EX280 Practice Test 22 — 15 Questions

Question 1

An application pod is running, but HTTP requests to the service are returning '502 Bad Gateway'. The administrator wants to check if the endpoints controller has populated the Service with active pod IP addresses. Which command verifies this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

oc get endpoints my-service. The Endpoints object is what the endpoints controller populates with the IP addresses and ports of pods that match a Service's selector. Running 'oc get endpoints my-service' shows whether the Service has active backend pod IPs; if the endpoints list is empty, the Service selector does not match any ready pods, which is a common cause of 502 errors from the router.

Answer

oc get svc my-service

Answer

oc describe ingress

Answer

oc get routes my-route

Question 2

Which component in OpenShift is responsible for watching PersistentVolumeClaims and dynamically provisioning PersistentVolumes when supported by a StorageClass?

Accepted Answer

kube-controller-manager. The kube-controller-manager runs the PersistentVolume controller, which watches for PersistentVolumeClaims that reference a StorageClass with a provisioner and dynamically creates matching PersistentVolumes. This is the component that implements dynamic provisioning in both Kubernetes and OpenShift. Without it, PVCs would remain Pending unless an admin manually pre-provisioned a PV.

Answer

kube-scheduler

Answer

crio

Answer

etcd

Question 3

Which service account is used by default for pods that do not specify a service account in their manifest?

Accepted Answer

default. Every namespace in Kubernetes/OpenShift is automatically provisioned with a ServiceAccount named 'default'. When a pod manifest omits the spec.serviceAccountName (or spec.serviceAccount) field, the admission controller assigns this 'default' ServiceAccount to the pod. OpenShift additionally creates 'builder' and 'deployer' ServiceAccounts per namespace for build and deployment controllers, but these are never auto-assigned to arbitrary pods.

Answer

builder

Answer

system

Answer

deployer

Question 4

An OpenShift cluster node has experienced kernel panics due to a faulty third-party kernel module. The administrator needs to review the kernel crash logs (vmcore or kdump logs) stored on the node. Where are these logs typically written on a CoreOS worker node?

Accepted Answer

/var/crash. On CoreOS worker nodes, kernel crash dumps (vmcore) and kdump logs are typically stored in /var/crash. This directory is the default location for kdump to save vmcore files when a kernel panic occurs. Administrators can inspect this directory to analyze the crash.

Answer

/run/log/journal

Answer

/var/lib/kubelet/pods

Answer

/var/log/audit/audit.log

Question 5

A service of type NodePort has been created in OpenShift. Within what default port range are NodePort services typically allocated on the worker nodes?

Accepted Answer

30000-32767. By default, Kubernetes and OpenShift allocate NodePort services from the range 30000-32767. This range is configurable at the cluster level, but the default is standardized. NodePort services expose the service on each node's IP at that port, allowing external access.

Answer

50000-60000

Answer

1024-65535

Answer

80-443

Question 6

You need to perform a canary deployment by shifting traffic between two versions of your app. What is the standard way to accomplish this in OpenShift without using a Service Mesh?

Accepted Answer

Use Route weights. In OpenShift, a Route can be configured with multiple backends (services) and each backend can be assigned a weight. By setting different weights, you can split traffic between two versions of your application, enabling a canary deployment. This is the standard method without a Service Mesh because it leverages the built-in HAProxy router's weighted round-robin capabilities. The weights are integers that represent relative proportions of traffic; for example, 80 and 20 would send 80% to one service and 20% to the other.

Answer

Create two separate Routes

Answer

Modify the Deployment strategy

Answer

Use the 'oc scale' command

Question 7

Which TWO things must be configured to use a Private Image Registry?

Accepted Answer

A docker-registry type secret. To pull images from a private image registry, Kubernetes needs credentials, which are supplied via a docker-registry type secret (option B) containing the registry URL, username, and password/token in .dockerconfigjson format. That secret must then be linked to the service account (option C) used by the pod (e.g., via the imagePullSecrets field or the service account's imagePullSecrets), so the kubelet can authenticate when pulling the image. A route to the registry (A) is only needed for external network access and is not a required configuration element for using a private registry. Creating a new ClusterRole (D) is unnecessary because image pulling is governed by node credentials and imagePullSecrets, not RBAC ClusterRoles. Updating the node configuration (E) is not required since authentication is handled through the secret and service account rather than by reconfiguring nodes.

