EX280 Practice Exam 4 — 20 Questions

Question 1

An administrator needs to temporarily prevent the Machine Config Operator from applying pending MachineConfig changes to the worker nodes while performing troubleshooting. How should the administrator accomplish this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Patch the worker MachineConfigPool to set 'spec.paused: true'.. To pause updates on a set of nodes, the administrator can set the 'paused: true' field on the corresponding MachineConfigPool resource.

Answer

Delete all pending MachineConfig objects from the cluster.

Answer

Scale down the machine-config-operator deployment in openshift-machine-config-operator to zero replicas.

Answer

Annotate all worker nodes with 'machineconfiguration.openshift.io/paused=true'.

Question 2

An administrator creates a NetworkPolicy that restricts egress traffic from a namespace. However, DNS resolution for external services immediately stops working. What is the cause of this behavior?

Accepted Answer

The NetworkPolicy blocks outbound traffic to port 53 on the cluster DNS service.. Pods rely on CoreDNS services for name resolution. If egress rules are applied without explicitly allowing UDP/TCP traffic to port 53 on the cluster DNS service or cluster CIDR, DNS queries are blocked.

Answer

NetworkPolicies automatically disable the OpenShift SDN controller.

Answer

CoreDNS pods do not have valid security context constraints.

Answer

External DNS servers reject requests originating from OpenShift node IPs.

Question 3

Which OpenShift 4.14 operator provides a catalog of certified third-party and Red Hat operators available for cluster installation?

Accepted Answer

OperatorHub / Cluster Catalog Operator. OperatorHub is the mechanism and user interface catalog powered by the Cluster Catalog Operators where administrators discover and install operators.

Answer

Console Operator

Answer

Machine API Operator

Answer

Cluster Version Operator

Question 4

An administrator configures an Ingress resource in the 'web-apps' namespace to route traffic using the default OpenShift Ingress controller. The Ingress creation succeeds, but traffic to the hostname returns a 404 error. What is a common reason for this behavior in OpenShift?

Accepted Answer

The Ingress resource is missing the spec.ingressClassName set to the default OpenShift ingress class name.. OpenShift natively uses Route objects. While Ingress is supported, the Ingress controller watches Ingress objects, but custom annotations or missing paths/backend configurations or default controller sharding often require ensuring the Ingress class or annotations match the default router configuration. Alternatively, Ingress controllers in OpenShift require the ingress class name to be specified correctly (e.g., 'openshift-default').

Answer

Ingress hostnames must end with the exact string '.internal.cloudapp.net'.

Answer

Ingress objects require a ServiceMeshControlPlane to function properly in OpenShift.

Answer

OpenShift completely ignores Ingress resources and only processes Route objects.

Question 5

An OpenShift 4.14 cluster administrator has installed an Operator from OperatorHub into a custom namespace using a Subscription. The administrator notices that the Operator pod is not being created. Upon checking the Subscription, the installation mode is set to AllNamespaces, but the Operator target namespace is restricted. Which Operator Lifecycle Manager (OLM) object should the administrator inspect to troubleshoot why the CSV (ClusterServiceVersion) is not installing?

Accepted Answer

Inspect the OperatorGroup in the target namespace to ensure its targetNamespaces match or support the Subscription scope.. When using OLM, the OperatorGroup defines the namespace scope where Operators can be installed. If the OperatorGroup does not match the Subscription's install mode, the CSV will not install.

Answer

Check the MachineConfigPool for paused reconciliation flags.

Answer

Review the ClusterVersion resource status for pending updates.

Answer

Inspect the KubeletConfig custom resource for validation errors.

Question 6

Which TWO components are core parts of the OpenShift DNS architecture for cluster resolution? (Choose TWO)

Accepted Answer

CoreDNS. CoreDNS is deployed by the Cluster DNS Operator to provide internal name resolution for pods and services.

Answer

BIND9

Answer

HAProxy DNS module

Answer

Keepalived DNS plugin

Question 7

An administrator creates a Route with a specific hostname, but multiple Ingress controllers exist in the cluster. How does the Route know which Ingress controller should serve it?

Accepted Answer

By specifying the corresponding label selector in the Route spec under 'wildcardPolicy' or router selection annotations.. Routes specify which Ingress controller should serve them using the 'ingressControllers' label selector or by referencing the router name in the route spec / namespace annotations.

Answer

By adding the Ingress controller IP directly to the Route spec targetPort.

Answer

All routes are automatically served by every Ingress controller without exception.

Answer

Routes cannot be assigned to specific Ingress controllers.

Question 8

What is the purpose of the 'oc adm drain' command during cluster maintenance?

Accepted Answer

To mark a node unschedulable and gracefully evict workloads running on it.. The 'oc adm drain' command cordons the node and safely evicts all pods from it, allowing maintenance to be performed.

Answer

To restart the kubelet service and flush local DNS caches.

Answer

To permanently delete the node and its virtual machine instance from the cloud provider.

Answer

To clear container logs and free up disk space on the node filesystem.

Question 9

An administrator troubleshoots a failing NetworkPolicy and wants to verify if the OpenShift SDN or OVN-Kubernetes controller has successfully applied the rules. Where are the controller operator logs examined?

Accepted Answer

In the openshift-network-operator or openshift-ovn-kubernetes namespaces. Network operator logs, such as cluster-networks-operator or ovnkube-controller logs in their respective namespaces, contain synchronization errors and policy status.

