EX280 Practice Test 4 — 25 Questions

Question 1

A developer wants to track multiple versions and tags of container images within an OpenShift cluster efficiently. Which OpenShift resource provides this capability?

Accepted Answer

ImageStream. An ImageStream is an OpenShift resource that acts as an abstraction layer over container images, allowing you to track multiple versions and tags of an image. It maintains a history of image changes and provides a stable reference that can trigger builds and deployments when new images are pushed or tagged. This makes it ideal for efficiently managing image versions and tags within the cluster.

Answer

Route

Answer

DeploymentConfig

Answer

BuildConfig

Question 2

Which command is used to delete a PersistentVolumeClaim named 'my-app-pvc' in the current project?

Accepted Answer

oc delete pvc my-app-pvc. 'oc delete pvc my-app-pvc' is the correct syntax to remove a PersistentVolumeClaim in the current project. The 'oc delete' verb works uniformly across resource types, and 'pvc' is the accepted short name for PersistentVolumeClaim. The current namespace is used unless -n is specified.

Answer

oc remove pvc my-app-pvc

Answer

oc destroy pvc my-app-pvc

Answer

oc prune pvc my-app-pvc

Question 3

When performing a 'rollout undo' on a Deployment, what is the default behavior if no revision is specified?

Accepted Answer

Roll back to the previous revision. The `oc rollout undo` command (and its kubectl equivalent) defaults to reverting a Deployment to the immediately preceding revision when no `--to-revision` flag is supplied. OpenShift tracks each DeploymentConfig/Deployment revision via ReplicaSets, and the undo operation simply scales up the prior ReplicaSet while scaling down the current one. This makes 'previous revision' the implicit target, not revision 1 or the initial state.

Answer

Delete the current deployment

Answer

Return to the state at initial deployment

Answer

Roll back to revision 1

Question 4

An administrator needs to create a Route that handles multiple subdomains or redirects insecure HTTP traffic to HTTPS automatically. Where is the insecure traffic redirect configured?

Accepted Answer

insecureEdgeTerminationPolicy: Redirect. In OpenShift, a Route's TLS configuration includes the `insecureEdgeTerminationPolicy` field, which controls how non-TLS (HTTP) traffic is handled when the Route is configured for edge or re-encrypt termination. Setting it to `Redirect` makes the router automatically issue an HTTP 302 redirect to the HTTPS URL, ensuring all insecure traffic is upgraded. This is the standard, supported mechanism for enforcing HTTPS on a Route.

Answer

route.openshift.io/handling: insecure-redirect

Answer

tls.allowInsecure: true

Answer

spec.redirectHTTP: enabled

Question 5

An administrator is troubleshooting a failed cluster upgrade in OpenShift 4.14. The upgrade channel is set to 'stable-4.14', but the cluster refuses to update to the latest target version. The administrator runs 'oc get clusterversion' and notes that a specific ClusterOperator reports 'Degraded=True'. What is the recommended next step?

Accepted Answer

Describe or inspect the degraded ClusterOperator to identify the root cause and resolve its configuration or resource issues.. The Cluster Version Operator (CVO) blocks upgrades when any ClusterOperator reports Degraded=True because a degraded operator indicates an unhealthy cluster component that could cause the upgrade to fail or leave the cluster in an unstable state. The correct next step is to investigate the specific degraded operator using 'oc describe clusteroperator ' or 'oc get clusteroperator -o yaml' to identify the root cause, such as misconfiguration, missing resources, or failing pods. Once the underlying issue is resolved and the operator reports Available=True and Degraded=False, the upgrade can proceed normally. This aligns with OpenShift's design principle that upgrades should only occur on a healthy cluster.

Answer

Switch the upgrade channel to 'fast-4.14' to bypass the degraded check.

Answer

Delete the Cluster Version Operator deployment to force a reset of the upgrade state machine.

Answer

Force the upgrade by running 'oc adm upgrade --to=<version> --force-ignore-degraded'.

Question 6

You need to create a Role that allows reading and writing ConfigMaps and Secrets only within the 'database' project. Which API groups and resource types should be included in the rules?

Accepted Answer

apiGroups: [''], resources: ['configmaps', 'secrets'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']. ConfigMaps and Secrets belong to the core API group, represented as an empty string ('') in RBAC rules. The correct verbs for read and write access are get, list, watch (read) and create, update, patch, delete (write). This Role, when bound within the 'database' project via a RoleBinding, grants the intended permissions.

