EX280 Practice Test 25 — 15 Questions

Question 1

An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A ClusterRole and a ClusterRoleBinding. To grant read-only access to pods across all namespaces, the permissions must be cluster-scoped. A ClusterRole defines the permissions (e.g., get, list, watch on pods), and a ClusterRoleBinding binds that ClusterRole to the service account, granting access cluster-wide. This is the correct RBAC configuration for cross-namespace access.

Answer

A SecurityContextConstraints object assigned to the ServiceAccount

Answer

A ClusterRole and a RoleBinding in the monitoring namespace

Answer

A Role and a RoleBinding in the monitoring namespace

Question 2

An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?

Accepted Answer

Via the /etc/resolv.conf file automatically managed inside the pod container. Every pod in OpenShift has its /etc/resolv.conf automatically populated by the kubelet with the cluster DNS service IP (typically 172.30.0.10) and search domains. CoreDNS listens on that service IP and answers queries for cluster-internal names like service.namespace.svc.cluster.local. The pod does not query the API server directly; it simply uses the resolver configuration injected at container start.

Answer

By querying the OpenShift API server directly on port 6443 for DNS records

Answer

Through an environment variable named CLUSTER_DNS injected into every container

Answer

By parsing the /etc/hosts file updated dynamically by the OpenShift SDN controller

Question 3

An administrator wants to inspect the ignition configuration generated for worker nodes by the Machine Config Operator. Which command or resource should the administrator examine?

Accepted Answer

Inspect the rendered MachineConfig objects (e.g., rendered-worker-*) managed by the MCO.. The Machine Config Operator (MCO) generates rendered MachineConfig objects named rendered-worker-* (and rendered-master-*) that contain the final, merged ignition configuration for each machine pool. These rendered objects are the authoritative source for inspecting what ignition config will actually be applied to worker nodes, combining all MachineConfigs, kubelet configs, and container runtime settings. Inspecting these rendered objects via 'oc get machineconfig rendered-worker-<hash> -o yaml' reveals the complete ignition payload, including systemd units, files, and kernel arguments.

Answer

Run 'oc adm inspect ignition-configs'.

Answer

Check the ConfigMap named 'ignition-worker' in the default namespace.

Answer

View the ClusterVersion status conditions.

Question 4

Which TWO options describe characteristics of OVN-Kubernetes compared to the legacy OpenShift SDN? (Choose TWO)

Accepted Answer

It provides native support for EgressIP and EgressFirewall custom resources.. Option A is correct because OVN-Kubernetes natively implements EgressIP and EgressFirewall as custom resources managed through its OVN northbound database, giving cluster administrators first-class APIs for controlling egress traffic that the legacy OpenShift SDN handled differently or with limited functionality. Option D is correct because OVN-Kubernetes is built on Open Virtual Network (OVN) and Open vSwitch (OVS), using OVS flows and OVN logical flows for distributed routing and switching across nodes, which is the architectural foundation that distinguishes it from OpenShift SDN. Option B is incorrect because OVN-Kubernetes does not rely exclusively on iptables; it uses OVS flow tables and OVN logical flows for most dataplane forwarding, with iptables only for limited host-level functions. Option C is incorrect because OVN-Kubernetes does not require the flannel CNI plugin; it is a self-contained CNI implementation. Option E is incorrect because OVN-Kubernetes fully supports Kubernetes NetworkPolicy objects, translating them into OVN ACLs.

Answer

It relies exclusively on traditional Linux iptables rules without OVS flow tables.

Answer

It requires the flannel CNI plugin to function.

Answer

It does not support NetworkPolicies.

Question 5

Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?

Accepted Answer

admin. The 'admin' cluster role is a default OpenShift role that grants full read/write access to most resources within a project, including the ability to manage roles and rolebindings inside that namespace. When bound via a RoleBinding (namespace-scoped), it confers project-level administrative rights without granting cluster-wide privileges. This is distinct from 'cluster-admin', which is a cluster-scoped role granting unrestricted access across all projects and cluster resources.

Answer

edit

Answer

view

Answer

cluster-admin

Question 6

A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?

