EX280 Practice Test 3 — 25 Questions

Question 1

An administrator notices that Ingress controller logs show frequent health check failures for backend pods. Where can the administrator check or configure the liveness and readiness probes that dictate pod health for service endpoints?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the IngressController custom resource spec. Liveness and readiness probes are configured directly within the Pod template spec of the Deployment or Pod resource.

Answer

In the Service specification under healthCheckNodePort

Answer

In the DNS operator configuration

Question 2

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

Accepted Answer

The cluster OAuth custom resource named cluster. LDAP identity providers are configured inside the cluster-scoped OAuth custom resource under the spec.identityProviders array.

Answer

A Secret named identity-provider in the openshift-authentication namespace

Answer

An Authentication custom resource named cluster in the kube-system namespace

Answer

A ConfigMap named ldap-config in the openshift-config namespace

Question 3

An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?

Accepted Answer

backend.production.svc.cluster.local. The standard FQDN format for a Kubernetes service is ..svc.cluster.local.

Answer

backend.production.pod.cluster.local

Answer

backend.production.router.default.svc

Answer

svc.production.backend.cluster.local

Question 4

A cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?

Accepted Answer

A custom label defined in the namespaceSelector of the NetworkPolicy spec. When using namespaceSelector in a NetworkPolicy, the target namespace must be labeled appropriately so the label matches the selector criteria specified in the ingress rule.

Answer

openshift.io/cluster-monitoring=true

Answer

security.openshift.io/scc=restricted

Answer

kubernetes.io/metadata.name matching the namespace name

Question 5

An OVN-Kubernetes clustered environment requires configuring egress IP functionality for a specific namespace so that all outgoing traffic from pods in that namespace appears to originate from a designated external IP address. Which custom resource must be configured?

Accepted Answer

EgressIP. In OVN-Kubernetes, EgressIP is a native custom resource used to assign a dedicated external IP to specific pods or namespaces.

Answer

ClusterNetwork

Answer

HostSubnet

Answer

EgressRouter

Question 6

An administrator running OpenShift 4.14 wants to configure automatic approval for an Operator subscription updates using the Operator Lifecycle Manager. Which field and value in the Subscription resource must be set?

Accepted Answer

Set 'spec.installPlanApproval: Automatic'. Subscriptions have an installPlanApproval field which can be set to 'Automatic' or 'Manual'. Setting it to 'Automatic' allows OLM to automatically install updates.

Answer

Set 'spec.channel.autoApprove: yes'

Answer

Set 'spec.autoUpgrade: true'

Answer

Set 'spec.approvalStrategy: Immediate'

Question 7

An administrator notices that a worker node is in a 'NotReady' state due to a storage failure. The administrator successfully replaces the underlying physical machine and wants to clear the old node object from the OpenShift 4.14 cluster. Which command should be used?

Accepted Answer

oc delete node worker-old. Once a node is drained or permanently offline, the administrator can delete the node resource using 'oc delete node <node-name>'.

Answer

oc adm cordon worker-old --purge

Answer

oc patch machine worker-old --type=merge -p '{"spec":{"deleted":true}}'

Answer

oc remove node-status worker-old

Question 8

An administrator wants to apply kernel arguments to all worker nodes in an OpenShift 4.14 cluster using the Machine Config Operator. After creating a new MachineConfig object, the administrator notices that the worker nodes are not updating and the MachineConfigPool status shows 'Updating=False'. What is the most likely cause?

Accepted Answer

The MachineConfig object lacks the correct labels required to associate it with the target MachineConfigPool.. The MachineConfig object must include valid labels matching the MachineConfigPool node selector (e.g., pools.operator.machineconfiguration.openshift.io/worker: '') so the Machine Config Operator knows which pool to target.

Answer

The administrator forgot to run 'oc adm upgrade --force' to trigger node reboots.

Answer

The Cluster Version Operator must be manually restarted to detect new MachineConfig definitions.

Answer

The cluster storage provider must be re-initialized to support kernel argument persistence.

Question 9

An administrator needs to ensure that if a worker node freezes or becomes unresponsive for more than 5 minutes, the cluster automatically remediates it by deleting and recreating the underlying virtual machine instance. Which OpenShift 4.14 feature should the administrator configure?

Accepted Answer

MachineHealthCheck. MachineHealthCheck allows administrators to define criteria (such as node not ready conditions) and automatically remediate unhealthy nodes by deleting their corresponding Machine objects.

Answer

NodeAutoscaler

Answer

MachineConfigPool

Answer

ClusterAutoscaler

Question 10

An administrator wants to test network connectivity from a pod named 'app-pod-1' to a service port on 'backend-service' using TCP. Which tool is commonly available and ideal for testing TCP port connectivity inside a container?

Accepted Answer

nc. nc (netcat) or telnet or curl are commonly used tools, but nc/netcat is standard for raw TCP connectivity checks.

Answer

ifconfig

Answer

traceroute

Answer

ping

Question 11

An administrator needs to temporarily prevent the Machine Config Operator from applying pending MachineConfig changes to the worker nodes while performing troubleshooting. How should the administrator accomplish this?

Accepted Answer

Patch the worker MachineConfigPool to set 'spec.paused: true'.. To pause updates on a set of nodes, the administrator can set the 'paused: true' field on the corresponding MachineConfigPool resource.

Answer

Delete all pending MachineConfig objects from the cluster.

Answer

Scale down the machine-config-operator deployment in openshift-machine-config-operator to zero replicas.

Answer

Annotate all worker nodes with 'machineconfiguration.openshift.io/paused=true'.

Question 12

An administrator creates a NetworkPolicy that restricts egress traffic from a namespace. However, DNS resolution for external services immediately stops working. What is the cause of this behavior?

