EX280 Practice Test 21 — 15 Questions

Question 1

An administrator needs to modify the timeout values for the default OpenShift Ingress Controller (Router). Where should this change be applied?

Accepted Answer

Edit the ingresscontroller instance named 'default' in the 'openshift-ingress-operator' namespace.. The OpenShift Ingress Controller (Router) is managed by the Ingress Operator. To change timeout values, you must modify the IngressController custom resource named 'default' in the 'openshift-ingress-operator' namespace. This is the supported method because the Operator reconciles the router deployment and its configuration based on this resource. Directly editing the router's configmap or deployment is not persistent and will be overwritten by the Operator.

Answer

Edit the proxy resource named 'cluster'.

Answer

Edit the endpoints resource in the 'openshift-ingress' namespace.

Answer

Modify the kube-apiserver configmap.

Question 2

Which TWO commands or tools can an administrator use to inspect cluster logs or events when troubleshooting node or pod issues? (Choose TWO)

Accepted Answer

oc logs . Option B, `oc logs `, is correct because it retrieves the stdout/stderr container logs for a specific pod (with flags like `-c` for a container, `-f` to follow, or `--previous` for a crashed container), which is the primary way to inspect application-level output when troubleshooting a pod. Option E, `oc get events`, is correct because it lists Kubernetes Events in the current namespace (or with `-A`/`--all-namespaces`), showing scheduling failures, image pull errors, probe failures, and node-related warnings useful for diagnosing node or pod issues. Option A, `oc adm cluster-logs --tail=all`, is not a valid OpenShift command for this purpose. Option C, `oc system-log dump`, is not a real `oc` subcommand for collecting logs. Option D, `oc adm tail-events`, is not a valid command; events are viewed with `oc get events` or `oc describe`.

Answer

oc adm cluster-logs --tail=all

Answer

oc system-log dump

Answer

oc adm tail-events

Question 3

Which TWO commands can an administrator use to check the overall status or health of core OpenShift 4.14 cluster operators? (Choose TWO)

Accepted Answer

oc get clusteroperators. Option D, `oc get clusteroperators`, is correct because it lists all ClusterOperators and their AVAILABLE, PROGRESSING, and DEGRADED status conditions, which is the primary way to assess the overall health of core OpenShift operators. Option E, `oc get clusterversion`, is correct because it shows the ClusterVersion operator's state, including the current version, update status, and whether the cluster is progressing or failing an upgrade, reflecting overall cluster health. Option A, `oc get machinesets`, only shows MachineSet replicas for machine management and does not report operator health. Option B, `oc get machineconfigpools`, only reports MachineConfigPool readiness and node configuration status, not operator health. Option C, `oc get csv --all-namespaces`, lists ClusterServiceVersions for Operator Lifecycle Manager-installed operators, not the core cluster operators' health.

Answer

oc get machinesets

Answer

oc get machineconfigpools

Answer

oc get csv --all-namespaces

Question 4

An administrator is configuring automated node remediation and scaling in OpenShift 4.14. Which THREE objects or custom resources are involved in machine management, autoscaling, and health checking? (Choose THREE)

Accepted Answer

MachineSet. MachineSet (A) is correct because it is the OpenShift Machine API resource that maintains a desired number of Machine replicas, enabling scaling and replacement of nodes within a cluster. ClusterAutoscaler (D) is correct because it is the custom resource that automatically adjusts the size of MachineSets (via MachineAutoscaler) based on pending pods and node utilization. MachineHealthCheck (E) is correct because it defines conditions for detecting unhealthy nodes and triggers remediation by deleting the Machine so the MachineSet recreates it. ClusterVersion (B) is not involved in node remediation or scaling; it manages cluster version and update status. OperatorGroup (C) is an OLM resource that scopes operator installations to namespaces and has no role in machine management, autoscaling, or health checking.

Answer

ClusterVersion

Answer

OperatorGroup

Question 5

An administrator needs to create a new OpenShift build using a BuildConfig. Which TWO build strategies are natively supported out-of-the-box by OpenShift? (Choose two.)

Accepted Answer

Source (S2I). Option A (Source, i.e., Source-to-Image/S2I) is correct because OpenShift natively supports the Source build strategy, which injects application source into a builder image and produces a runnable image without a Dockerfile. Option E (Docker) is correct because the Docker build strategy is a built-in OpenShift strategy that builds an image from a Dockerfile using the container runtime. These are two of the standard strategies available in a BuildConfig (alongside Custom and Pipeline). Option B (Ansible) is not a native BuildConfig strategy; Ansible automation is typically run via Ansible Automation Platform or as a custom build, not as a built-in strategy. Option C (Knative) is a serverless/eventing platform, not a BuildConfig build strategy. Option D (Helm) is a package manager for Kubernetes manifests, not an OpenShift build strategy.

Answer

Ansible

Answer

Knative

Answer

Helm

Question 6

Which THREE pieces of data can an ImageStream reference?

