EX280 Practice Exam 1 — 20 Questions

Question 1

What is the primary function of a MachineSet in an OpenShift 4.14 cluster running on a cloud provider?

Accepted Answer

To ensure a specified number of identical machine instances are running and healthy.. A MachineSet's primary function is to maintain a declared number of identical Machine objects (and therefore Nodes) in an OpenShift 4 cluster. It is the cloud-provider-aware controller that reconciles desired replica count with actual running instances, replacing failed or deleted machines automatically.

Answer

To load balance ingress traffic across worker nodes.

Answer

To manage persistent volume claims across storage backends.

Answer

To group cluster nodes by operating system kernel version.

Question 2

Which TWO of the following actions occur when a user is deleted from an OpenShift cluster using 'oc delete user <username>'? (Choose TWO)

Accepted Answer

The User resource object is removed from the cluster database.. Option A is correct because 'oc delete user <username>' removes the User resource object itself from etcd, the cluster's backing datastore, so the user no longer exists as an OpenShift API object. Option D is correct because deleting the User triggers revocation of that user's OAuth access tokens and refresh tokens, invalidating existing sessions so the identity can no longer authenticate. Option B is wrong because OpenShift does not write back to external identity providers; LDAP or OIDC records are managed outside the cluster and are untouched. Option C is wrong because namespaces are independent resources and are not garbage-collected when a user is deleted. Option E is wrong because RoleBindings and ClusterRoleBindings are not automatically removed; they may remain and reference a now-nonexistent user until manually cleaned up.

Answer

External identity provider records are automatically deleted from LDAP or OIDC servers.

Answer

All namespaces owned or created by the user are permanently deleted.

Answer

All RoleBindings and ClusterRoleBindings referencing the user are automatically deleted.

Question 3

An administrator observes that pods in a specific namespace are unable to resolve external domain names (e.g., www.redhat.com) while internal service resolution works perfectly. What is the most likely cause of this issue in CoreDNS configuration?

Accepted Answer

The Corefile in the cluster DNS operator configuration has incorrect or missing forward plugins for external resolvers.. CoreDNS handles all DNS resolution in OpenShift, and its behavior is driven by the Corefile managed by the DNS Operator. Internal service names resolve via the kubernetes plugin, but external names like www.redhat.com require the forward plugin pointing to upstream resolvers (e.g., /etc/resolv.conf or explicit IPs). If the forward plugin is missing or misconfigured, internal resolution still works while external lookups fail with SERVFAIL or NXDOMAIN.

Answer

The API server service is missing endpoint IPs.

Answer

NodePort range exhaustion prevents external DNS packets from traversing worker nodes.

Answer

The cluster ingress controller is blocking external UDP port 53.

Question 4

Which command is used to start a new build from an existing BuildConfig named 'frontend'?

Accepted Answer

oc start-build frontend. oc start-build frontend is the correct command to trigger a new build from an existing BuildConfig named 'frontend'. It creates a new Build object, which the build controller then executes according to the BuildConfig's strategy (Source, Docker, or Custom).

Answer

oc trigger-build frontend

Answer

oc run-build frontend

Answer

oc build frontend

Question 5

Which THREE of the following are required when configuring an OIDC identity provider?

Accepted Answer

Client Secret reference. When configuring an OIDC identity provider, the Client ID (C) is required because it uniquely identifies the relying party/application to the OpenID Provider during the authorization code flow. The Client Secret reference (A) is also required so the application can authenticate itself to the token endpoint and securely exchange the authorization code for tokens. The Issuer URL (E) is required because it identifies the OpenID Provider's metadata document (typically at /.well-known/openid-configuration), enabling discovery of endpoints such as authorization_endpoint, token_endpoint, and jwks_uri. The Htpasswd file path (B) is not part of OIDC; it belongs to HTTP Basic authentication using a local password file. The LDAP bind password (D) is also unrelated to OIDC, as it is used for LDAP directory authentication, not for OpenID Connect token exchange.

