EX280 Practice Test 24 — 15 Questions

Question 1

An administrator needs to delete a Service named 'old-service' in the 'test' namespace. Which command accomplishes this?

Accepted Answer

oc delete service old-service -n test. The oc delete service command removes the specified service resource.

Answer

oc remove svc old-service --namespace=test

Answer

oc prune service old-service -n test

Answer

oc destroy service old-service -n test

Question 2

Which TWO methods can administrators use to access the OpenShift 4.14 web console or CLI for cluster management? (Choose TWO)

Accepted Answer

Using a web browser to access the OpenShift Web Console URL.. Administrators use the 'oc' CLI tool and the OpenShift web console URL.

Answer

Using 'systemctl gui-console' on control plane nodes.

Answer

Using SSH to log directly into the API server container runtime socket.

Answer

Using the 'kubectl-adm console' plugin.

Question 3

An administrator wants to check the status of Machine API provisioning and verify that all machines are in a running state. Which TWO commands or resource inspections should the administrator perform? (Choose TWO)

Accepted Answer

Run 'oc get machines -A' to list all provisioned machines across namespaces.. Administrators inspect machines and machinesets using 'oc get machines' and 'oc get machinesets'.

Answer

Run 'oc adm machine-status'.

Answer

Run 'oc get clusteroperators --machines'.

Answer

Run 'oc get machineconfigpools --machines'.

Question 4

An administrator is planning an OpenShift 4.14 cluster upgrade and wants to ensure that specific safety checks and conditions are met before proceeding. Which THREE conditions must be true for an upgrade to proceed smoothly? (Choose THREE)

Accepted Answer

All MachineConfigPools must be fully updated and not in a degraded state.. Cluster version updates require healthy operators (not degraded), available storage/compute resources, and a valid update path.

Answer

The cluster must be switched to the 'nightly' channel for all production upgrades.

Answer

All user-created namespaces must be temporarily deleted prior to upgrade.

Question 5

An administrator wants to configure automated remediation for worker nodes that become unresponsive or experience hardware failure. Which TWO configurations or resources are required for a MachineHealthCheck to function properly? (Choose TWO)

Accepted Answer

Unhealthy conditions specifying the node status condition and timeout duration.. MachineHealthCheck requires target selectors (matchLabels) and node condition timeout definitions (unhealthyConditions).

Answer

A replica count specifying how many remediation pods to run.

Answer

A ContainerRuntimeConfig specifying reboot parameters.

Answer

An OperatorGroup defining the namespace for the health check.

Question 6

Which TWO commands are used to check the health and status of the cluster networking operator? (Choose TWO)

Accepted Answer

oc describe clusteroperator network. oc get clusteroperators and oc describe clusteroperator network are correct.

Answer

oc get routes --all-nodes

Answer

oc adm network status

Answer

oc top network

Question 7

An administrator is managing operator subscriptions and wants to ensure that an operator is automatically updated when new versions are released in the channel. Which THREE conditions or configuration settings must be satisfied? (Choose THREE)

Accepted Answer

The OperatorGroup must correctly encompass the target namespace scope.. Automatic updates require installPlanApproval set to Automatic, a valid CatalogSource, and an active Subscription.

Answer

The Cluster Version Operator must have auto-upgrade enabled for third-party operators.

Answer

The global pull secret must be deleted so OLM can fetch unauthenticated updates.

Question 8

An administrator needs to configure secure access to a private registry for both node image pulls and OLM operator deployments. Which THREE actions or resources are required across the cluster? (Choose THREE)

Accepted Answer

Update the global pull secret in openshift-config/pull-secret with registry credentials.. Configuring private registries requires updating the global pull secret, configuring ICSP/ITMS for image mirroring, and attaching pull secrets to service accounts if needed.

Answer

Modify the ClusterVersion spec to disable TLS verification globally.

Answer

Scale the Machine API operator to zero during credential updates.

Question 9

An administrator configures a LoadBalancer service on an OpenShift cluster running on a cloud provider. However, the EXTERNAL-IP remains in a <pending> state indefinitely. What is the most likely reason?

Accepted Answer

The cloud controller manager or cloud credentials operator is not configured to provision external load balancers.. A LoadBalancer service requires a cloud provider integration (such as an Ingress operator or cloud controller manager) to provision an external load balancer. Without proper configuration or cloud credentials, it remains pending.

Answer

The cluster is missing a valid Ingress controller deployment.

Answer

The NetworkPolicy is blocking cloud provider traffic.

Answer

The NodePort range is exhausted.

Question 10

A developer deploys a headless service (ClusterIP set to None) in OpenShift. What is the primary characteristic of a headless service?

Accepted Answer

It does not allocate a ClusterIP, and DNS returns the individual pod IPs directly.. Headless services do not allocate a cluster IP; instead, DNS returns the IP addresses of the individual pods backing the service directly.

Answer

It prevents any external routes from binding to the service.

Answer

It routes traffic exclusively via NodePort across worker nodes.

Answer

It provisions an external cloud load balancer automatically.

Question 11

Which TWO tools or protocols can an administrator use to verify internal cluster DNS resolution from a pod? (Choose TWO)

Accepted Answer

nslookup. nslookup and dig are standard tools for DNS queries.

Answer

ping

Answer

ifconfig

Answer

top

Question 12

A developer reports that pods in the namespace 'project-a' cannot resolve services located in the namespace 'project-b' using standard internal DNS names. What is the correct way to query 'project-b' service 'backend' from 'project-a'?

Accepted Answer

backend.project-b.svc.cluster.local. Kubernetes cluster DNS allows cross-namespace resolution using the FQDN format ..svc.cluster.local.

Answer

backend.project-b.pod.cluster.local

Answer

backend.project-b.svc

Answer

backend.project-b.internal

Question 13

Which THREE network-related objects are namespaced in OpenShift? (Choose THREE)

Accepted Answer

NetworkPolicy. Services, Routes, and NetworkPolicies are namespaced resources, whereas IngressControllers and ClusterNetworks are cluster-scoped.

Answer

ClusterNetwork

Answer

IngressController

Question 14

A cluster administrator needs to grant a Deployment in the production namespace permission to pull images from a private container registry. The image pull secret is named my-registry-secret. Which step must be performed so that pods created by this Deployment can successfully pull the image?

Accepted Answer

Patch the default ServiceAccount in the production namespace to include my-registry-secret in its imagePullSecrets array.. Service accounts in OpenShift automatically reference image pull secrets in their imagePullSecrets array if they are intended to be used by pods, or you patch the default service account to include the secret so pods using that service account inherit it.

Answer

Create a RoleBinding mapping the secret to the cluster-readers cluster role.

Answer

Annotate the Deployment resource with the full base64-encoded dockerconfigjson payload.

Answer

Run oc set data secrets/my-registry-secret --namespace=production.

Question 15

A pod fails to start with 'container has runAsNonRoot and image will run as root'. Which SCC field needs to be adjusted in a custom SCC to allow this image to run?

Accepted Answer

runAsUser: RunAsAny. The runAsUser strategy in the SCC determines how the UID is handled for containers.

Answer

runAsUser: MustRunAsRange

Answer

readOnlyRootFilesystem: false

Answer

allowPrivilegedEscalation: true