Accepted Answer

Create a RoleBinding in the 'app-dev' namespace referencing the 'pod-debugger' ClusterRole and the 'development' group.. A RoleBinding can reference a ClusterRole, and when it does, the permissions defined in the ClusterRole are granted only within the namespace where the RoleBinding is created. By creating a RoleBinding in the 'app-dev' namespace that references the 'pod-debugger' ClusterRole and binds it to the 'development' group, the administrator ensures that only members of that group can use the role's permissions within that specific project. This is the standard OpenShift/Kubernetes pattern for scoping cluster-defined roles to a single namespace.

Answer

Modify the 'pod-debugger' ClusterRole directly to include a namespace selector for 'app-dev'.

Answer

Create a Role in the 'app-dev' namespace and assign it to the 'pod-debugger' subject.

Answer

Create a ClusterRoleBinding for the 'development' group pointing to 'pod-debugger'.

Question 7

An administrator is configuring authentication in OpenShift. Which TWO of the following identity provider types are natively supported by the OpenShift OAuth server? (Choose TWO)

Accepted Answer

HTPasswd. Option A (HTPasswd) is correct because the OpenShift OAuth server natively supports the HTPasswd identity provider, which validates users against a flat file of bcrypt-hashed credentials generated with htpasswd and referenced via the htpasswd secret. Option B (LDAP) is correct because OpenShift ships a built-in LDAP identity provider that binds and searches an LDAPv3 directory (for example via ldap:// or ldaps:// URLs) using configured bindDN, bindPassword, and attribute mappings. The remaining options are not real OpenShift identity provider types: CustomDatabaseProvider and LocalFileAuthService are fabricated names, and ActiveDirectoryNativeProtocol is not a provider — Active Directory is integrated through the LDAP identity provider rather than a dedicated native protocol.

Answer

CustomDatabaseProvider

Answer

LocalFileAuthService

Answer

ActiveDirectoryNativeProtocol

Question 8

An administrator needs to deploy a Helm chart into an OpenShift cluster while overriding specific chart values using a local YAML file. Which Helm CLI command should be executed?

Accepted Answer

helm install my-release my-chart --values overrides.yaml. The Helm CLI command to install a chart with value overrides from a file is 'helm install --values '. The '--values' (or '-f') flag loads a YAML file whose keys override the chart's default values.yaml, and 'helm install' performs the initial deployment into the cluster.

Answer

helm push my-chart --override overrides.yaml

Answer

helm deploy my-release my-chart --values overrides.yaml

Answer

helm apply -f overrides.yaml my-chart

Question 9

An OpenShift administrator needs to trigger a rollback of a Deployment to its previous working revision after a failed update. Which oc command should be used?

Accepted Answer

oc rollout undo deployment/my-app. The correct command to rollback a Deployment to its previous revision is oc rollout undo deployment/my-app. This command reverts the Deployment to the last successful revision.

Answer

oc update deployment/my-app --revision=previous

Answer

oc revert deployment/my-app

Answer

oc rollback deployment/my-app

Question 10

Which access mode specifies that a volume can be mounted as read-write by a single node?

Accepted Answer

ReadWriteOnce. ReadWriteOnce (RWO) is the access mode that allows a PersistentVolume to be mounted as read-write by a single node at a time. This is the most common mode for block-backed storage such as AWS EBS, GCE PD, and Ceph RBD, where the underlying device cannot be safely shared across nodes. It does not restrict the number of pods on that node — multiple pods on the same node can share the volume.

