EX280 Practice Exam 2 — 20 Questions

Question 1

A production Deployment using the Rolling update strategy is failing its readiness probe during a rollout, causing the update to block and eventually time out. You need to inspect the reason for the rollout failure using the OpenShift CLI without deleting the failing pods immediately. Which oc command provides the most direct diagnostic information regarding the rollout status and blockage reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

oc rollout status deployment/<deployment-name>. The 'oc rollout status' command monitors the progress of a deployment and provides direct feedback on why a rollout is blocked.

Answer

oc get events --sort-by='.metadata.creationTimestamp'

Answer

oc describe deployment <deployment-name>

Answer

oc debug deployment/<deployment-name>

Question 2

An administrator needs to create a Service of type ClusterIP that exposes an application running on port 8080 inside the container, mapping it to port 80 on the Service. Which command should the administrator use?

Accepted Answer

oc expose pod frontend --port=80 --target-port=8080 --type=ClusterIP. The oc expose service or oc create service command correctly maps the targetPort inside the container to the service port using the syntax --port=80 --target-port=8080.

Answer

oc create service clusterip frontend --tcp=80:8080

Answer

oc create service clusterip frontend --port=80 --port=8080

Answer

oc expose deployment frontend --port=8080 --target-port=80

Question 3

A developer wants to track multiple versions and tags of container images within an OpenShift cluster efficiently. Which OpenShift resource provides this capability?

Accepted Answer

ImageStream. ImageStreams allow developers to combine and track multiple versions of container images through tags without needing to manage the raw registry image references directly.

Answer

Route

Answer

DeploymentConfig

Answer

BuildConfig

Question 4

Which THREE of the following mechanisms can be used to automatically trigger a new build in an OpenShift BuildConfig? (Choose three.)

Accepted Answer

ImageChange trigger. BuildConfigs support webhook triggers (GitHub, Generic), image change triggers (when a base image updates), and configuration change triggers (when the BuildConfig itself changes).

Answer

Route health-check trigger

Answer

CronJob schedule trigger

Question 5

You want to automate the application lifecycle so that every time a code change is pushed, the build and deployment occur automatically. Which combination of features should you use?

Accepted Answer

BuildConfig Webhook and ImageStream triggers. A GitHub webhook combined with ImageStream triggers creates a fully automated pipeline from code commit to deployment.

Answer

Only cron jobs

Answer

Manual build and manual rollout

Answer

DeploymentConfigs only

Question 6

An OpenShift cluster administrator needs to ensure that custom S2I builder images stored in an insecure internal registry can be successfully pulled by build pods without failing TLS verification. Where must the insecure registry be defined?

Accepted Answer

In the cluster Image resource configuration (imageregistry.config.openshift.io/cluster or image.config.openshift.io). Insecure registries must be configured in the cluster-wide Image.config.openshift.io/cluster resource (or registry configuration) so the container runtime and build machinery trust the registry.

Answer

In the OAuth client definition

Answer

In the individual BuildConfig strategy environment variables

Answer

In the Project request template metadata

Question 7

You need to perform a canary deployment by shifting traffic between two versions of your app. What is the standard way to accomplish this in OpenShift without using a Service Mesh?

Accepted Answer

Use Route weights. By adjusting the weights of the 'alternate backends' in a Route, you can control traffic splitting.

Answer

Create two separate Routes

Answer

Modify the Deployment strategy

Answer

Use the 'oc scale' command

Question 8

An administrator created a Route but external clients receive a 503 Service Unavailable error when attempting to access it. Upon checking the endpoints of the Service referenced by the Route, the administrator discovers there are zero endpoints listed. What is the most likely cause?

Accepted Answer

The Service selector labels do not match any active Pod labels.. A 503 error with zero endpoints typically indicates that the selector in the Service definition does not match the labels on any running pods.

Answer

The Route YAML has an invalid TLS certificate format.

Answer

The Ingress controller pods have crashed across all worker nodes.

Answer

The cluster DNS operator is degraded.

Question 9

An ImageStream named 'frontend' in a project contains multiple tags, including 'latest' and 'v1.0'. You want to update an existing Deployment to specifically use the 'v1.0' tag of this ImageStream. Where must this reference be updated in the Deployment specification?

Accepted Answer

In the spec.template.spec.containers[].image field pointing to image-registry.openshift-image-registry.svc:5000/namespace/frontend:v1.0.. ImageStreamTags or ImageStreamImages are referenced inside the container image field within the pod template of a Deployment.

