EX280 Practice Exam 1 — 20 Questions

Question 1

An administrator needs to deploy a Helm chart into an OpenShift cluster while overriding specific chart values using a local YAML file. Which Helm CLI command should be executed?

Accepted Answer

helm install my-release my-chart --values overrides.yaml. The helm install command with the -f or --values flag allows supplying a YAML file to override default chart values.

Answer

helm push my-chart --override overrides.yaml

Answer

helm deploy my-release my-chart --values overrides.yaml

Answer

helm apply -f overrides.yaml my-chart

Question 2

A cluster uses OVN-Kubernetes as its CNI network provider. An administrator needs to inspect the logical switches and routers created by OVN within a node. Which command-line tool inside the ovn-node pod should be used?

Accepted Answer

ovn-nbctl. ovn-nbctl is the Open Virtual Network Northbound CLI utility used to inspect logical entities like switches, routers, and ports.

Answer

ip route show

Answer

iptables-save

Answer

ovs-vsctl

Question 3

An administrator needs to view the rollout history of a DeploymentConfig named web-frontend. Which command accomplishes this?

Accepted Answer

oc rollout history dc/web-frontend. The oc rollout history command displays the revision history for a Deployment or DeploymentConfig.

Answer

oc describe dc/web-frontend

Answer

oc get revisions dc/web-frontend

Answer

oc log rollout dc/web-frontend

Question 4

You need to deploy a Node.js application from a Git repository using Source-to-Image (S2I) on OpenShift 4.14, and you want to ensure the build triggers automatically whenever a new image is pushed to the dependent base ImageStream. Which BuildConfig strategy and configuration element achieves this?

Accepted Answer

Configure a Source build with an ImageChange trigger on the input ImageStreamTag.. Using the source strategy in a BuildConfig along with triggers of type ImageChange allows the build to automatically run when the referenced ImageStreamTag changes.

Answer

Configure a Docker build with a ConfigChange trigger on the DeploymentConfig.

Answer

Configure a Pipeline build referencing a Tekton pipeline with manual execution parameters.

Answer

Configure a Custom build with a GitHub webhook trigger referencing the source repository.

Question 5

Which TWO of the following can be used to troubleshoot a failing deployment?

Accepted Answer

oc describe deployment. Describing the deployment and checking the pod logs are standard troubleshooting steps.

Answer

oc rollout undo

Answer

oc delete project

Answer

oc start-build

Question 6

An administrator wants to configure a NetworkPolicy that allows incoming traffic only from pods with the label 'role=frontend' residing in any namespace, provided those namespaces have the label 'environment=production'. How should the namespaceSelector and podSelector be combined?

Accepted Answer

In the same ingress 'from' array item, combining namespaceSelector and podSelector. A single ingress rule in a NetworkPolicy can contain both a namespaceSelector and a podSelector within the same 'from' array element to target specific pods in specific namespaces.

Answer

By referencing an external ClusterRole binding with label selectors

Answer

Using a peerSelector object that nests both labels

Answer

In separate ingress rules, where one rule has namespaceSelector and another has podSelector

Question 7

An administrator needs to configure custom container runtime parameters (such as the maximum pod log size or maximum number of processes per container) across all worker nodes in an OpenShift 4.14 cluster. Which custom resource should the administrator create?

Accepted Answer

ContainerRuntimeConfig. Container runtime settings such as max log size and storage options are managed using the ContainerRuntimeConfig custom resource in OpenShift.

Answer

MachineHealthCheck

Answer

KubeletConfig

Answer

NodeNetworkConfigurationPolicy

Question 8

An administrator wants to view the public URL assigned to an existing Route named 'webapp'. Which oc command is best suited to extract only the host URL value?

Accepted Answer

oc get route webapp -o jsonpath='{.spec.host}'. Using jsonpath with the oc get command allows extracting specific fields like the host spec of a route directly.

Answer

oc get route webapp --show-url

Answer

oc describe route webapp --url

Answer

oc extract route/webapp --field=host

Question 9

What is the primary function of the Machine Config Operator (MCO) in OpenShift 4.14?

Accepted Answer

Managing operating system configurations, file system changes, and software updates for cluster nodes.. The MCO manages and applies configuration changes to the operating system on control plane and worker nodes, such as updates to system files, certs, and kernel parameters.

Answer

Handling external DNS records and cluster ingress routing.

Answer

Provisioning cloud provider virtual machines for cluster scaling.

Answer

Managing container image registries and secure image signing.

Question 10

An administrator needs to modify the timeout values for the default OpenShift Ingress Controller (Router). Where should this change be applied?

Accepted Answer

Edit the ingresscontroller instance named 'default' in the 'openshift-ingress-operator' namespace.. Ingress controller parameters such as timeouts are configured by editing the IngressController custom resource in the 'openshift-ingress-controller' namespace.

Answer

Edit the proxy resource named 'cluster'.

Answer

Edit the endpoints resource in the 'openshift-ingress' namespace.

Answer

Modify the kube-apiserver configmap.

Question 11

An administrator needs to deploy a containerized web application using a Git repository as the source without writing a Dockerfile. Which OpenShift build strategy should be used?

Accepted Answer

Source-to-Image (S2I) strategy. The Source-to-Image (S2I) build strategy builds reproducible container images from source code without requiring a Dockerfile, injecting the source code into a builder image.