Accepted Answer

Internal registry image. An ImageStream in OpenShift tracks image references, and it can point to an image in the internal registry (option A), which is the typical case when builds push images to the integrated registry and deployments pull from it. It can also reference a specific image tag (option B), since ImageStreamTags are the mechanism by which an ImageStream maps a tag name to a concrete image ID. Additionally, an ImageStream can reference an image in an external registry (option D), allowing OpenShift to track and import images hosted outside the cluster. Option C is incorrect because a Git repository is a source for builds (e.g., BuildConfig source), not something an ImageStream references. Option E is incorrect because a DeploymentConfig consumes ImageStreams via triggers or image change parameters; it is not a target that an ImageStream references.

Answer

Git repository

Answer

DeploymentConfig

Question 7

Which THREE statements are true regarding Ingress controllers in OpenShift? (Choose THREE)

Accepted Answer

Administrators can create additional custom IngressController instances.. Option A is correct because OpenShift administrators can create additional custom IngressController instances (for example, in the openshift-ingress-operator namespace) to provide separate ingress endpoints with their own HAProxy router deployments, scaling, and node placement. Option C is correct because the default OpenShift Ingress controller is implemented by the OpenShift Router, which runs HAProxy in router pods managed by the Ingress Operator. Option D is correct because the OpenShift router watches both Route resources (the OpenShift-native API) and Ingress resources (the standard Kubernetes API), serving both through the same HAProxy-based data path. Option B is not correct because kube-proxy is a separate Kubernetes component that programs service load balancing on nodes; Ingress controllers handle HTTP/HTTPS routing and do not replace kube-proxy. Option E is not correct because the router dynamically updates its HAProxy configuration as Routes and Ingresses change, so administrators do not manually edit iptables rules on worker nodes for each new route.

Answer

They replace the internal Kubernetes kube-proxy component entirely.

Answer

They require manual iptables rule updates on every worker node for every new route.

Question 8

An administrator is reviewing the default Security Context Constraints in OpenShift 4.14+. Which THREE of the following SCCs are built-in and provided out-of-the-box by OpenShift? (Choose THREE)

Accepted Answer

nonroot. Option C (nonroot) is correct because OpenShift ships a built-in nonroot SCC that allows pods to run as any non-root UID while still restricting privileged access, and it is part of the default SCC set. Option D (restricted-v2) is correct because it is the default SCC assigned to authenticated users in OpenShift 4.14+, replacing the older restricted SCC with stricter seccomp and capability requirements. Option E (privileged) is correct because the privileged SCC is a built-in SCC that allows full unrestricted host access and is provided out-of-the-box for system workloads. Options A (root-container-v1) and B (custom-app-scc) are not built-in SCCs; they appear to be custom or fabricated names, and OpenShift does not provide them by default.

Answer

root-container-v1

Answer

custom-app-scc

Question 9

An administrator needs to troubleshoot an upgrade failure in OpenShift 4.14. Which TWO actions or diagnostic steps should the administrator take? (Choose TWO)

Accepted Answer

Inspect any cluster operators reporting 'Degraded=True' or 'Progressing=True'.. Option C is correct because during an OpenShift 4.x upgrade the Cluster Version Operator orchestrates ClusterOperators, and any operator stuck with Degraded=True or Progressing=True directly identifies the component blocking or failing the upgrade, making it the primary diagnostic signal. Option D is correct because 'oc describe clusterversion' (or 'oc get clusterversion -o yaml') exposes the ClusterVersion status, including the current and desired channel, version history, conditions, and the specific failure message recorded by the CVO, which is essential for pinpointing why an upgrade failed. Option A is wrong because power-cycling the control plane is disruptive, unsupported, and risks etcd corruption without providing any diagnostic value. Option B is wrong because deleting pods in openshift-cluster-version does not force a clean restart of the upgrade and can disrupt the CVO's reconciliation logic. Option E is wrong because scaling OLM subscriptions to zero would break operator management and is unrelated to diagnosing a cluster version upgrade failure.

Answer

Reboot the entire cluster control plane via physical power cycles.

Answer

Delete all pods in the openshift-cluster-version namespace to force a clean restart.

Answer

Scale down all OLM Operator subscriptions to zero.

Question 10

Which TWO methods can an administrator use to troubleshoot why a pod cannot connect to a remote Service? (Choose TWO)

Accepted Answer

Verifying that the target service has valid endpoints pointing to running pods.. Option A is correct because a Service only forwards traffic to pods that match its selector and are Ready, so checking that the Service has valid Endpoints (via kubectl get endpoints or kubectl describe svc) confirms whether the Service is actually backed by running pods and is essential to diagnosing connectivity failures. Option B is correct because running nc or curl from inside a debug pod directly tests L3/L4 reachability to the Service ClusterIP and port, helping isolate whether the problem is DNS, network policy, kube-proxy, or the application itself. Options C, D, and E are unrelated to Service connectivity troubleshooting: restarting storage provider pods addresses storage/CSI issues, deleting PVCs affects persistent volume binding, and modifying a MachineConfig pool changes node-level configuration, none of which diagnose why a pod cannot reach a remote Service.

