EX280 Practice Test 23 — 15 Questions

Question 1

An administrator has added a new custom worker MachineConfigPool and wants existing worker nodes to be migrated into this new pool based on specific labels. How does an administrator move a node from the default worker pool to a custom MachineConfigPool?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply the corresponding role label to the node (e.g., 'oc label node worker-01 node-role.kubernetes.io/custom-worker='').. To move a node to a custom MachineConfigPool, the administrator must label the node with the role label matching the custom MachineConfigPool (e.g., node-role.kubernetes.io/<pool-name>='').

Answer

Modify the cluster-wide node migration ConfigMap.

Answer

Edit the MachineSet to change its target pool name.

Answer

Run 'oc adm migrate node worker-01 --to-pool=custom-worker'.

Question 2

An administrator has successfully updated the global pull secret in openshift-config/pull-secret. How does the Machine Config Operator propagate this new pull secret to all existing worker nodes in the cluster?

Accepted Answer

The MCO automatically detects the secret change, generates a new rendered MachineConfig, and rolls out the update to nodes.. When the global pull secret is updated in openshift-config, the MCO automatically detects the change, renders a new MachineConfig, and initiates a rolling update of the nodes to apply the new pull secret via Ignition.

Answer

Pull secrets cannot be updated on existing nodes; nodes must be destroyed and recreated.

Answer

The Cluster Version Operator requires a manual cluster reboot command to push secrets.

Answer

The administrator must manually SSH into each worker node and run 'oc-update-pull-secret'.

Question 3

An administrator is configuring a disconnected (air-gapped) OpenShift 4.14 cluster installation. Which THREE components or resources are critical for successfully managing container image mirroring and catalog sources in this environment? (Choose THREE)

Accepted Answer

ImageContentSourcePolicy (or ImageTagMirrorSet). ImageContentSourcePolicy/ImageTagMirrorSet, mirror registry, and CatalogSource are essential for disconnected installations.

Answer

OperatorGroup namespace restriction rules

Answer

MachineHealthCheck remediation timeout settings

Question 4

An administrator wants to modify the default kubelet parameters (such as maximum pods per core or eviction hard thresholds) across worker nodes. Which TWO steps or resources are involved in this process? (Choose TWO)

Accepted Answer

Create a KubeletConfig custom resource defining the desired kubelet parameters.. Kubelet configuration changes involve creating a KubeletConfig resource and ensuring its selector targets the correct MachineConfigPool.

Answer

Directly edit the kubelet.conf file on every node via SSH.

Answer

Restart the kubelet service manually on all nodes using systemctl.

Answer

Modify the ClusterVersion spec to include kubelet flags.

Question 5

An administrator is managing an OpenShift 4.14 cluster and notices that a newly installed Operator fails to start because it requires a specific version of Kubernetes that is older than what OpenShift 4.14 provides. How does OLM handle Operator compatibility checks during subscription creation?

Accepted Answer

OLM evaluates the ClusterServiceVersion (CSV) metadata against the cluster version and blocks installation if requirements are unmet.. OLM checks the 'minVersion' and 'maxVersion' or 'capabilities' specified in the Operator's CSV against the cluster version and will not install an incompatible CSV, keeping the installation pending or failing.

Answer

The kube-apiserver automatically patches the operator deployment to bypass version checks.

Answer

The operator runs inside a compatibility emulation container provided by the MCO.

Answer

The Cluster Version Operator automatically downgrades the cluster Kubernetes API to match the Operator.

Question 6

You need to terminate TLS for a route using a custom certificate. Which object must contain the TLS key and certificate?

Accepted Answer

A Secret in the same namespace as the route. The Route object itself holds the configuration, but the certificate and key are referenced within the Route's 'spec.tls' section, often pulled from a Secret.

Answer

A ConfigMap in the 'openshift-config' namespace

Answer

A custom resource definition of type TLS

Answer

The ingress controller configuration

Question 7

An administrator needs to create a Route that handles multiple subdomains or redirects insecure HTTP traffic to HTTPS automatically. Where is the insecure traffic redirect configured?