Answer

Docker strategy

Answer

Custom strategy

Answer

Pipeline strategy

Question 12

An administrator wants to pause rollouts on a DeploymentConfig named backend-api to make multiple configuration changes without triggering intermediate builds or rollouts. Which command pauses the rollout?

Accepted Answer

oc rollout pause dc/backend-api. The oc rollout pause command suspends rollout updates on a Deployment or DeploymentConfig.

Answer

oc patch dc/backend-api --type=json -p='[{"op": "add", "path": "/spec/paused", "value": true}]'

Answer

oc suspend dc/backend-api

Answer

oc stop rollout dc/backend-api

Question 13

An administrator needs to perform a canary deployment strategy using standard OpenShift Deployment resources (not DeploymentConfigs). What is the standard Kubernetes/OpenShift native mechanism to route a small percentage of traffic to the canary deployment?

Accepted Answer

Using an OpenShift Route with weighted backend services pointing to stable and canary Services. Standard Deployments do not have native percentage-based traffic splitting; an administrator must use a Service with multiple underlying selector labels alongside a Service Mesh, Ingress controller, or an OpenShift Route with weight configurations pointing to distinct Services. Specifically, OpenShift Routes support splitting traffic via weighted backends across multiple Services.

Answer

Setting the traffic-split annotation on the Deployment resource

Answer

Configuring weight parameters directly in the Deployment spec rollingUpdate strategy

Answer

Enabling canary mode in the ImageStream tag metadata

Question 14

Which TWO fields are mandatory when defining a standard Kubernetes NetworkPolicy object? (Choose TWO)

Accepted Answer

metadata. A NetworkPolicy requires 'apiVersion', 'kind', 'metadata', and 'spec' (with podSelector). From the specific choices, spec.podSelector and metadata are essential.

Answer

spec.ingress

Answer

spec.egress.to.ipBlock

Answer

metadata.namespace

Question 15

During an upgrade of an OpenShift 4.14 cluster using the Cluster Version Operator (CVO), the upgrade status stalls at a specific component. The administrator wants to check the detailed error messages and reconciling loops of the CVO itself. Where should the administrator look?

Accepted Answer

Review the logs of the cluster-version-operator deployment in the openshift-cluster-version namespace.. The Cluster Version Operator runs in the openshift-cluster-version namespace. Its logs provide detailed reconciliation status and errors during cluster upgrades.

Answer

Inspect the clusteroperators object using 'oc describe clusteroperator base-os'.

Answer

Check the cluster-wide events in the default namespace using 'oc get events'.

Answer

Inspect the MachineConfigPool status in the openshift-machine-api namespace.

Question 16

An administrator wants to add a custom CA certificate trust bundle to all worker nodes in an OpenShift 4.14 cluster so that internal container registries can be accessed securely. Which object should the administrator configure?

Accepted Answer

Create a ConfigMap in openshift-config containing the CA certificate and reference it in the cluster image configuration (imageregistry.config.openshift.io).. In OpenShift 4, administrators add custom CA bundles to the cluster-wide proxy or via a ConfigMap targeted by the image config, or by creating a MachineConfig injecting the CA certificate into /etc/pki/ca-trust/source/anchors/.

Answer

Modify the kube-dns ConfigMap to trust external TLS certificates.

Answer

Update the OAuth custom resource with the CA bundle path.

Answer

Restart the cluster proxy service with the '--ca-file' parameter.

Question 17

An administrator needs to create a passthrough Route that preserves client certificates and forwards encrypted traffic directly to the backend pod. Which spec configuration is required?

Accepted Answer

spec:
  tls:
    termination: passthrough. A passthrough route requires setting tls.termination to passthrough.

Answer

spec:
  tls:
    termination: reencrypt

Answer

spec:
  tls:
    termination: edge

Answer

spec:
  tls:
    insecureEdgeTerminationPolicy: Allow

Question 18

An administrator observes that pods in a specific namespace are unable to resolve external domain names (e.g., www.redhat.com) while internal service resolution works perfectly. What is the most likely cause of this issue in CoreDNS configuration?

Accepted Answer

The Corefile in the cluster DNS operator configuration has incorrect or missing forward plugins for external resolvers.. CoreDNS forwards external queries to upstream forwarders (like corporate DNS or public resolvers). If the forwarding block in the Corefile is misconfigured, external resolution fails.

Answer

The API server service is missing endpoint IPs.

Answer

NodePort range exhaustion prevents external DNS packets from traversing worker nodes.

Answer

The cluster ingress controller is blocking external UDP port 53.

Question 19

An administrator is configuring a DeploymentConfig in OpenShift and wants to set up automated triggers for new rollouts. Which TWO trigger types are natively supported in a DeploymentConfig spec? (Choose two.)

Accepted Answer

ConfigChange. DeploymentConfigs support ConfigChange (triggering when the DeploymentConfig template changes) and ImageChange (triggering when a referenced ImageStream tag updates).

Answer

PeriodicTrigger

Answer

WebhookTrigger

Answer

GitTrigger

Question 20

You have modified a set of Kubernetes manifests using Kustomize and want to preview the exact output that will be applied to your OpenShift cluster without actually executing the changes. Which command should you run?

Accepted Answer

oc kustomize .. The 'oc kustomize' command builds the Kustomize overlay and outputs the resulting raw manifests to stdout.

Answer

oc diff -f kustomization.yaml

Answer

oc convert -k .

Answer

oc apply -k . --dry-run=client