EX280 Practice Test 2 — 25 Questions

Question 1

An OpenShift cluster administrator needs to ensure that custom S2I builder images stored in an insecure internal registry can be successfully pulled by build pods without failing TLS verification. Where must the insecure registry be defined?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the cluster Image resource configuration (imageregistry.config.openshift.io/cluster or image.config.openshift.io). Insecure registries must be configured in the cluster-wide Image.config.openshift.io/cluster resource (or registry configuration) so the container runtime and build machinery trust the registry.

Answer

In the OAuth client definition

Answer

In the individual BuildConfig strategy environment variables

Answer

In the Project request template metadata

Question 2

You need to perform a canary deployment by shifting traffic between two versions of your app. What is the standard way to accomplish this in OpenShift without using a Service Mesh?

Accepted Answer

Use Route weights. By adjusting the weights of the 'alternate backends' in a Route, you can control traffic splitting.

Answer

Create two separate Routes

Answer

Modify the Deployment strategy

Answer

Use the 'oc scale' command

Question 3

An administrator created a Route but external clients receive a 503 Service Unavailable error when attempting to access it. Upon checking the endpoints of the Service referenced by the Route, the administrator discovers there are zero endpoints listed. What is the most likely cause?

Accepted Answer

The Service selector labels do not match any active Pod labels.. A 503 error with zero endpoints typically indicates that the selector in the Service definition does not match the labels on any running pods.

Answer

The Route YAML has an invalid TLS certificate format.

Answer

The Ingress controller pods have crashed across all worker nodes.

Answer

The cluster DNS operator is degraded.

Question 4

An ImageStream named 'frontend' in a project contains multiple tags, including 'latest' and 'v1.0'. You want to update an existing Deployment to specifically use the 'v1.0' tag of this ImageStream. Where must this reference be updated in the Deployment specification?

Accepted Answer

In the spec.template.spec.containers[].image field pointing to image-registry.openshift-image-registry.svc:5000/namespace/frontend:v1.0.. ImageStreamTags or ImageStreamImages are referenced inside the container image field within the pod template of a Deployment.

Answer

In the spec.imageStreamRef field.

Answer

In the metadata.annotations['openshift.io/image.in-cluster'] field.

Answer

In the spec.strategy.rollingUpdate.image field.

Question 5

You want to trigger a new build automatically whenever the base image in an ImageStream changes. What must be enabled in the BuildConfig?

Accepted Answer

ImageChange trigger. An ImageChange trigger allows the BuildConfig to react to changes in a specific ImageStreamTag.

Answer

Continuous Deployment trigger

Answer

WebHook trigger

Answer

ConfigChange trigger

Question 6

Which tool would you use to package an application including its dependencies and configuration for easy distribution in OpenShift?

Accepted Answer

Helm. Helm is the standard package manager for Kubernetes and OpenShift applications.

Answer

oc build

Answer

Kustomize

Answer

S2I

Question 7

You need to ensure that your application deployment always maintains at least 80% of its desired pod count during a rolling update. Which strategy parameter should you configure?

Accepted Answer

maxUnavailable: 20%. The maxUnavailable parameter defines the maximum number of pods that can be unavailable during the update process. Setting this to 20% ensures 80% availability.

Answer

minReadySeconds: 20

Answer

maxSurge: 20%

Answer

rollingUpdatePeriod: 20%

Question 8

What is the result of using a 'Recreate' strategy during a deployment?

Accepted Answer

Temporary service outage. The Recreate strategy terminates all existing instances before creating any new ones, resulting in a temporary service outage.

Answer

Zero downtime deployment

Answer

Rolling update

Answer

Instant switch

Question 9

An administrator notices that pods on different worker nodes cannot communicate with each other. Upon checking the cluster network operator, it appears the MTU settings between the underlying physical network and the cluster overlay network mismatch. Which OpenShift command checks the cluster network operator status?

Accepted Answer

oc get clusteroperator network. The ClusterNetworkOperator status can be verified by inspecting the operator resource cluster/network.

Answer

oc get cni cluster

Answer

oc describe networkconfig

Answer

oc get nodes --show-mtu

Question 10

An OpenShift administrator needs to inspect how OVN-Kubernetes handles network flows and packet drops on a specific node. Which debugging utility installed in the OVN node container is most effective for viewing OpenFlow rules?

Accepted Answer

ovs-ofctl. ovs-ofctl is used to inspect and manipulate OpenFlow rules in Open vSwitch bridges, which underpin OVN-Kubernetes data paths.

