EX280 Practice Exam 2 — 20 Questions

Question 1

An administrator is configuring topology-aware storage provisioning. A StorageClass uses volumeBindingMode: WaitForFirstConsumer. When is the PersistentVolume actually created?

Accepted Answer

When the scheduler places the pod referencing the PVC onto a specific worker node.. With volumeBindingMode: WaitForFirstConsumer, the PV is not provisioned when the PVC is created. Instead, the scheduler delays binding until a pod using the PVC is scheduled, so it can pick a node and provision the volume in the correct topology zone. The PV is created at that point, ensuring the volume lands in the same zone as the pod.

Answer

When the PVC object is successfully created in the namespace.

Answer

When the user executes 'oc adm pv create'.

Answer

When the CSI driver operator starts up during cluster bootstrap.

Question 2

An administrator needs to check the status of all MachineSets in an OpenShift 4.14 cluster to see how many worker machines are currently provisioned and running. Which command should be used?

Accepted Answer

oc get machinesets -A (or within openshift-machine-api). MachineSets are the OpenShift 4 resource that manages the desired and current number of machines per availability zone for a pool. Running 'oc get machinesets -A' (or scoped to openshift-machine-api) lists all MachineSets with their desired, current, and ready replica counts, which is exactly what the administrator needs to see how many worker machines are provisioned and running.

Answer

oc adm get machines

Answer

oc get cluster-infrastructure

Answer

oc get machineconfigpools

Question 3

Which command is used to switch the active project context to a namespace named 'staging' in the OpenShift CLI?

Accepted Answer

oc project staging. The `oc project <name>` command is the documented OpenShift CLI method for switching the active project (namespace) context for subsequent commands. It updates the current context in the kubeconfig so that all future `oc` commands target the 'staging' namespace without needing `-n staging`. This is functionally equivalent to `oc config set-context --current --namespace=staging` but is the idiomatic OpenShift shortcut.

Answer

oc config set-namespace staging

Answer

oc use project staging

Answer

oc switch-context staging

Question 4

Which THREE conditions must be met for a NetworkPolicy to successfully allow traffic from another pod? (Choose THREE)

Accepted Answer

If an ingress policy is present, the connection must be explicitly permitted by at least one rule.. Option C is correct because Kubernetes NetworkPolicy is default-deny for ingress once any policy selects the pod: if an ingress policy exists, the connection must be explicitly allowed by at least one ingress rule, otherwise the traffic is dropped. Option D is correct because the policy's ports and protocol fields (e.g., port: 6379, protocol: TCP) must match the actual destination port and L4 protocol of the traffic for the rule to permit it. Option E is correct because the ingress rule's from selectors — podSelector and/or namespaceSelector — must match the source pod's labels and namespace for the connection to be allowed. Option A is wrong because NetworkPolicy enforcement is independent of the number of worker nodes; it depends on a CNI plugin that implements NetworkPolicy (e.g., Calico, Cilium), not cluster size. Option B is wrong because NetworkPolicy operates at the pod/CNI layer inside the cluster and does not require any top-of-rack switch port trunk configuration.

Answer

The cluster must have exactly three worker nodes.

Answer

The physical switch port on the top-of-rack switch must be configured in trunk mode.

Question 5

An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?

Accepted Answer

spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate. For edge termination, the Route's spec.tls section holds the certificate, key, and optional CA certificate as plain string fields (not base64). The router terminates TLS at the edge using these values, then forwards plain HTTP to the pods. The correct fields are spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate.

Answer

spec.endpoint.tls with base64 encoded string data

Answer

metadata.annotations containing openshift.io/tls-cert and openshift.io/tls-key

Answer

status.ingress.tls for automatic cert-manager synchronization

Question 6

An administrator needs to temporarily prevent the Machine Config Operator from applying pending MachineConfig changes to the worker nodes while performing troubleshooting. How should the administrator accomplish this?

Accepted Answer

Patch the worker MachineConfigPool to set 'spec.paused: true'.. Setting 'spec.paused: true' on the worker MachineConfigPool tells the Machine Config Operator to stop rendering and applying new MachineConfigs to that pool. This is the documented, supported way to temporarily halt MCO updates during troubleshooting without deleting configs or disrupting the operator itself. Once troubleshooting is complete, setting 'paused: false' resumes normal reconciliation.

Answer

Delete all pending MachineConfig objects from the cluster.

Answer

Scale down the machine-config-operator deployment in openshift-machine-config-operator to zero replicas.

Answer

Annotate all worker nodes with 'machineconfiguration.openshift.io/paused=true'.

Question 7

Which THREE items can be inspected using 'oc describe' when troubleshooting a failing storage attachment in OpenShift?

