned to the Route. This is the most precise and script-friendly way to retrieve only the host value without any additional formatting or metadata. The `-o jsonpath` output option is a standard Kubernetes/OpenShift mechanism for field-level extraction.

Answer

oc get route webapp --show-url

Answer

oc describe route webapp --url

Answer

oc extract route/webapp --field=host

Question 6

An administrator needs to ensure that no pod in the 'secure-zone' namespace can run with root privileges or use host networking. Which mechanism natively enforces this across all pods in the namespace?

Accepted Answer

Assigning a restrictive SecurityContextConstraints (SCC) policy to the service accounts running the pods. SecurityContextConstraints (SCCs) are OpenShift's native cluster-level policy objects that control pod security settings such as running as root, host networking, and volume types. Assigning a restrictive SCC to the service accounts used by pods in the namespace enforces these restrictions across all pods.

Answer

Setting container securityContext in every deployment manually

Answer

Configuring a NetworkPolicy to block root network namespaces

Answer

ResourceQuota limits on security capabilities

Question 7

A developer wants to ensure that a pod's temporary storage does not exceed 2Gi and that the pod is terminated or throttled if it exceeds this limit. Where should this ephemeral storage limit be declared?

Accepted Answer

In the container's spec.resources.limits under 'ephemeral-storage'.. Ephemeral storage limits are declared in the container's spec.resources.limits under the 'ephemeral-storage' key, just like CPU and memory. This causes the kubelet to enforce the limit by evicting the pod when local ephemeral storage usage exceeds the configured value. The limit applies to the container's writable layer, emptyDir volumes, and logs, making it the correct place for a 2Gi cap.

Answer

In the emptyDir volume specification under 'sizeLimit'.

Answer

In the StorageClass under 'parameters.ephemeralLimit'.

Answer

In the persistentVolumeClaim under 'spec.ephemeral'.

Question 8

Which THREE of the following are valid parameters that can be specified in a LimitRange object specification? (Choose THREE)

Accepted Answer

max. In a Kubernetes LimitRange spec, the max field (option A) sets the maximum compute resource limits (e.g., cpu, memory) that a container or Pod may request/limit within the namespace, so it is a valid parameter. The defaultRequest field (option C) specifies the default resource requests applied to containers that do not declare their own requests, making it a valid LimitRange parameter. The min field (option D) defines the minimum resource requests/limits a container or Pod must specify, and is also a valid LimitRange parameter. Option B (replicas) is not part of LimitRange; replica counts belong to workload controllers such as Deployments or ReplicaSets. Option E (clusterWideAccess) is not a LimitRange field; it is unrelated to resource governance and resembles a storage or access setting rather than a LimitRange parameter.

Answer

replicas

Answer

clusterWideAccess

Question 9

An administrator needs to perform a graceful maintenance reboot on a worker node named worker-01 in an OpenShift 4.14 cluster without causing application downtime for stateless deployments. Which combination of actions should the administrator perform first?

Accepted Answer

Run 'oc adm cordon worker-01' followed by 'oc adm drain worker-01 --delete-emptydir-data --ignore-daemonsets'.. The correct sequence is to first cordon the node to mark it unschedulable, preventing new pods from being placed there, then drain it to evict existing pods gracefully. The flags --delete-emptydir-data and --ignore-daemonsets ensure that pods using emptyDir volumes are removed and daemonset pods are ignored, allowing the drain to complete without errors. This approach respects PodDisruptionBudgets and allows stateless workloads to be rescheduled onto other nodes, avoiding downtime.

Answer

Apply a MachineConfig to the worker MachineConfigPool pausing the updates, then reboot the node.

Answer

Stop the kubelet service on worker-01 via systemctl and reboot the underlying operating system.

Answer

Run 'oc delete node worker-01' directly to force the cluster control plane to automatically reschedule workloads.

Question 10

Which THREE of the following actions can a user with the default OpenShift 'view' role perform within a project? (Choose THREE)

Accepted Answer

View ConfigMaps. The default OpenShift 'view' role is a ClusterRole aggregated to grant read-only access to most project-scoped resources, so option B (View ConfigMaps) is correct because ConfigMaps are readable via get/list/watch verbs under the view role. Option D (List and read Pods) is correct because the view role includes get, list, and watch on pods and pod logs. Option E (View Deployments and Services) is correct because the view role grants read access to Deployments, Services, and other workload/networking resources in the project. Option A (Delete PersistentVolumeClaims) is incorrect because delete is a write verb not granted by the view role; that requires edit or admin. Option C (Modify RoleBindings within the project) is incorrect because managing RoleBindings requires admin-level permissions, not the read-only view role.

Answer

Delete PersistentVolumeClaims

Answer

Modify RoleBindings within the project

Question 11

An administrator needs to identify worker nodes that require attention during an upgrade or maintenance. Which TWO conditions or states on a node object indicate potential issues or special maintenance states? (Choose TWO)

Accepted Answer

SchedulingDisabled. Option B (SchedulingDisabled) is correct because this condition on a node object indicates the node has been cordoned (via `oc adm cordon` or `kubectl cordon`), meaning it is marked unschedulable and will not accept new pods, which is a special maintenance state administrators must track during upgrades. Option E (NotReady) is correct because the Ready condition set to NotReady (or Unknown) means the node's kubelet is not reporting healthy status to the control plane, signaling a potential problem requiring attention. Options A (Running=Normal) and C (Active=True) are not valid node conditions in OpenShift/Kubernetes node status, so they do not indicate anything meaningful. Option D (Schedulable=True) is the normal, healthy state indicating the node can accept pods, so it does not represent an issue or special maintenance state.