Answer

nmcli connection show

Answer

ethtool -S

Answer

ovn-trace

Question 11

When configuring a custom build strategy, where do you define the Dockerfile to use?

Accepted Answer

In the strategy block of the BuildConfig. In the BuildConfig, under the 'strategy' block, you can specify the Dockerfile context or explicitly define the Dockerfile source.

Answer

In the DeploymentConfig

Answer

In the Build object

Answer

In the ImageStream

Question 12

You have a build that fails because it requires access to a private repository. What is the correct way to provide credentials to the build?

Accepted Answer

Associate a secret with the BuildConfig. You can add a Secret to the BuildConfig that contains the credentials for the private repository.

Answer

Hardcode credentials in the Dockerfile

Answer

Use an environment variable in the deployment

Answer

Mount a ConfigMap

Question 13

An administrator needs to configure a custom default certificate for all routes created in the cluster without specifying a certificate on every individual Route object. Where should this wildcard certificate be configured?

Accepted Answer

In the IngressController resource named 'default' in openshift-ingress-operator. The default certificate for routes is configured in the IngressController custom resource under the 'defaultCertificate' spec.

Answer

In a ConfigMap named 'router-certs' in the default namespace

Answer

In the apiserver.config.openshift.io cluster object

Answer

In the DNS cluster operator configuration

Question 14

Which THREE components are part of a Kustomize configuration?

Accepted Answer

kustomization.yaml. Kustomize uses resources, patches, and a kustomization file to manage deployment overrides.

Answer

BuildConfigs

Answer

Helm Charts

Question 15

An administrator wants to expose a Deployment via a NodePort service. What is the default port range allocated for NodePort services in OpenShift if not explicitly configured otherwise?

Accepted Answer

30000-32767. Kubernetes and OpenShift allocate NodePort services within the standard port range of 30000-32767.

Answer

1024-65535

Answer

80-443

Answer

8000-9000

Question 16

Which OpenShift resource defines the desired state of a containerized application, including replica count and image version?

Accepted Answer

Deployment. A Deployment (or DeploymentConfig) object defines the desired state of the pods.

Answer

Pod

Answer

ImageStream

Answer

Service

Question 17

An OpenShift administrator needs to restrict access so that pods in namespace 'dev' cannot initiate any outbound connections to pods in namespace 'secure-db'. Which resource should be created in namespace 'secure-db' to achieve this?

Accepted Answer

A NetworkPolicy with an empty ingress rule set in namespace 'secure-db'. A NetworkPolicy with ingress rules applied in the destination namespace ('secure-db') controls which sources are allowed to connect to it.

Answer

A NetworkPolicy blocking egress in namespace 'dev'

Answer

A ClusterNetwork policy blocking all cross-namespace traffic cluster-wide

Answer

An EgressFirewall object in namespace 'dev'

Question 18

An administrator needs to modify the default Ingress controller configuration to change its replica count and adjust the router deployment parameters. Which resource should the administrator edit?

Accepted Answer

ingresscontroller.operator.openshift.io named 'default'. The default Ingress controller is managed by the Ingress operator via the 'default' Ingress resource in the operator.openshift.io API group.

Answer

deployment named router-default in openshift-ingress namespace

Answer

configmap named router-config in openshift-ingress-operator

Answer

service named router-default-http in openshift-ingress

Question 19

An OpenShift administrator needs to expose an internal web application securely using a Route that terminates TLS at the router. Which Route type and configuration requires the administrator to provide the certificate, private key, and CA certificate?

Accepted Answer

Edge TLS termination. Edge termination terminates TLS at the Ingress controller/router and requires the user to supply the TLS certificate and key in the Route specification.

Answer

Re-encrypt TLS termination

Answer

Unsecured Route with an external proxy

Answer

Insecure plain HTTP route

Answer

Passthrough TLS termination

Question 20

An OpenShift cluster is configured with a custom Cluster Network CIDR. An administrator needs to verify the cluster network subnet settings and host subnet assignments. Which operator status or configuration resource contains this cluster-wide network configuration?

Accepted Answer

networks.config.openshift.io named 'cluster'. The networks.config.openshift.io cluster singleton resource holds the cluster network, service network, and CNI provider configuration.

Answer

network.operator.openshift.io named 'default'

Answer

cluster-network.openshift.io

Answer

sdn.openshift.io/config