Answer

Htpasswd file path

Answer

LDAP bind password

Question 6

An administrator needs to provision a new user named 'sarah' using the HTPasswd identity provider. After updating the htpasswd file and secret, Sarah logs in successfully. What command should the administrator run to verify that OpenShift has successfully created the corresponding User object for Sarah?

Accepted Answer

oc get user sarah. When an HTPasswd identity provider authenticates a user for the first time, OpenShift automatically creates a User object whose name matches the username supplied in the htpasswd file. The correct command to confirm this is `oc get user sarah`, which queries the cluster-scoped User resource. This verifies that the identity provider successfully mapped the login to a User object.

Answer

oc get account sarah

Answer

oc get identity htp:sarah

Answer

oc describe htpasswd-user sarah

Question 7

An administrator is configuring a DeploymentConfig in OpenShift and wants to set up automated triggers for new rollouts. Which TWO trigger types are natively supported in a DeploymentConfig spec? (Choose two.)

Accepted Answer

ConfigChange. DeploymentConfigs support ConfigChange (triggering when the DeploymentConfig template changes) and ImageChange (triggering when a referenced ImageStream tag updates).

Answer

PeriodicTrigger

Answer

WebhookTrigger

Answer

GitTrigger

Question 8

You need to provide temporary scratch space for a container that shares the pod's lifetime and is cleared when the pod is deleted. Which volume type should you configure in the Pod specification?

Accepted Answer

emptyDir. An emptyDir volume is created when a pod is assigned to a node and exists for the lifetime of that pod. It is initially empty, provides scratch space for the container, and is deleted permanently when the pod is removed from the node. This exactly matches the requirement for temporary, pod-lifetime scratch space.

Answer

persistentVolumeClaim

Answer

hostPath

Answer

nfs

Question 9

You want to trigger a new build automatically whenever the base image in an ImageStream changes. What must be enabled in the BuildConfig?

Accepted Answer

ImageChange trigger. The ImageChange trigger in a BuildConfig watches a specified ImageStream tag and starts a new build whenever that tag's image digest changes. This is the mechanism used to rebuild an application automatically when its base image (e.g., a builder image or a parent image) is updated. Configuring an ImageChange trigger with the base ImageStream as the source enables this behavior.

Answer

Continuous Deployment trigger

Answer

WebHook trigger

Answer

ConfigChange trigger

Question 10

What is the purpose of the 'postCommit' hook in a BuildConfig?

Accepted Answer

To run tests on the image. The 'postCommit' hook in an OpenShift BuildConfig is designed to execute a command inside a temporary container created from the newly built image, immediately after the build completes and the image is committed. This is specifically intended for running tests, such as unit tests or integration tests, to validate the image's functionality before it is pushed or deployed. It does not notify external systems, push images, or restart deployments; those are handled by other mechanisms like webhooks, push secrets, or deployment triggers.

Answer

To notify an external system

Answer

To push the image to an external registry

Answer

To restart the Deployment

Question 11

An administrator needs to restrict ingress traffic to pods in the 'frontend' namespace so that only pods labeled role=api in the 'backend' namespace can connect on TCP port 8080. All other traffic must be denied. Which NetworkPolicy configuration achieves this?

Accepted Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web, ingress from namespaceSelector matching name=backend and podSelector matching role=api, and ports TCP 8080.. A NetworkPolicy must be created in the namespace of the pods it protects (frontend) and use podSelector to select those pods. The ingress rule must combine namespaceSelector and podSelector to allow only pods in backend with role=api, and specify the port TCP 8080. Once any policy selects the frontend pods, all other ingress is denied by default.

Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web and ingress from ipBlock 10.0.0.0/8 on TCP 8080.

Answer

A NetworkPolicy in the backend namespace with podSelector matching role=api and egress to namespaceSelector matching name=frontend and port TCP 8080.

Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web and ingress from namespaceSelector matching name=backend without specifying ports.