Accepted Answer

The PersistentVolumeClaim (to check binding status and provisioner errors). Option B is correct because 'oc describe pvc ' shows the PersistentVolumeClaim's status, bound volume, and provisioner-related events, which directly reveal binding failures or dynamic provisioning errors during a storage attachment problem. Option C is correct because 'oc describe pod ' surfaces scheduling decisions and volume mount events (such as FailedMount or FailedAttachVolume), pinpointing why a pod cannot attach or mount its storage. Option E is correct because 'oc describe pv ' reports the PersistentVolume's status, claim reference, reclaim policy, and node affinity/attachment details, helping verify whether the volume is available and attachable to the target node. Option A is not applicable because the cluster image registry configuration is inspected via registry operator resources or configs (for example 'oc get configs.imageregistry.operator.openshift.io'), not as a storage attachment object. Option D is not applicable because OAuth client credentials are stored in a Secret and relate to authentication, not to diagnosing storage attachment failures.

Answer

The cluster image registry configuration

Answer

The OAuth client credentials secret

Question 8

Which resource represents the physical or cloud storage provisioned in the cluster by an administrator, independent of any user namespace claims?

Accepted Answer

PersistentVolume. A PersistentVolume (PV) is the cluster-scoped resource that represents actual storage provisioned by an administrator — an NFS export, EBS volume, or Ceph RBD image — and exists independently of any namespace. It is bound to a PersistentVolumeClaim (PVC) when a user requests storage, but the PV itself is not owned by or scoped to a user namespace.

Answer

StorageClass

Answer

PersistentVolumeClaim

Answer

PodVolume

Question 9

How do you define a health check that verifies if your application is ready to start receiving traffic?

Accepted Answer

ReadinessProbe. A ReadinessProbe determines whether a container is ready to accept traffic. If the probe fails, the pod is removed from the Service's endpoints, so no traffic is routed to it until the probe succeeds. This directly matches the requirement of verifying readiness to receive traffic.

Answer

StartupProbe

Answer

LivenessProbe

Answer

HealthProbe

Question 10

Which TWO of the following conditions must be met for a ServiceAccount from 'namespace-a' to successfully access API resources in 'namespace-b'? (Choose TWO)

Accepted Answer

A RoleBinding must exist in 'namespace-b' referencing the ServiceAccount as 'system:serviceaccount:namespace-a:sa-name'.. Option C is correct because Kubernetes RBAC bindings are namespaced: to grant a ServiceAccount from namespace-a permissions in namespace-b, a RoleBinding must be created in namespace-b that references the subject as 'system:serviceaccount:namespace-a:sa-name'. Option E is correct because the RoleBinding only associates the subject with permissions; the actual API verb permissions (get, list, watch, create, etc.) on the target resources must be defined in a Role (namespaced) or ClusterRole that the binding references. Option A is incorrect because LimitRange objects only enforce resource quota defaults/limits on pods and containers and have no bearing on RBAC authorization. Option B is incorrect because Kubernetes RBAC has no 'administrative override annotation' mechanism for namespaces; access is governed solely by Roles/ClusterRoles and their bindings. Option D is incorrect because cluster-admin is not required and would be excessive; a namespaced Role plus RoleBinding in namespace-b is sufficient and follows least privilege.

Answer

The source namespace must disable its LimitRange objects.

Answer

An administrative override annotation must be placed on the target namespace.

Answer

The ServiceAccount must be granted cluster-admin rights cluster-wide.

Question 11

Which component in OpenShift 4.14 serves as the API entry point for managing MachineAPI resources like Machines and MachineSets?

Accepted Answer

Machine API Operator. The Machine API Operator is the component that manages the lifecycle of MachineAPI resources such as Machines, MachineSets, and MachineHealthChecks. It deploys and reconciles the machine-api controllers and CRDs, making it the API entry point for cluster node provisioning in OpenShift 4.

Answer

Cluster Version Operator

Answer

Machine Config Operator

Answer

Operator Lifecycle Manager

Question 12

An administrator wants to check the logs of the Cluster Version Operator to see why an upgrade failed. In which namespace does the CVO run?

Accepted Answer

openshift-cluster-version. The Cluster Version Operator (CVO) runs in the 'openshift-cluster-version' namespace, where it reconciles the ClusterVersion resource and manages cluster upgrades. To diagnose a failed upgrade, an administrator inspects the CVO pod logs in that namespace. This is the canonical location in OpenShift 4 for all cluster version and upgrade activity.

Answer

openshift-operator-lifecycle-manager

Answer

openshift-config-operator

Answer

kube-system

Question 13

Which TWO pieces of information are needed when defining a new Helm repository?

Accepted Answer

Repository Name. When defining a new Helm repository, the two required pieces of information are the repository name (option D) and the repository URL (option E). The repository name (D) serves as the local alias used by Helm commands such as `helm repo add `, allowing you to reference the repo later (e.g., `helm install mychart /`). The repository URL (E) is the actual endpoint where the `index.yaml` and chart packages are hosted, which Helm fetches to resolve and download charts. A chart version (A) is not needed to define a repository; it is specified later when installing or pulling a specific chart. A username (B) is only required for private repositories that enforce authentication, not for defining a repository in general. A namespace (C) is a Kubernetes concept used at install time to scope resources, not part of a Helm repository definition.

Answer

Chart version

Answer

Username

Answer

Namespace

Question 14

A cluster administrator wants to create a VolumeSnapshot of a database PVC. Which API group must the VolumeSnapshotClass belong to?

