EX280 Practice Exam 3 — 20 Questions

Question 1

Which OpenShift resource defines the desired state of a containerized application, including replica count and image version?

Accepted Answer

Deployment. A Deployment (or DeploymentConfig) object defines the desired state of the pods.

Answer

Pod

Answer

ImageStream

Answer

Service

Question 2

An OpenShift administrator needs to restrict access so that pods in namespace 'dev' cannot initiate any outbound connections to pods in namespace 'secure-db'. Which resource should be created in namespace 'secure-db' to achieve this?

Accepted Answer

A NetworkPolicy with an empty ingress rule set in namespace 'secure-db'. A NetworkPolicy with ingress rules applied in the destination namespace ('secure-db') controls which sources are allowed to connect to it.

Answer

A NetworkPolicy blocking egress in namespace 'dev'

Answer

A ClusterNetwork policy blocking all cross-namespace traffic cluster-wide

Answer

An EgressFirewall object in namespace 'dev'

Question 3

An administrator needs to modify the default Ingress controller configuration to change its replica count and adjust the router deployment parameters. Which resource should the administrator edit?

Accepted Answer

ingresscontroller.operator.openshift.io named 'default'. The default Ingress controller is managed by the Ingress operator via the 'default' Ingress resource in the operator.openshift.io API group.

Answer

deployment named router-default in openshift-ingress namespace

Answer

configmap named router-config in openshift-ingress-operator

Answer

service named router-default-http in openshift-ingress

Question 4

An OpenShift administrator needs to expose an internal web application securely using a Route that terminates TLS at the router. Which Route type and configuration requires the administrator to provide the certificate, private key, and CA certificate?

Accepted Answer

Edge TLS termination. Edge termination terminates TLS at the Ingress controller/router and requires the user to supply the TLS certificate and key in the Route specification.

Answer

Re-encrypt TLS termination

Answer

Unsecured Route with an external proxy

Answer

Insecure plain HTTP route

Answer

Passthrough TLS termination

Question 5

An OpenShift cluster is configured with a custom Cluster Network CIDR. An administrator needs to verify the cluster network subnet settings and host subnet assignments. Which operator status or configuration resource contains this cluster-wide network configuration?

Accepted Answer

networks.config.openshift.io named 'cluster'. The networks.config.openshift.io cluster singleton resource holds the cluster network, service network, and CNI provider configuration.

Answer

network.operator.openshift.io named 'default'

Answer

cluster-network.openshift.io

Answer

sdn.openshift.io/config

Question 6

An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?

Accepted Answer

Via the /etc/resolv.conf file automatically managed inside the pod container. Kubernetes automatically injects the nameserver configuration into the /etc/resolv.conf file of every container based on the cluster DNS configuration.

Answer

By querying the OpenShift API server directly on port 6443 for DNS records

Answer

Through an environment variable named CLUSTER_DNS injected into every container

Answer

By parsing the /etc/hosts file updated dynamically by the OpenShift SDN controller

Question 7

An administrator needs to identify worker nodes that require attention during an upgrade or maintenance. Which TWO conditions or states on a node object indicate potential issues or special maintenance states? (Choose TWO)

Accepted Answer

SchedulingDisabled. SchedulingDisabled (cordoned) and NotReady indicate maintenance or health issues on nodes.

Answer

Running=Normal

Answer

Active=True

Answer

Schedulable=True

Question 8

An administrator needs to test internal cluster DNS resolution from a temporary troubleshooting pod. Which command creates a temporary pod with the 'dig' utility installed for DNS debugging?

Accepted Answer

oc run dns-test --rm -it --image=registry.redhat.io/rhel9/support-tools --command -- bash. The 'oc debug' command or running a temporary debug pod using 'oc run' with an image containing DNS tools (like utils or busybox) is standard. Specifically, 'oc run' with an interactive shell or debug container provides access.

Answer

oc test dns --cluster

Answer

oc adm diagnose network-dns

Answer

oc debug node/worker-1 --image=registry.redhat.io/rhel9/support-tools:latest

Question 9

An administrator is setting up a new custom MachineConfigPool for GPU-enabled worker nodes. After creating the MachineConfigPool resource, the administrator creates a MachineConfig that should apply exclusively to these nodes. What must the administrator include in the MachineConfig to ensure it only applies to the GPU pool?

Accepted Answer

Labels matching the machineconfigpool selector (e.g., 'pools.operator.machineconfiguration.openshift.io/gpu-worker: ""').. MachineConfigs must include node role labels matching the MachineConfigPool (e.g., pools.operator.machineconfiguration.openshift.io/<pool-name>: '') so the MCO targets the correct nodes.

Answer

Placing the MachineConfig object directly inside the GPU namespace.

Answer

A field in the spec named 'targetPool: gpu-worker'.

Answer

An annotation specifying 'machineconfigpool.openshift.io/target: gpu-worker'.

Question 10

When troubleshooting network policies or container connectivity in an OVN-Kubernetes environment, which THREE tools or logs are useful for diagnosing packet drops and flow issues? (Choose THREE)

Accepted Answer

Querying the OVN southbound database using ovn-sbctl. OVN-Kubernetes logs, node ovn-controller logs, and ovn-sbctl are key diagnostic tools.