Answer

apiGroups: ['rbac.authorization.k8s.io'], resources: ['roles', 'rolebindings'], verbs: ['*']

Answer

apiGroups: [''], resources: ['pods/exec'], verbs: ['create']

Answer

apiGroups: ['apps'], resources: ['configmaps', 'secrets'], verbs: ['*']

Question 7

Which THREE troubleshooting steps should an administrator take when a newly created Route fails to resolve or connect? (Choose THREE)

Accepted Answer

Check that the Route hostname resolves correctly via DNS to the cluster router IP.. Option B is correct because a Route only works if its hostname resolves via DNS to the cluster's router (Ingress controller) IP; if DNS points elsewhere or does not resolve, clients cannot reach the route. Option C is correct because a Route forwards to a Service, and if that Service has no active endpoints (e.g., selector mismatch or unready pods), the router returns 503 and the route appears broken. Option D is correct because the Ingress controller operator/router logs record routing errors such as missing TLS secrets, invalid route admission, or backend failures, making them the primary diagnostic source. Option A is wrong because reinstalling the entire cluster storage operator is unrelated to Route resolution and would not fix DNS, Service, or router issues. Option E is wrong because modifying kube-apiserver certificates is a destructive, unrelated action that does not affect Route hostname resolution or backend connectivity.

Answer

Reinstall the entire cluster storage operator.

Answer

Modify the cluster kube-apiserver certificates.

Question 8

An administrator has modified a KubeletConfig resource to adjust the pod eviction thresholds on worker nodes. After applying the change, the administrator observes that some worker nodes are updating while others belonging to a custom worker pool are not. What is the most likely reason?

Accepted Answer

The KubeletConfig's machineConfigPoolSelector does not match the labels on the custom MachineConfigPool.. The KubeletConfig resource uses a machineConfigPoolSelector to target specific MachineConfigPools (MCPs). If the selector does not match the labels on the custom worker pool's MCP, the KubeletConfig will not be applied to nodes in that pool. This is the most likely reason why some nodes update while others do not.

Answer

KubeletConfig objects are only supported on control plane nodes in OpenShift 4.14.

Answer

The cluster storage size is insufficient to hold the new kubelet configuration.

Answer

The kubelet service must be manually restarted on every node using SSH.

Question 9

Which SCC is assigned by default to authenticated users who are not service accounts?

Accepted Answer

restricted. In OpenShift, authenticated users who are not service accounts are automatically granted the 'restricted' SCC (and in newer versions restricted-v2) via the system:authenticated group binding. This is the default least-privilege SCC that allows pods to run without root, with dropped capabilities. It is assigned by the cluster's default SCC admission configuration, not by any user action.

Answer

anyuid

Answer

nonroot

Answer

privileged

Question 10

A DeploymentConfig in OpenShift has a Rolling strategy defined. Which parameter in the strategy configuration controls the maximum number of pods that can be created above the desired replica count during the update?

Accepted Answer

maxSurge. In OpenShift's DeploymentConfig Rolling strategy, maxSurge specifies the maximum number of pods that can be created beyond the desired replica count during an update. This allows the deployment to temporarily exceed the desired number of replicas to ensure zero downtime. For example, if replicas=3 and maxSurge=1, the deployment can have up to 4 pods at once. This parameter is defined in the strategy's rollingParams section.

Answer

interval

Answer

updatePeriodSeconds

Answer

maxUnavailable

Question 11

A system administrator needs to revoke the 'admin' role from user 'bob' in the 'finance' project without deleting the project or affecting other users. Which command should be used?

Accepted Answer

oc adm policy remove-role-from-user admin bob -n finance. The correct command to revoke a role from a user in a specific project is 'oc adm policy remove-role-from-user admin bob -n finance'. This command removes the role binding that grants the 'admin' role to user 'bob' in the 'finance' namespace, without affecting other users or the project itself.

Answer

oc revoke role admin bob --namespace=finance

Answer

oc delete user bob -n finance

Answer

oc remove-user bob --project=finance

Question 12

A cluster administrator has deleted a PersistentVolumeClaim, but the underlying PersistentVolume still exists in the cluster with a Released status and its data remains intact on the storage backend. What is the most likely cause of this behavior?

Accepted Answer

The persistentVolumeReclaimPolicy of the PersistentVolume was set to Retain.. When a PVC is deleted, the PersistentVolume's reclaim policy determines what happens to the underlying storage. If the PV's persistentVolumeReclaimPolicy is set to Retain, the PV transitions to Released status and the data on the backend is preserved; the PV must be manually reclaimed or deleted by an administrator. This exactly matches the described behavior.

Answer

The StorageClass associated with the PV has allowVolumeExpansion set to false.

Answer

The volume access mode was configured as ReadWriteMany instead of ReadWriteOnce.

Answer

The PVC was protected by a finalizer that prevented immediate deletion.