Answer

In the spec.imageStreamRef field.

Answer

In the metadata.annotations['openshift.io/image.in-cluster'] field.

Answer

In the spec.strategy.rollingUpdate.image field.

Question 10

You want to trigger a new build automatically whenever the base image in an ImageStream changes. What must be enabled in the BuildConfig?

Accepted Answer

ImageChange trigger. An ImageChange trigger allows the BuildConfig to react to changes in a specific ImageStreamTag.

Answer

Continuous Deployment trigger

Answer

WebHook trigger

Answer

ConfigChange trigger

Question 11

Which tool would you use to package an application including its dependencies and configuration for easy distribution in OpenShift?

Accepted Answer

Helm. Helm is the standard package manager for Kubernetes and OpenShift applications.

Answer

oc build

Answer

Kustomize

Answer

S2I

Question 12

You need to ensure that your application deployment always maintains at least 80% of its desired pod count during a rolling update. Which strategy parameter should you configure?

Accepted Answer

maxUnavailable: 20%. The maxUnavailable parameter defines the maximum number of pods that can be unavailable during the update process. Setting this to 20% ensures 80% availability.

Answer

minReadySeconds: 20

Answer

maxSurge: 20%

Answer

rollingUpdatePeriod: 20%

Question 13

What is the result of using a 'Recreate' strategy during a deployment?

Accepted Answer

Temporary service outage. The Recreate strategy terminates all existing instances before creating any new ones, resulting in a temporary service outage.

Answer

Zero downtime deployment

Answer

Rolling update

Answer

Instant switch

Question 14

An administrator notices that pods on different worker nodes cannot communicate with each other. Upon checking the cluster network operator, it appears the MTU settings between the underlying physical network and the cluster overlay network mismatch. Which OpenShift command checks the cluster network operator status?

Accepted Answer

oc get clusteroperator network. The ClusterNetworkOperator status can be verified by inspecting the operator resource cluster/network.

Answer

oc get cni cluster

Answer

oc describe networkconfig

Answer

oc get nodes --show-mtu

Question 15

An OpenShift administrator needs to inspect how OVN-Kubernetes handles network flows and packet drops on a specific node. Which debugging utility installed in the OVN node container is most effective for viewing OpenFlow rules?

Accepted Answer

ovs-ofctl. ovs-ofctl is used to inspect and manipulate OpenFlow rules in Open vSwitch bridges, which underpin OVN-Kubernetes data paths.

Answer

nmcli connection show

Answer

ethtool -S

Answer

ovn-trace

Question 16

When configuring a custom build strategy, where do you define the Dockerfile to use?

Accepted Answer

In the strategy block of the BuildConfig. In the BuildConfig, under the 'strategy' block, you can specify the Dockerfile context or explicitly define the Dockerfile source.

Answer

In the DeploymentConfig

Answer

In the Build object

Answer

In the ImageStream

Question 17

You have a build that fails because it requires access to a private repository. What is the correct way to provide credentials to the build?

Accepted Answer

Associate a secret with the BuildConfig. You can add a Secret to the BuildConfig that contains the credentials for the private repository.

Answer

Hardcode credentials in the Dockerfile

Answer

Use an environment variable in the deployment

Answer

Mount a ConfigMap

Question 18

An administrator needs to configure a custom default certificate for all routes created in the cluster without specifying a certificate on every individual Route object. Where should this wildcard certificate be configured?

Accepted Answer

In the IngressController resource named 'default' in openshift-ingress-operator. The default certificate for routes is configured in the IngressController custom resource under the 'defaultCertificate' spec.

Answer

In a ConfigMap named 'router-certs' in the default namespace

Answer

In the apiserver.config.openshift.io cluster object

Answer

In the DNS cluster operator configuration

Question 19

Which THREE components are part of a Kustomize configuration?

Accepted Answer

kustomization.yaml. Kustomize uses resources, patches, and a kustomization file to manage deployment overrides.

Answer

BuildConfigs

Answer

Helm Charts

Question 20

An administrator wants to expose a Deployment via a NodePort service. What is the default port range allocated for NodePort services in OpenShift if not explicitly configured otherwise?

Accepted Answer

30000-32767. Kubernetes and OpenShift allocate NodePort services within the standard port range of 30000-32767.

Answer

1024-65535

Answer

80-443

Answer

8000-9000