Answer

A route to the registry

Answer

Creating a new ClusterRole

Answer

Updating the node configuration

Question 8

Which TWO methods can be used to populate data into a newly created PersistentVolumeClaim during provisioning?

Accepted Answer

Referencing an existing PersistentVolumeClaim in the PVC dataSource field for cloning.. Option C is correct because Kubernetes supports PVC cloning: a new PVC can specify an existing PVC in its spec.dataSource field (dataSource.kind: PersistentVolumeClaim), and the CSI driver then provisions the new volume with a copy of the source PVC's data. Option D is correct because a PVC can reference a VolumeSnapshot via spec.dataSource (dataSource.kind: VolumeSnapshot, apiGroup: snapshot.storage.k8s.io), which restores the snapshot's contents into the newly provisioned volume. Both mechanisms are standard ways to pre-populate a freshly created PVC at provisioning time. Option A is wrong because volumeMode only accepts Filesystem or Block and has nothing to do with populating data. Option B is wrong because PVC metadata cannot mount or pull from a container image registry. Option E is wrong because emptyDir is a pod-level ephemeral volume type and cannot be specified as a template inside a PVC spec.

Answer

Setting volumeMode to Populate in the PVC spec.

Answer

Mounting a container image registry directly via PVC metadata.

Answer

Specifying an emptyDir template in the PVC spec.

Question 9

An administrator needs to troubleshoot DNS resolution failures inside an application namespace. Which THREE resources or commands should they check? (Choose THREE)

Accepted Answer

oc logs -n openshift-dns -l dns.operator.openshift.io/daemonset-dns=default. Option B is correct because the CoreDNS pods in OpenShift run in the openshift-dns namespace under the daemonset labeled dns.operator.openshift.io/daemonset-dns=default, so `oc get logs` with that label selector reveals CoreDNS errors, plugin failures, or resolution issues affecting the application namespace. Option C is correct because the DNS ClusterOperator reports the overall health, availability, and degraded conditions of the cluster DNS service, quickly indicating whether the DNS operator itself is failing. Option E is correct because launching an interactive debug pod and running `nslookup` or `dig` against the cluster DNS service (for example, the kube-dns service IP) directly tests whether name resolution works from inside the cluster network. Option A is not relevant because MachineSets manage cluster nodes, not DNS resolution. Option D is not relevant because the IngressController resource governs router/ingress behavior, not internal DNS lookups.

Answer

oc get machineset

Answer

oc describe ingresscontroller default

Question 10

An administrator needs to restrict a user group named 'contractors' so they can view pods and services, but cannot view secrets across the 'staging' namespace. Which THREE of the following steps or configurations are valid and necessary to achieve this? (Choose THREE)

Accepted Answer

Create a custom Role in the staging namespace that explicitly includes rules for verbs get, list, watch on resources pods and services. Option B is correct because a namespaced Role must explicitly grant the desired permissions, and listing resources pods and services with verbs get, list, watch provides exactly the read-only access required in the staging namespace. Option C is correct because a RoleBinding in the staging namespace binds that Role to the contractors group, scoping the permissions to only that namespace. Option E is correct because RBAC is additive and deny-by-default, so simply not including secrets in the Role's resources list ensures the group cannot view secrets. Option A is incorrect because ClusterRoleBinding grants cluster-wide permissions and RBAC has no exclusion filter mechanism. Option D is incorrect because there is no negative weight annotation concept in Kubernetes RBAC, and cluster-admin would grant full access.

Answer

Create a ClusterRoleBinding referencing the view ClusterRole and set an exclusion filter for secrets

Answer

Assign the cluster-admin ClusterRole to the contractors group with a negative weight annotation

Question 11

An administrator wants to customize worker node behavior in an OpenShift 4.14 cluster using the Machine Config Operator. Which THREE custom resources are natively provided and managed by the MCO for node customization? (Choose THREE)

Accepted Answer

MachineConfig. The Machine Config Operator (MCO) natively manages three node-customization custom resources: MachineConfig (B), which defines Ignition-based changes to files, systemd units, and kernel arguments on nodes; KubeletConfig (C), which customizes kubelet parameters such as maxPods, podPidsLimit, and eviction thresholds; and ContainerRuntimeConfig (D), which tunes CRI-O settings like pidsLimit and logLevel. These three CRs are all reconciled by the MCO's controller and rendered into the machine-config daemon's desired state. ClusterVersion (A) is managed by the Cluster Version Operator (CVO) to control cluster updates, not by the MCO for node customization. OperatorGroup (E) is an OLM resource that scopes Operator installation to namespaces and is unrelated to MCO node configuration.

