EX280 Practice Test 25 — 15 Questions

Question 1

Which TWO authentication methods are supported by the OpenShift OAuth server?

Accepted Answer

Htpasswd. OpenShift natively supports various identity providers including LDAP and Htpasswd.

Answer

Local file system user list

Answer

Custom SSH keys

Answer

Direct database connection

Question 2

A stateful application needs its PersistentVolume to be bound only after the pod requesting it is assigned to a specific worker node, to avoid topology mismatch issues. Which StorageClass parameter achieves this?

Accepted Answer

volumeBindingMode: WaitForFirstConsumer. Setting volumeBindingMode to WaitForFirstConsumer delays the binding and provisioning of a PersistentVolume until a pod using the PersistentVolumeClaim is created and scheduled.

Answer

allowVolumeExpansion: true

Answer

volumeBindingMode: Immediate

Answer

bindingMode: Late

Question 3

An administrator wants to check the status of all cluster operators, specifically verifying that the Network and DNS operators are healthy. Which command should be run?

Accepted Answer

oc get clusteroperators. The oc get clusteroperators command lists all cluster operators and their availability/health status.

Answer

oc get operators --cluster

Answer

oc describe operators

Answer

oc adm check health

Question 4

Which THREE parameters can be configured within the cluster DNS operator resource (dns.operator/default)? (Choose THREE)

Accepted Answer

Upstream DNS forwarders. The DNS operator allows configuring forwarders, client IP handling, and server blocks/zones.

Answer

The physical MTU size of the cluster worker node network interfaces

Answer

The default HAProxy router replica count

Question 5

An application pod needs to discover other pods behind the same headless service. What characteristic defines a headless service?

Accepted Answer

It has spec.clusterIP set to None.. A headless service is created by setting clusterIP: None, which disables load balancing and returns the IP addresses of the individual pods via DNS.

Answer

It automatically creates an external Route resource.

Answer

It does not have any selector defined in its specification.

Answer

It disables internal container DNS resolution entirely.

Question 6

An administrator configures an EgressFirewall in a namespace to deny all external traffic except for a specific CIDR block. In what order are the rules in an EgressFirewall evaluated?

Accepted Answer

In sequential order (top to bottom), stopping at the first matching rule.. EgressFirewall rules are evaluated in sequential order from top to bottom, and the first matching rule dictates whether traffic is allowed or denied.

Answer

Allow rules are evaluated first, followed by deny rules.

Answer

Deny rules always take precedence over allow rules regardless of order.

Answer

Alphabetically by rule description.

Question 7

An administrator must configure a NetworkPolicy in the 'secure-zone' namespace to explicitly deny all ingress traffic except for TCP traffic coming from pods labeled 'tier=frontend' in the 'frontend-zone' namespace. Which NetworkPolicy specification achieves this?

Accepted Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: secure-zone
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: frontend-zone
      podSelector:
        matchLabels:
          tier: frontend
    ports:
    - protocol: TCP. To allow traffic from another namespace, the policyPeer must use namespaceSelector combined with podSelector. Denying all other ingress requires an empty ingress rule list alongside policyTypes: [Ingress].

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: secure-zone
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - ipBlock:
        cidr: 10.128.0.0/14
    ports:
    - protocol: TCP

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: secure-zone
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          kubernetes.io/metadata.name: frontend-zone
    ports:
    - protocol: TCP

Answer

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-frontend
  namespace: secure-zone
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          tier: frontend
        matchExpressions:
          - key: namespace
            operator: In
            values: [frontend-zone]
    ports:
    - protocol: TCP

Question 8

A service of type NodePort has been created in OpenShift. Within what default port range are NodePort services typically allocated on the worker nodes?

Accepted Answer

30000-32767. Kubernetes and OpenShift allocate NodePort services from the standard port range of 30000-32767.

Answer

50000-60000

Answer

1024-65535

Answer

80-443

Question 9

You want to restore an existing VolumeSnapshot into a new PersistentVolumeClaim. Which field in the PVC specification must reference the VolumeSnapshot?

Accepted Answer

dataSource. To restore from a snapshot, the dataSource (or dataSourceRef) field in the PVC spec must point to the VolumeSnapshot object.

Answer

claimRef

Answer

snapshotName

Answer

volumeName

Question 10

A cluster administrator needs to prevent users from accidentally deleting a VolumeSnapshot while associated PVC restores or clones depend on it. What protection mechanism is active by default in OpenShift?

Accepted Answer

VolumeSnapshot Content Protection finalizers. Kubernetes and OpenShift incorporate finalizers on VolumeSnapshot objects to prevent deletion while downstream references or dependent objects exist.

Answer

OCP Storage Mutating Webhooks

Answer

etcd Object Lock

Answer

StorageClass Retain Policy

Question 11

An administrator needs to create a service that exposes an application externally via an IP address allocated from an external cloud provider load balancer. Which service type must be used?

Accepted Answer

LoadBalancer. A LoadBalancer service type provisions an external load balancer specific to the underlying cloud infrastructure platform.

Answer

NodePort

Answer

ClusterIP

Answer

ExternalName

Question 12

An administrator needs to configure cluster-wide DNS forwarding for a specific custom domain (e.g., 'corp.local') to point to internal corporate DNS servers. Where is this configured in OpenShift 4.14?

Accepted Answer

Edit the DNS resource named 'cluster' and add a spec.servers block with forwardPlugin rules.. Cluster-wide DNS forwarding is configured by modifying the DNS custom resource named 'cluster' to include a forwardPlugin rule.

Answer

Modify the /etc/resolv.conf file on every worker node.

Answer

Create a custom Route with DNS forwarding annotations.

Answer

Edit the Corefile ConfigMap directly in the 'kube-system' namespace.

Question 13

Which TWO methods can an administrator use to inspect or troubleshoot Security Context Constraint (SCC) assignments for a specific ServiceAccount in a namespace?

Accepted Answer

Use oc auth can-i create pods --as=system:serviceaccount:: to test permissions.. Administrators can check SCC assignments by evaluating who can bind to the SCC cluster roles using 'oc adm policy' commands or by checking effective SCCs using 'oc auth can-i'.

Answer

Examine the /etc/origin/master/scc.yaml file on control plane nodes.

Answer

Inspect the service account's annotations for the kubernetes.io/scc-assignment-override key.

Answer

Check the logs of the kube-apiserver static pod for SCC admission failures.

Question 14

Which THREE actions can be performed using the IngressController custom resource? (Choose THREE)

Accepted Answer

Scaling the number of router replicas.. IngressController allows configuring replica counts, setting default TLS certificates, and choosing endpoint publishing strategies.

Answer

Modifying the core Kubernetes API server port.

Answer

Defining the container security context constraints for worker nodes.

Question 15

A cluster administrator needs to inspect the current default CNI network provider configured in an OpenShift 4.14 cluster. Which command or resource should the administrator check?

Accepted Answer

oc get networks.config/cluster -o jsonpath='{.spec.networkType}'. The cluster network operator configuration stores the active cluster network plugin type under spec.defaultNetwork.type.

Answer

oc get dns cluster -o jsonpath='{.spec.baseDomain}'

Answer

oc get proxy cluster -o jsonpath='{.spec.httpProxy}'

Answer

oc get clusterversion version -o jsonpath='{.status.capabilities}'