Answer

WriteOnceMany

Answer

ReadOnlyMany

Answer

ReadWriteMany

Question 11

An administrator is managing service accounts and wants to understand how tokens work in OpenShift 4.14+. Which TWO statements are correct regarding ServiceAccount tokens in this version? (Choose TWO)

Accepted Answer

Long-lived API tokens are no longer automatically created as secrets when a new ServiceAccount is created.. Option D is correct because starting with OpenShift 4.14 (aligned with Kubernetes 1.24+ behavior), the legacy behavior of automatically generating a long-lived token Secret alongside every new ServiceAccount was removed, so no token Secret is created unless explicitly requested. Option E is correct because the modern mechanism uses the TokenRequest API to issue bound service account tokens that are audience-scoped, time-bound (expiring, typically via projected volumes), and ephemeral rather than permanent. Option A is wrong because ServiceAccounts remain a core, fully supported identity mechanism and are not deprecated in favor of OAuth user objects. Option B is wrong because tokens are delivered via projected volumes or the TokenRequest API, not stored in plaintext ConfigMaps. Option C is wrong because ServiceAccounts still authenticate to the Kubernetes API server using their bound tokens.

Answer

Service accounts are now deprecated in favor of OAuth user objects.

Answer

Tokens must be stored in plaintext ConfigMaps for pods to read them.

Answer

Service accounts can no longer authenticate against the Kubernetes API server.

Question 12

An administrator needs to list all persistent volume claims in the cluster that are currently stuck in the 'Pending' state. Which command can be combined with grep or custom formatting to identify them?

Accepted Answer

oc get pvc --all-namespaces. PersistentVolumeClaims are namespaced resources, so listing them across the entire cluster requires the '--all-namespaces' flag. The command 'oc get pvc --all-namespaces' returns every PVC in every namespace, and the output can be piped to grep or formatted with -o wide/custom-columns to filter for those in Pending state. This is the correct base command for identifying stuck PVCs cluster-wide.

Answer

oc describe storage-cluster

Answer

oc adm storage pending

Answer

oc get pv --status=Pending

Question 13

An administrator is auditing Security Context Constraints and wants to identify which settings can be controlled within a custom SCC definition. Which THREE fields are valid configuration options inside an SCC resource? (Choose THREE)

Accepted Answer

requiredDropCapabilities. Option C, requiredDropCapabilities, is a valid SCC field that lists Linux capabilities (e.g., KILL, MKNOD, SYS_ADMIN) which are dropped from all containers, and it is commonly used to enforce a baseline of reduced privileges. Option D, allowPrivilegedContainer, is a valid boolean SCC field that determines whether a pod may request a privileged container, directly controlling a key privilege-escalation vector. Option E, volumes, is a valid SCC field that enumerates the volume plugin types (such as configMap, emptyDir, hostPath, persistentVolumeClaim) a pod is permitted to use, restricting host-level storage access. The unmarked options do not belong because routeAdmissionLimit and networkPolicyMode are not fields in the OpenShift SecurityContextConstraints API; route and network policy behavior is governed by other resources like Route and NetworkPolicy objects, not by SCCs.

Answer

routeAdmissionLimit

Answer

networkPolicyMode

Question 14

An application pod needs to discover other pods behind the same headless service. What characteristic defines a headless service?

Accepted Answer

It has spec.clusterIP set to None.. A headless service is defined by setting `spec.clusterIP` to `None`, which tells Kubernetes not to allocate a virtual IP. Instead, DNS returns the individual pod IPs associated with the service, allowing direct pod discovery. This is commonly used for stateful applications where clients need to connect to specific pods.

Answer

It automatically creates an external Route resource.

Answer

It does not have any selector defined in its specification.

Answer

It disables internal container DNS resolution entirely.

Question 15

A cluster administrator wants to restrict a specific storage class so that only members of a designated OpenShift project can create PVCs referencing it. How is this typically enforced in OpenShift?

Accepted Answer

Using admission control policies or validation webhooks to restrict StorageClass usage by namespace.. OpenShift does not natively support per-namespace StorageClass restrictions in the StorageClass spec itself, so enforcement is typically done through admission control — either a ValidatingAdmissionPolicy, a custom validating webhook, or OPA/Gatekeeper constraints that inspect PVC creation requests and reject those referencing a restricted StorageClass from unauthorised namespaces. This is the standard pattern for multi-tenant storage isolation.

Answer

By assigning RBAC RoleBindings to the StorageClass object directly.

Answer

By setting accessMode: Restricted in the StorageClass metadata.

Answer

By adding a namespaces array directly in the StorageClass spec.