Question 12

An administrator notices that a worker node is in a 'NotReady' state due to a storage failure. The administrator successfully replaces the underlying physical machine and wants to clear the old node object from the OpenShift 4.14 cluster. Which command should be used?

Accepted Answer

oc delete node worker-old. To remove a node object from an OpenShift cluster, the correct command is `oc delete node <node-name>`. This deletes the Node resource from the cluster, and if the node is managed by a MachineSet, the Machine object may also be deleted or replaced. In this scenario, the administrator has already replaced the physical machine, so deleting the old node object is appropriate.

Answer

oc adm cordon worker-old --purge

Answer

oc patch machine worker-old --type=merge -p '{"spec":{"deleted":true}}'

Answer

oc remove node-status worker-old

Question 13

You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?

Accepted Answer

oc auth can-i list deployments --as=system:serviceaccount:ci-cd:cicd-bot -n ci-cd. `oc auth can-i` performs a SubjectAccessReview against the OpenShift API server, and the `--as=system:serviceaccount::` flag impersonates the service account so the answer reflects that SA's effective RBAC permissions rather than the current user's. Adding `-n ci-cd` scopes the check to the ci-cd namespace, which is required because RoleBindings are namespace-scoped. This is the canonical way to verify whether a specific SA can perform a verb on a resource.

Answer

oc adm policy who-can get deployments -n ci-cd

Answer

oc describe serviceaccount cicd-bot -n ci-cd

Answer

oc get rolebindings --serviceaccount=cicd-bot

Question 14

What is the primary difference between PersistentVolumes (PVs) and PersistentVolumeClaims (PVCs)?

Accepted Answer

PVs represent actual cluster storage resources, while PVCs represent user requests for storage.. PersistentVolumes (PVs) are cluster-level storage objects that represent the actual backing storage (NFS, iSCSI, cloud disk, etc.) provisioned by an admin or dynamically by a StorageClass. PersistentVolumeClaims (PVCs) are namespace-scoped requests from a user/pod for a certain size and access mode, which the control plane binds to a matching PV. This separation of 'supply' (PV) from 'demand' (PVC) is the core abstraction in Kubernetes/OpenShift storage.

Answer

PVs only support block mode, while PVCs only support filesystem mode.

Answer

PVs are created by developers, while PVCs are created by cluster administrators.

Answer

PVs are namespace-scoped, while PVCs are cluster-scoped.

Question 15

An OpenShift administrator needs to allow users to expand the storage capacity of existing PersistentVolumeClaims without restarting their applications. Which action must be taken first to enable this capability?

Accepted Answer

Edit the StorageClass to set allowVolumeExpansion: true.. Online volume expansion in Kubernetes/OpenShift is gated by the StorageClass field allowVolumeExpansion. Until that field is set to true on the StorageClass backing the PVC, the API server will reject any attempt to increase the PVC's requested storage, so it must be enabled first.

Answer

Restart the csi-provisioner controller deployment in the openshift-cluster-storage-operator namespace.

Answer

Add the expansion-enabled annotation directly to each active Pod object.

Answer

Convert all existing static PersistentVolumes into dynamically provisioned volumes.

Question 16

An administrator wants to check why a specific MachineConfigPool is taking a long time to complete an update. Which status condition on the MachineConfigPool indicates that nodes are currently being updated?

Accepted Answer

Updating=True. The MachineConfigPool (MCP) status includes a condition of type 'Updating'. When this condition's status is 'True', it explicitly indicates that the pool is actively applying configuration changes to its nodes. This is the standard condition used by the Machine Config Operator (MCO) to signal that an update is in progress. Therefore, option A is correct.