Answer

In the openshift-apiserver namespace

Answer

In the kube-system namespace under core-dns logs

Answer

In the openshift-ingress namespace under router pods

Question 10

An administrator is troubleshooting a failed cluster upgrade in OpenShift 4.14. The upgrade channel is set to 'stable-4.14', but the cluster refuses to update to the latest target version. The administrator runs 'oc get clusterversion' and notes that a specific ClusterOperator reports 'Degraded=True'. What is the recommended next step?

Accepted Answer

Describe or inspect the degraded ClusterOperator to identify the root cause and resolve its configuration or resource issues.. Before proceeding with an upgrade, any degraded or failing ClusterOperator must be investigated and resolved because the CVO will block upgrades if core components are not healthy.

Answer

Switch the upgrade channel to 'fast-4.14' to bypass the degraded check.

Answer

Delete the Cluster Version Operator deployment to force a reset of the upgrade state machine.

Answer

Force the upgrade by running 'oc adm upgrade --to=<version> --force-ignore-degraded'.

Question 11

An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?

Accepted Answer

pod-security.kubernetes.io/enforce: restricted. To enforce a standard while generating audit log violations, the audit level is set to enforce while warning/audit levels are configured via namespace labels.

Answer

pod-security.openshift.io/standard: restricted

Answer

security.openshift.io/scc.enforce: restricted

Answer

openshift.io/cluster-monitoring: "true"

Question 12

Which TWO of the following are valid Service types supported natively in OpenShift? (Choose TWO)

Accepted Answer

ClusterIP. ClusterIP, NodePort, and LoadBalancer are standard Kubernetes/OpenShift service types. (ExternalName is also valid, Route is not a service type).

Answer

VirtualIP

Answer

IngressObject

Answer

Route

Question 13

A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?

Accepted Answer

allowHostPorts: true. Allowing pods to bind to privileged ports (< 1024) is controlled by setting allowHostPorts to true or defining allowedHostPorts in a custom SCC.

Answer

runAsUser.type: RunAsAny

Answer

allowPrivilegedContainer: true

Answer

privileged: true

Question 14

An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?

Accepted Answer

Set runAsUser.type to MustRunAs and specify uid: 1000 in the uidRange. To force a specific UID execution, the runAsUser strategy must be set to MustRunAs with a uidRange specifying UID 1000.

Answer

Set runAsUser.type to RunAsAny and add securityContext.runAsUser: 1000 in the pod spec

Answer

Configure fsGroup.type to MustRunAs with uid: 1000

Answer

Set privileged: true and map the container user via supplementalGroups

Question 15

Which THREE commands can an administrator use to inspect existing routes in an OpenShift cluster? (Choose THREE)

Accepted Answer

oc get routes. oc get routes, oc describe route, and oc get route are standard commands. (oc explain route is also valid for documentation). Let's select get, describe, and explain.

Answer

oc top route

Answer

oc logs route/<route-name>

Question 16

A cluster administrator notices that a PVC stuck in the Pending state references a StorageClass with volumeBindingMode set to WaitForFirstConsumer. What action will cause the PVC to bind?

Accepted Answer

Create and schedule a Pod that mounts the PVC.. When volumeBindingMode is WaitForFirstConsumer, the PV is not provisioned or bound until a Pod referencing that PVC is scheduled onto a node.

Answer

Delete the StorageClass and recreate it with Immediate binding mode.

Answer

Restart the kube-apiserver service on the control plane nodes.

Answer

Manually create a PV matching the exact size and labels of the PVC.

Question 17

An administrator wants to prevent automatic updates for an Operator installed via OLM while still allowing manual installation of new versions when desired. Which TWO actions or configurations should be performed? (Choose TWO)

Accepted Answer

Approve generated InstallPlans selectively using 'oc patch installplan' or via the web console when an update is desired.. To prevent automatic updates, set installPlanApproval to Manual and approve install plans manually when ready.

Answer

Scale the OLM operator pods to zero.

Answer

Delete the CatalogSource resource entirely.

Answer

Annotate the Subscription with 'olm.openshift.io/block-updates=true'.

Question 18

You need to provide temporary scratch space for a container that shares the pod's lifetime and is cleared when the pod is deleted. Which volume type should you configure in the Pod specification?

Accepted Answer

emptyDir. An emptyDir volume is created when a pod is assigned to a node, and exists as long as that pod is running on that node. It starts empty.

Answer

persistentVolumeClaim

Answer

hostPath

Answer

nfs

Question 19

Which TWO of the following are valid OpenShift Service types? (Choose TWO)

Accepted Answer

ClusterIP. Kubernetes and OpenShift support several standard service types, among which ClusterIP and NodePort are core native types.

Answer

NetworkPort

Answer

RouteIP

Answer

ContainerPort

Question 20

An administrator wants to verify node configuration application status. Which TWO indicators show that a MachineConfigPool has successfully finished applying a new MachineConfig? (Choose TWO)

Accepted Answer

The 'UpdatedMachineCount' equals the 'MachineCount' in the pool status.. A successfully updated MachineConfigPool will show Updating=False and Updated=<total-nodes> matching machine counts.

Answer

The 'ClusterVersion' status reads 'Updating'.

Answer

The pool status condition 'Paused' is set to True.

Answer

The 'DegradedMachineCount' is greater than zero.