Answer

Restarting the cluster storage provider pods.

Answer

Deleting all persistent volume claims.

Answer

Modifying the global MachineConfig pool.

Question 11

Which TWO methods can administrators use to access the OpenShift 4.14 web console or CLI for cluster management? (Choose TWO)

Accepted Answer

Using a web browser to access the OpenShift Web Console URL.. Option C is correct because administrators can access the OpenShift 4.14 web console by pointing a supported web browser at the console URL (typically https://console-openshift-console.apps.), which is the standard browser-based management interface. Option E is correct because the 'oc' CLI is the supported command-line tool for OpenShift, and administrators authenticate to the cluster with 'oc login' (for example, 'oc login https://api.:6443 -u ') before running management commands. Option A is incorrect because 'systemctl gui-console' is not a valid OpenShift or systemd unit for launching a console on control plane nodes. Option B is incorrect because SSHing into the API server container runtime socket is neither a supported nor practical method for accessing the web console or CLI. Option D is incorrect because 'kubectl-adm console' is not a real plugin or command in OpenShift or Kubernetes.

Answer

Using 'systemctl gui-console' on control plane nodes.

Answer

Using SSH to log directly into the API server container runtime socket.

Answer

Using the 'kubectl-adm console' plugin.

Question 12

Which TWO security standards are natively tracked in OpenShift?

Accepted Answer

restricted. In OpenShift, Security Context Constraints (SCCs) are the native mechanism for controlling pod permissions, and the platform ships with several predefined SCCs, including restricted and privileged. The restricted SCC is correct because it is the default, most locked-down policy that enforces running as a non-root user, drops capabilities, and uses a restricted SELinux context. The privileged SCC is correct because it is a built-in policy that grants broad access, allowing privileged containers, host networking, host PID/IPC, and all capabilities for cluster-admin workloads. The options isolated, custom, and secure are not native OpenShift SCC names, so they are not tracked as built-in security standards.

Answer

isolated

Answer

custom

Answer

secure

Question 13

Which THREE actions can be performed using the IngressController custom resource? (Choose THREE)

Accepted Answer

Scaling the number of router replicas.. Option C is correct because the IngressController custom resource includes a replicas field that controls the number of router pods deployed by the OpenShift ingress operator, allowing administrators to scale router replicas declaratively. Option D is correct because the IngressController CR exposes the endpointPublishingStrategy field, which lets you choose how the router is exposed, such as LoadBalancerService, HostNetwork, NodePortService, or Private. Option E is correct because the IngressController CR supports the defaultCertificate field, which references a TLS secret used as the wildcard certificate for routes that do not specify their own certificate. Option A is not correct because the core Kubernetes API server port is configured on the kube-apiserver static pod or API server arguments, not through the IngressController CR. Option B is not correct because security context constraints for worker nodes are managed via SCC objects and node configuration, not through the IngressController custom resource.

Answer

Modifying the core Kubernetes API server port.

Answer

Defining the container security context constraints for worker nodes.

Question 14

Which TWO statements are true regarding Kustomize usage within OpenShift? (Choose two.)

Accepted Answer

Kustomize is natively integrated into the oc command line tool using the -k flag.. Option B is correct because OpenShift's oc CLI natively integrates Kustomize, allowing users to build and apply a kustomization directory directly with commands like 'oc apply -k ' or 'oc kustomize ', without needing a separate kustomize binary. Option D is correct because Kustomize's core purpose is declarative customization of base YAML manifests through kustomization.yaml features such as strategic-merge and JSON 6902 patches, plus namePrefix and nameSuffix transformers, which is exactly how OpenShift users overlay environment-specific changes. Option A is wrong because Kustomize is a client-side manifest rendering tool and never replaces or bypasses the Kubernetes API server; resources are still created via the API server. Option C is wrong because Kustomize works with plain directories of YAML and requires no centralized chart repository like ChartMuseum (that concept belongs to Helm). Option E is wrong because Kustomize deliberately avoids Go templating and conditional logic, using declarative patches and overlays instead.

Answer

Kustomize replaces the Kubernetes API server entirely during resource creation.

Answer

Kustomize requires a centralized chart repository server similar to ChartMuseum.

Answer

Kustomize requires writing complex Go templates with conditional logic statements.

Question 15

Which tool should be used to troubleshoot why an SCC is being rejected for a pod?

Accepted Answer

oc adm policy scc-review. 'oc adm policy scc-review' is the dedicated diagnostic command that evaluates whether a given pod (or a ServiceAccount with a given set of security context settings) would be admitted by any SCC. It reports which SCCs the subject can use and why a pod may be rejected, making it the correct tool for troubleshooting SCC rejection.

Answer

oc adm top scc

Answer

oc get scc --debug

Answer

oc explain scc