Accepted Answer

The NetworkPolicy blocks outbound traffic to port 53 on the cluster DNS service.. Pods rely on CoreDNS services for name resolution. If egress rules are applied without explicitly allowing UDP/TCP traffic to port 53 on the cluster DNS service or cluster CIDR, DNS queries are blocked.

Answer

NetworkPolicies automatically disable the OpenShift SDN controller.

Answer

CoreDNS pods do not have valid security context constraints.

Answer

External DNS servers reject requests originating from OpenShift node IPs.

Question 13

Which OpenShift 4.14 operator provides a catalog of certified third-party and Red Hat operators available for cluster installation?

Accepted Answer

OperatorHub / Cluster Catalog Operator. OperatorHub is the mechanism and user interface catalog powered by the Cluster Catalog Operators where administrators discover and install operators.

Answer

Console Operator

Answer

Machine API Operator

Answer

Cluster Version Operator

Question 14

An administrator configures an Ingress resource in the 'web-apps' namespace to route traffic using the default OpenShift Ingress controller. The Ingress creation succeeds, but traffic to the hostname returns a 404 error. What is a common reason for this behavior in OpenShift?

Accepted Answer

The Ingress resource is missing the spec.ingressClassName set to the default OpenShift ingress class name.. OpenShift natively uses Route objects. While Ingress is supported, the Ingress controller watches Ingress objects, but custom annotations or missing paths/backend configurations or default controller sharding often require ensuring the Ingress class or annotations match the default router configuration. Alternatively, Ingress controllers in OpenShift require the ingress class name to be specified correctly (e.g., 'openshift-default').

Answer

Ingress hostnames must end with the exact string '.internal.cloudapp.net'.

Answer

Ingress objects require a ServiceMeshControlPlane to function properly in OpenShift.

Answer

OpenShift completely ignores Ingress resources and only processes Route objects.

Question 15

An OpenShift 4.14 cluster administrator has installed an Operator from OperatorHub into a custom namespace using a Subscription. The administrator notices that the Operator pod is not being created. Upon checking the Subscription, the installation mode is set to AllNamespaces, but the Operator target namespace is restricted. Which Operator Lifecycle Manager (OLM) object should the administrator inspect to troubleshoot why the CSV (ClusterServiceVersion) is not installing?

Accepted Answer

Inspect the OperatorGroup in the target namespace to ensure its targetNamespaces match or support the Subscription scope.. When using OLM, the OperatorGroup defines the namespace scope where Operators can be installed. If the OperatorGroup does not match the Subscription's install mode, the CSV will not install.

Answer

Check the MachineConfigPool for paused reconciliation flags.

Answer

Review the ClusterVersion resource status for pending updates.

Answer

Inspect the KubeletConfig custom resource for validation errors.

Question 16

Which TWO components are core parts of the OpenShift DNS architecture for cluster resolution? (Choose TWO)

Accepted Answer

CoreDNS. CoreDNS is deployed by the Cluster DNS Operator to provide internal name resolution for pods and services.

Answer

BIND9

Answer

HAProxy DNS module

Answer

Keepalived DNS plugin

Question 17

An administrator creates a Route with a specific hostname, but multiple Ingress controllers exist in the cluster. How does the Route know which Ingress controller should serve it?

Accepted Answer

By specifying the corresponding label selector in the Route spec under 'wildcardPolicy' or router selection annotations.. Routes specify which Ingress controller should serve them using the 'ingressControllers' label selector or by referencing the router name in the route spec / namespace annotations.

Answer

By adding the Ingress controller IP directly to the Route spec targetPort.

Answer

All routes are automatically served by every Ingress controller without exception.

Answer

Routes cannot be assigned to specific Ingress controllers.

Question 18

What is the purpose of the 'oc adm drain' command during cluster maintenance?

Accepted Answer

To mark a node unschedulable and gracefully evict workloads running on it.. The 'oc adm drain' command cordons the node and safely evicts all pods from it, allowing maintenance to be performed.

Answer

To restart the kubelet service and flush local DNS caches.

Answer

To permanently delete the node and its virtual machine instance from the cloud provider.

Answer

To clear container logs and free up disk space on the node filesystem.

Question 19

An administrator troubleshoots a failing NetworkPolicy and wants to verify if the OpenShift SDN or OVN-Kubernetes controller has successfully applied the rules. Where are the controller operator logs examined?

Accepted Answer

In the openshift-network-operator or openshift-ovn-kubernetes namespaces. Network operator logs, such as cluster-networks-operator or ovnkube-controller logs in their respective namespaces, contain synchronization errors and policy status.

Answer

In the openshift-apiserver namespace

Answer

In the kube-system namespace under core-dns logs

Answer

In the openshift-ingress namespace under router pods

Question 20

An administrator is troubleshooting a failed cluster upgrade in OpenShift 4.14. The upgrade channel is set to 'stable-4.14', but the cluster refuses to update to the latest target version. The administrator runs 'oc get clusterversion' and notes that a specific ClusterOperator reports 'Degraded=True'. What is the recommended next step?

Accepted Answer

Describe or inspect the degraded ClusterOperator to identify the root cause and resolve its configuration or resource issues.. Before proceeding with an upgrade, any degraded or failing ClusterOperator must be investigated and resolved because the CVO will block upgrades if core components are not healthy.

Answer

Switch the upgrade channel to 'fast-4.14' to bypass the degraded check.

Answer

Delete the Cluster Version Operator deployment to force a reset of the upgrade state machine.

Answer

Force the upgrade by running 'oc adm upgrade --to=<version> --force-ignore-degraded'.