Accepted Answer

snapshot.storage.k8s.io. VolumeSnapshotClass resources are part of the Kubernetes CSI snapshot API group 'snapshot.storage.k8s.io'. This API group defines the VolumeSnapshot, VolumeSnapshotContent, and VolumeSnapshotClass custom resources. Therefore, the VolumeSnapshotClass must belong to this API group to be recognized by the CSI snapshot controller.

Answer

storage.k8s.io

Answer

csi.storage.k8s.io

Answer

volumesnapshot.openshift.io

Question 15

An administrator is diagnosing why an authentication token exchange is failing for cluster users. Which THREE sources provide relevant error logs and status information? (Choose THREE)

Accepted Answer

oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>. Option B is correct because the kube-apiserver logs in the openshift-kube-apiserver namespace record authentication and token exchange activity, including OAuth token review and authentication errors, making them a primary source for diagnosing token exchange failures. Option D is correct because 'oc describe clusteroperator authentication' shows the status, conditions, and messages of the authentication ClusterOperator, which reveal whether the OAuth server and related authentication components are degraded or failing. Option E is correct because the oauth-openshift deployment in the openshift-authentication namespace runs the OpenShift OAuth server that issues and exchanges tokens, so its logs directly capture token exchange errors. Option A is not relevant because the ingress-operator logs concern ingress controller management, not authentication token exchange. Option C is not relevant because listing namespaces only shows namespace existence and status, providing no authentication error details.

Answer

oc logs -n openshift-ingress-operator deployment/ingress-operator

Answer

oc get namespaces

Question 16

During a troubleshooting session on a degraded cluster operator, an administrator finds that the operator's operand configuration is controlled by a Custom Resource (CR). Where is the most reliable place to look for error status messages reported by the operator controller loop regarding this CR?

Accepted Answer

The status field of the specific Custom Resource instance (e.g., 'oc get

-o yaml').. Operator controllers reconcile a Custom Resource and write observed state, conditions, and error messages back into the CR's status field. The most reliable place to see controller-reported errors is the status subresource of that specific CR instance, typically viewed with 'oc get

-o yaml'. This reflects the controller's own view of the operand's health and any reconciliation failures.

Answer

The default Kubernetes events in the default namespace.

Answer

The global clusterversion object status conditions.

Answer

The /var/log/messages file on the master nodes.

Question 17

A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?

Accepted Answer

oc auth can-i create pods -n target-ns. The 'oc auth can-i' command is the OpenShift-native way to perform a SelfSubjectAccessReview against the API server, returning yes or no for a specific verb/resource combination. Adding '-n target-ns' scopes the check to the target namespace, so the developer can verify whether their current service account or user can create pods there. This is the exact command documented for permission troubleshooting in OpenShift.

Answer

oc get rolebindings -n target-ns --user=self

Answer

oc check-permission create pods -n target-ns

Answer

oc describe authorization -n target-ns

Question 18

Which command allows you to view the logs of a specific build?

Accepted Answer

oc logs build/[build-name]. The `oc logs` command can target a build object directly by using the `build/[build-name]` syntax, which streams the logs from the build pod that OpenShift creates for that build. This is the canonical way to inspect build output without first looking up the generated pod name. The build name is the value shown in `oc get builds` output.

Answer

oc get build

Answer

oc describe build

Answer

oc logs [pod-name]

Question 19

Which TWO of the following are valid volume modes supported by PersistentVolumes and PersistentVolumeClaims in OpenShift?

Accepted Answer

Block. In OpenShift/Kubernetes, the PersistentVolume spec.volumeMode field accepts exactly two values: Block and Filesystem. Option B (Block) is correct because a PV/PVC with volumeMode: Block exposes the volume as a raw block device with no filesystem, which is required for workloads like databases that manage their own storage layout. Option D (Filesystem) is correct because it is the default volumeMode, where the volume is formatted with a filesystem and mounted into a directory inside the pod. Options A (Object), C (Database), and E (Stream) are not valid volumeMode values — they are not recognized by the Kubernetes/OpenShift API for PersistentVolumes or PersistentVolumeClaims, so they would be rejected.

Answer

Object

Answer

Database

Answer

Stream

Question 20

An OpenShift 4.14 cluster administrator has installed an Operator from OperatorHub into a custom namespace using a Subscription. The administrator notices that the Operator pod is not being created. Upon checking the Subscription, the installation mode is set to AllNamespaces, but the Operator target namespace is restricted. Which Operator Lifecycle Manager (OLM) object should the administrator inspect to troubleshoot why the CSV (ClusterServiceVersion) is not installing?

Accepted Answer

Inspect the OperatorGroup in the target namespace to ensure its targetNamespaces match or support the Subscription scope.. The OperatorGroup defines the target namespaces that an Operator can watch and install into. When a Subscription uses AllNamespaces mode but the OperatorGroup restricts targetNamespaces, OLM cannot reconcile the CSV into the desired scope, so the Operator pod never gets created. Inspecting the OperatorGroup in the target namespace reveals the mismatch.

Answer

Check the MachineConfigPool for paused reconciliation flags.

Answer

Review the ClusterVersion resource status for pending updates.

Answer

Inspect the KubeletConfig custom resource for validation errors.