Answer

Running=Normal

Answer

Active=True

Answer

Schedulable=True

Question 12

Which THREE methods can be used to pass parameters or configuration values into a Helm chart installation in OpenShift? (Choose three.)

Accepted Answer

Relying on the default values defined in the chart's values.yaml file. Option A is correct because Helm automatically loads the chart's built-in values.yaml file as the base set of default configuration values whenever a chart is installed, so relying on those defaults is a legitimate way configuration is supplied to the release. Option C is correct because the --set flag lets you override individual values as key-value pairs directly on the command line (e.g., helm install myrelease mychart --set image.tag=latest), which is a standard method for injecting parameters at install time. Option D is correct because the --values (or -f) flag lets you supply a custom YAML file whose keys are merged over the chart defaults, enabling structured, reusable configuration input. Option B does not belong because oc patch modifies live Kubernetes objects after deployment and has no role in Helm's templating or value-passing mechanism. Option E does not belong because the cluster-wide OAuth configuration map governs OpenShift authentication settings, not Helm chart parameter injection.

Answer

Directly modifying the deployed Kubernetes Pod annotations via oc patch

Answer

Injecting values through the cluster-wide OAuth configuration map

Question 13

An administrator is troubleshooting an Operator installation issue in OpenShift 4.14. Which TWO resources or logs should the administrator examine to diagnose OLM operator subscription and CSV issues? (Choose TWO)

Accepted Answer

Inspect the ClusterServiceVersion (CSV) status and conditions.. Option D is correct because the ClusterServiceVersion (CSV) is the OLM resource that represents a running operator; its status.phase (e.g., Succeeded, Failed, Pending) and status.conditions (such as InstallSucceeded, InstallReady, RequirementsUnknown) directly reveal why an operator install is failing, including dependency or RBAC problems. Option E is correct because the Subscription object in the target namespace tracks the operator's desired channel, installPlanApproval, and its status.conditions (e.g., CatalogSourcesUnhealthy, InstallPlanMissing, ResolutionFailed), which is the first place OLM records subscription resolution and upgrade errors. Option A is not relevant because MachineConfigPool status in openshift-machine-api reflects node configuration rollout, not OLM operator subscription or CSV state. Option B is not relevant because node storage provisioning logs pertain to CSI/storage operators and PV binding, not to OLM subscription or CSV diagnostics. Option C is not relevant because the ClusterVersion resource reports OpenShift platform update status, not the health of individual operator subscriptions or CSVs.

Answer

Review the MachineConfigPool status in openshift-machine-api.

Answer

Check the cluster-wide node storage provisioning logs.

Answer

Review the ClusterVersion resource status conditions.

Question 14

Which TWO tools or protocols can an administrator use to verify internal cluster DNS resolution from a pod? (Choose TWO)

Accepted Answer

nslookup. nslookup (B) is correct because it is a DNS query utility that can be run from inside a pod to resolve cluster service names against the cluster DNS server (CoreDNS/kube-dns) and confirm the returned A/AAAA records. dig (E) is also correct because it performs direct DNS lookups and shows detailed query/response data, including the resolver used and answer records, making it ideal for verifying internal cluster DNS resolution. ping (A) only tests ICMP reachability and name-to-address resolution incidentally, so it does not specifically validate DNS query behavior. ifconfig (C) merely displays network interface configuration and addresses, and top (D) shows process/resource usage, neither of which queries DNS.

Answer

ping

Answer

ifconfig

Answer

top

Question 15

An administrator is preparing to perform maintenance on worker nodes in an OpenShift 4.14 cluster. Which TWO commands or actions are part of the standard workflow to safely prepare a node for maintenance? (Choose TWO)

Accepted Answer

Run 'oc adm cordon ' to mark the node as unschedulable.. Option B is correct because 'oc adm cordon ' marks the node as unschedulable, preventing the scheduler from placing new pods on it while existing workloads continue running, which is the required first step before maintenance. Option D is correct because 'oc adm drain --delete-emptydir-data --ignore-daemonsets' safely evicts the node's pods; --ignore-daemonsets is needed since DaemonSet pods cannot be evicted, and --delete-emptydir-data allows removal of pods using emptyDir volumes. Together, cordon then drain is the standard OpenShift 4.14 workflow to prepare a worker node for maintenance. Option A is wrong because force-deleting the Node object does not gracefully evict pods and can leave workloads in an inconsistent state. Option C is wrong because stopping kubelet without cordoning or draining leaves pods abruptly terminated and the node still marked schedulable. Option E is wrong because scaling a MachineConfigPool to zero replicas is not a node-maintenance procedure and would disrupt the pool's managed nodes.

Answer

Run 'oc delete node <node-name> --force' immediately before stopping services.

Answer

Stop the kubelet service directly via systemctl without cordoning.

Answer

Scale the MachineConfigPool replicas to zero.