Accepted Answer

insecureEdgeTerminationPolicy: Redirect. Insecure traffic redirection is configured via the insecureEdgeTerminationPolicy field in the Route spec.

Answer

route.openshift.io/handling: insecure-redirect

Answer

tls.allowInsecure: true

Answer

spec.redirectHTTP: enabled

Question 8

An OpenShift administrator needs to restrict external access to a specific application Route by limiting access to a predefined list of allowed client IP addresses. How can this be accomplished?

Accepted Answer

Add the annotation 'haproxy.router.openshift.io/ip_whitelist' to the Route object.. Routes support spec.securityContext or annotations/fields for IP filtering. Specifically, the 'haproxy.router.openshift.io/ip_whitelist' annotation restricts access based on client source IP.

Answer

Configure spec.clientIP in the Service object definition.

Answer

Create a NetworkPolicy with spec.ingress.ipBlock restricting the router pod.

Answer

Update the IngressController CR with a global clientIP blacklist.

Question 9

Which THREE statements are true regarding Ingress controllers in OpenShift? (Choose THREE)

Accepted Answer

Administrators can create additional custom IngressController instances.. Ingress controllers in OpenShift manage external access via HAProxy pods, support multiple instances, and automatically translate Ingress and Route resources.

Answer

They replace the internal Kubernetes kube-proxy component entirely.

Answer

They require manual iptables rule updates on every worker node for every new route.

Question 10

Which OpenShift 4.14 command allows an administrator to gather cluster-wide diagnostic logs and configuration data for support cases?

Accepted Answer

oc adm must-gather. The 'oc adm must-gather' tool collects debugging information, logs, and object definitions from the cluster into a local directory.

Answer

oc adm collect-logs

Answer

oc support dump

Answer

oc cluster-debug bundle

Question 11

An administrator wants to inspect or modify the OperatorGroup for a namespace in OpenShift 4.14. Which TWO characteristics or settings are defined by an OperatorGroup? (Choose TWO)

Accepted Answer

The target namespaces (targetNamespaces) where Operators in the group can manage workloads.. OperatorGroups define the target namespaces where OLM operators can be installed and operated.

Answer

The kernel version applied to worker nodes in the pool.

Answer

The cluster upgrade channel and target release version.

Answer

The cloud provider machine instance type (e.g., m5.xlarge).

Question 12

An administrator is managing cluster machine configurations and needs to understand how Ignition configuration files are processed. Which THREE statements are correct regarding Ignition and the Machine Config Operator in OpenShift 4.14? (Choose THREE)

Accepted Answer

The Machine Config Daemon runs on every node to apply updates delivered by the MCO.. Ignition provisions nodes on first boot, rendered MachineConfigs combine configs, and the Machine Config Daemon applies them.

Answer

Ignition files are stored directly inside etcd without encryption or serialization.

Answer

Ignition configs are dynamically parsed and executed continuously by a background daemon every 5 seconds during normal runtime.

Question 13

Which component in OpenShift 4.14 coordinates the creation of certificates for cluster components and worker nodes?

Accepted Answer

Kubernetes CSR controller / OpenShift PKI operators. The Certificate Signing Request (CSR) controller and the Machine Config Operator / cluster-kube-apiserver-operator handle internal PKI and certificate issuance.

Answer

Machine API Operator

Answer

Cluster Autoscaler

Answer

Operator Lifecycle Manager (OLM)

Question 14

Which TWO objects are used by OLM to manage Operator catalogs and sources of software in OpenShift 4.14? (Choose TWO)

Accepted Answer

OperatorGroup. CatalogSource and OperatorGroup are key OLM components for catalog management and scoping.

Answer

ClusterVersion

Answer

MachineSet

Answer

MachineConfigPool

Question 15

Which TWO files or directories are commonly configured or injected via MachineConfig objects for node customization? (Choose TWO)

Accepted Answer

Custom files placed in arbitrary file paths on the node filesystem.. MachineConfigs can inject custom files into target paths and configure system files like SSH authorized keys.

Answer

Persistent Volume Claims (PVCs) for user applications.

Answer

Direct modifications to the Kubernetes API server binary code.

Answer

Dynamic container image layer storage caches.