Answer

Running systemctl restart firewalld on all worker nodes simultaneously

Answer

Editing the master /etc/hosts file to add custom pod IP mappings

Question 11

An administrator notices that Ingress controller logs show frequent health check failures for backend pods. Where can the administrator check or configure the liveness and readiness probes that dictate pod health for service endpoints?

Accepted Answer

In the IngressController custom resource spec. Liveness and readiness probes are configured directly within the Pod template spec of the Deployment or Pod resource.

Answer

In the Service specification under healthCheckNodePort

Answer

In the DNS operator configuration

Question 12

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

Accepted Answer

The cluster OAuth custom resource named cluster. LDAP identity providers are configured inside the cluster-scoped OAuth custom resource under the spec.identityProviders array.

Answer

A Secret named identity-provider in the openshift-authentication namespace

Answer

An Authentication custom resource named cluster in the kube-system namespace

Answer

A ConfigMap named ldap-config in the openshift-config namespace

Question 13

An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?

Accepted Answer

backend.production.svc.cluster.local. The standard FQDN format for a Kubernetes service is ..svc.cluster.local.

Answer

backend.production.pod.cluster.local

Answer

backend.production.router.default.svc

Answer

svc.production.backend.cluster.local

Question 14

A cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?

Accepted Answer

A custom label defined in the namespaceSelector of the NetworkPolicy spec. When using namespaceSelector in a NetworkPolicy, the target namespace must be labeled appropriately so the label matches the selector criteria specified in the ingress rule.

Answer

openshift.io/cluster-monitoring=true

Answer

security.openshift.io/scc=restricted

Answer

kubernetes.io/metadata.name matching the namespace name

Question 15

An OVN-Kubernetes clustered environment requires configuring egress IP functionality for a specific namespace so that all outgoing traffic from pods in that namespace appears to originate from a designated external IP address. Which custom resource must be configured?

Accepted Answer

EgressIP. In OVN-Kubernetes, EgressIP is a native custom resource used to assign a dedicated external IP to specific pods or namespaces.

Answer

ClusterNetwork

Answer

HostSubnet

Answer

EgressRouter

Question 16

An administrator running OpenShift 4.14 wants to configure automatic approval for an Operator subscription updates using the Operator Lifecycle Manager. Which field and value in the Subscription resource must be set?

Accepted Answer

Set 'spec.installPlanApproval: Automatic'. Subscriptions have an installPlanApproval field which can be set to 'Automatic' or 'Manual'. Setting it to 'Automatic' allows OLM to automatically install updates.

Answer

Set 'spec.channel.autoApprove: yes'

Answer

Set 'spec.autoUpgrade: true'

Answer

Set 'spec.approvalStrategy: Immediate'

Question 17

An administrator notices that a worker node is in a 'NotReady' state due to a storage failure. The administrator successfully replaces the underlying physical machine and wants to clear the old node object from the OpenShift 4.14 cluster. Which command should be used?

Accepted Answer

oc delete node worker-old. Once a node is drained or permanently offline, the administrator can delete the node resource using 'oc delete node <node-name>'.

Answer

oc adm cordon worker-old --purge

Answer

oc patch machine worker-old --type=merge -p '{"spec":{"deleted":true}}'

Answer

oc remove node-status worker-old

Question 18

An administrator wants to apply kernel arguments to all worker nodes in an OpenShift 4.14 cluster using the Machine Config Operator. After creating a new MachineConfig object, the administrator notices that the worker nodes are not updating and the MachineConfigPool status shows 'Updating=False'. What is the most likely cause?

Accepted Answer

The MachineConfig object lacks the correct labels required to associate it with the target MachineConfigPool.. The MachineConfig object must include valid labels matching the MachineConfigPool node selector (e.g., pools.operator.machineconfiguration.openshift.io/worker: '') so the Machine Config Operator knows which pool to target.

Answer

The administrator forgot to run 'oc adm upgrade --force' to trigger node reboots.

Answer

The Cluster Version Operator must be manually restarted to detect new MachineConfig definitions.

Answer

The cluster storage provider must be re-initialized to support kernel argument persistence.

Question 19

An administrator needs to ensure that if a worker node freezes or becomes unresponsive for more than 5 minutes, the cluster automatically remediates it by deleting and recreating the underlying virtual machine instance. Which OpenShift 4.14 feature should the administrator configure?

Accepted Answer

MachineHealthCheck. MachineHealthCheck allows administrators to define criteria (such as node not ready conditions) and automatically remediate unhealthy nodes by deleting their corresponding Machine objects.

Answer

NodeAutoscaler

Answer

MachineConfigPool

Answer

ClusterAutoscaler

Question 20

An administrator wants to test network connectivity from a pod named 'app-pod-1' to a service port on 'backend-service' using TCP. Which tool is commonly available and ideal for testing TCP port connectivity inside a container?

Accepted Answer

nc. nc (netcat) or telnet or curl are commonly used tools, but nc/netcat is standard for raw TCP connectivity checks.

Answer

ifconfig

Answer

traceroute

Answer

ping