Answer

ClusterVersion

Answer

OperatorGroup

Question 12

An administrator is securing routes in an OpenShift cluster. Which THREE TLS termination types are supported natively by OpenShift Routes? (Choose THREE)

Accepted Answer

Passthrough. OpenShift Routes natively support three TLS termination types: Edge, Passthrough, and Re-encrypt. Option A (Passthrough) is correct because the router forwards encrypted traffic directly to the pod without terminating TLS, letting the application handle the certificate. Option B (Edge) is correct because TLS is terminated at the router, which then forwards plain HTTP to the backend pods. Option E (Re-encrypt) is correct because TLS is terminated at the router and a new TLS connection is established to the backend using a separate certificate. Option C (Proxy) is not a valid OpenShift Route termination type, and Option D (FullMesh) is not a supported termination type either; both are distractors not recognized by the Route API.

Answer

Proxy

Answer

FullMesh

Question 13

An administrator wants to verify node configuration application status. Which TWO indicators show that a MachineConfigPool has successfully finished applying a new MachineConfig? (Choose TWO)

Accepted Answer

The 'UpdatedMachineCount' equals the 'MachineCount' in the pool status.. Option B is correct because in a MachineConfigPool status, when UpdatedMachineCount equals MachineCount, every node in the pool has rendered and applied the current MachineConfig, indicating the rollout has completed. Option C is correct because the pool's Updating condition being False means the MachineConfigOperator is no longer actively applying a new MachineConfig to the pool, which is the definitive signal that the update process has finished. Option A is incorrect because ClusterVersion status 'Updating' refers to the cluster version operator applying an OpenShift release update, not a MachineConfigPool applying a MachineConfig. Option D is incorrect because a Paused condition set to True means the pool's rollout is intentionally halted, so it cannot indicate successful completion. Option E is incorrect because a DegradedMachineCount greater than zero indicates nodes failed to apply the configuration, which is the opposite of a successful application.

Answer

The 'ClusterVersion' status reads 'Updating'.

Answer

The pool status condition 'Paused' is set to True.

Answer

The 'DegradedMachineCount' is greater than zero.

Question 14

Which THREE actions can be performed when managing Route objects in OpenShift? (Choose THREE)

Accepted Answer

Specifying TLS termination as edge, passthrough, or reencrypt. Option C is correct because a Route's spec.tls.termination field accepts exactly edge, passthrough, or reencrypt, controlling where TLS is decrypted (at the router for edge, not at all for passthrough, and at the router then re-encrypted to the backend for reencrypt). Option D is correct because spec.host lets you define the externally reachable hostname (e.g., app.example.com) that the router uses to match incoming requests. Option E is correct because spec.path allows path-based routing, so a single hostname can direct /api to one Service and /web to another. Option A is wrong because storage volumes belong to Pods/Deployments via PersistentVolumeClaims, not to Route specs, which only handle HTTP(S) ingress. Option B is wrong because BGP peering is a networking concern handled by the cluster's SDN/OVN or MetalLB, not by Route objects, which are HAProxy-based ingress definitions.

Answer

Attaching a container storage volume directly inside the Route spec

Answer

Allocating a direct BGP peering session from the Route object

Question 15

A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?

Accepted Answer

Configure a LimitRange object in the 'data-tier' namespace with max storage constraints for persistent volume claims.. A LimitRange object in the 'data-tier' namespace can enforce a maximum storage request for PersistentVolumeClaims, rejecting any PVC that requests more than 50Gi. This is the native Kubernetes mechanism for per-namespace resource constraints on PVCs.

Answer

Set a StorageClass default size restriction.

Answer

Apply a ClusterRole restricting PVC creation sizes.

Answer

Configure an egress firewall rule blocking large volume attachments.