Answer

RollingOut=Running

Answer

Reconciling=Pending

Answer

Progressing=Active

Question 17

An OpenShift cluster upgrade has failed because a MachineConfigPool is degraded. Which THREE actions or commands can an administrator perform to diagnose the root cause of the MachineConfigPool degradation? (Choose THREE)

Accepted Answer

oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon. Option E is correct because `oc describe machineconfigpool ` shows the pool's status conditions, including Degraded, Updated, Updating, and the reason/message fields that identify why the pool is degraded. Option C is correct because listing MachineConfigs with the label `machineconfiguration.openshift.io/role=` shows the rendered and role-specific configs applied to that pool, helping spot a bad or mismatched MachineConfig. Option A is correct because `oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon` retrieves the Machine Config Daemon logs, where the actual node-level failure (e.g., failed systemd unit, file write, or reboot issue) is recorded. Option B is wrong because scaling the cluster-version-operator deployment does not diagnose a degraded MachineConfigPool and is not a supported troubleshooting step. Option D is wrong because `oc adm upgrade cancel` only cancels an in-progress cluster upgrade and does not reveal the root cause of the MachineConfigPool degradation.

Answer

oc scale deployment/cluster-version-operator --replicas=3

Answer

oc adm upgrade cancel

Question 18

Which THREE parameters or fields are valid when configuring a StorageClass object in OpenShift 4.14+?

Accepted Answer

provisioner. Option B (provisioner) is correct because every StorageClass must specify the provisioner field, which identifies the volume plugin (e.g., kubernetes.io/aws-ebs, ebs.csi.aws.com, or kubernetes.io/no-provisioner) used to dynamically provision PersistentVolumes. Option C (volumeBindingMode) is correct because it is a valid StorageClass field that controls when volume binding and dynamic provisioning occur, with supported values Immediate and WaitForFirstConsumer. Option E (reclaimPolicy) is correct because StorageClass supports the reclaimPolicy field to define the default PersistentVolume reclaim behavior for dynamically provisioned volumes, with valid values Delete and Retain. Option A (containerRuntime) is not a StorageClass parameter; it relates to container runtime configuration (e.g., CRI-O) and is not part of the storage.k8s.io/v1 StorageClass schema. Option D (nodeSelector) is not a StorageClass field; node selection for storage is handled via allowedTopologies or in PersistentVolume nodeAffinity, not a nodeSelector key on StorageClass.

Answer

containerRuntime

Answer

nodeSelector

Question 19

When creating a custom SCC, what is the best practice for assigning it to users?

Accepted Answer

Bind the SCC to a specific service account in a specific namespace. Binding a custom SCC to a specific service account in a specific namespace follows the principle of least privilege and is the OpenShift best practice. SCCs are applied to service accounts (or users/groups) via RBAC role bindings, and scoping to a specific service account in a specific namespace ensures the elevated permissions are granted only where needed, minimizing the blast radius of a compromised pod.

Answer

Bind the SCC to the 'cluster-admin' user

Answer

Bind the SCC to the 'system:authenticated' group

Answer

Assign the SCC to the namespace object directly

Question 20

An administrator needs to troubleshoot why an OLM (Operator Lifecycle Manager) managed operator installation is failing. Which THREE resources should be inspected? (Choose THREE)

Accepted Answer

oc get subscription . Option A, `oc get subscription `, is correct because the Subscription is the OLM resource that declares which operator and channel to install and records the resolution state, so its status reveals whether the operator was resolved and any resolution failures. Option B, `oc get installplan`, is correct because the InstallPlan is generated by OLM to enumerate the CSVs and approval requirements needed to install or upgrade an operator, and its status shows whether the plan is pending approval or has failed to execute. Option E, `oc get csv`, is correct because the ClusterServiceVersion represents the actual running operator deployment and its status/phase (e.g., Failed, Pending) exposes installation errors such as unmet dependencies or failed deployments. Option C, `oc get routes`, is not relevant because Routes only expose services externally and are not part of the OLM installation pipeline. Option D, `oc get pv`, is not relevant because PersistentVolumes relate to storage provisioning and are not OLM installation resources unless a specific storage issue is already suspected.

Answer

oc get routes

Answer

oc get pv