Question 13

Which tool would you use to package an application including its dependencies and configuration for easy distribution in OpenShift?

Accepted Answer

Helm. Helm is a package manager for Kubernetes/OpenShift that bundles application manifests, dependencies, and configuration into a single chart for easy distribution and versioned installation. It supports templating, values files, and dependency management, making it the standard tool for packaging and distributing applications. The other options are build or configuration tools, not packaging/distribution tools.

Answer

oc build

Answer

Kustomize

Answer

S2I

Question 14

You need to ensure that a specific ServiceAccount named 'builder-sa' in the 'cicd' project can use the 'privileged' SecurityContextConstraints. Which command accomplishes this?

Accepted Answer

oc adm policy add-scc-to-user privileged system:serviceaccount:cicd:builder-sa. `oc adm policy add-scc-to-user privileged system:serviceaccount:cicd:builder-sa` is the correct command to grant the 'privileged' SCC to the 'builder-sa' ServiceAccount in the 'cicd' project. It adds the ServiceAccount to the SCC's users list, allowing pods running as that SA to request privileged access.

Answer

oc annotate serviceaccount builder-sa scc=privileged -n cicd

Answer

oc set scc privileged --serviceaccount=builder-sa -n cicd

Answer

oc create rolebinding privileged-binding --clusterrole=privileged --serviceaccount=cicd:builder-sa

Question 15

A user creates a PVC, but the storage backend fails to provision the volume. Where can the administrator look to find detailed error messages emitted by the external provisioner controller?

Accepted Answer

Review the logs of the CSI external provisioner controller pod in its management namespace.. When a PVC fails to provision, the external provisioner sidecar (e.g., csi-provisioner) running alongside the CSI driver controller is the component that actually calls the storage backend's CreateVolume API and logs the resulting errors. In OpenShift, CSI controller pods run in the driver's management namespace (typically openshift-cluster-csi-drivers or the operator's namespace), so reviewing that pod's logs reveals the detailed backend error messages.

Answer

Run 'oc adm diagnostics storage'.

Answer

Inspect the container image registry logs.

Answer

Check /var/log/messages on the control plane nodes.

Question 16

A cluster administrator needs to inspect the current bindings and capacities of all PersistentVolumes across the entire OpenShift cluster. Which CLI command should be used?

Accepted Answer

oc get pv. PersistentVolumes (PVs) are cluster-scoped resources in OpenShift/Kubernetes, so 'oc get pv' lists every PV in the cluster along with its capacity, access modes, reclaim policy, status, and claim binding. Because PVs are not namespaced, no --all-namespaces flag is needed or accepted. This single command gives the administrator the complete cluster-wide view of bindings and capacities requested.

Answer

oc get pvc --all-namespaces

Answer

oc describe storage

Answer

oc get volume

Question 17

A cluster operator is reviewing the volume snapshot implementation in an OpenShift 4.14 environment. Which THREE components or resources are required to successfully perform and manage volume snapshots? (Choose THREE)

Accepted Answer

A CSI driver that implements snapshot/restore GRPC services. Option A is correct because volume snapshots in OpenShift depend on a CSI driver that implements the snapshot/restore gRPC services (the external-snapshotter sidecar and CSI snapshotter capability), which actually creates and restores the snapshots on the storage backend. Option B is correct because a VolumeSnapshotClass defines the CSI driver and deletion policy used when provisioning a VolumeSnapshot, and it must exist for the snapshot to be dynamically created. Option D is correct because the VolumeSnapshot object is the user-facing resource that requests the snapshot and tracks its status and restore point. Option C is not required, since snapshot operations are governed by RBAC on the snapshot resources rather than a default ClusterRoleBinding for system:authenticated users. Option E is not required, as NetworkPolicy controls pod network traffic and is unrelated to provisioning or managing volume snapshots.

Answer

A default ClusterRoleBinding for system:authenticated users

Answer

NetworkPolicy resources restricting snapshot traffic

Question 18

A stateful application needs its PersistentVolume to be bound only after the pod requesting it is assigned to a specific worker node, to avoid topology mismatch issues. Which StorageClass parameter achieves this?

Accepted Answer

volumeBindingMode: WaitForFirstConsumer. The volumeBindingMode: WaitForFirstConsumer parameter in a StorageClass delays volume binding until a pod using the PVC is scheduled. This ensures that the PersistentVolume is provisioned in the same topology zone as the node where the pod runs, preventing topology mismatch. It is the correct setting for stateful applications that require node-local or zone-specific storage.

Answer

allowVolumeExpansion: true

Answer

volumeBindingMode: Immediate

Answer

bindingMode: Late

Question 19

An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?

Accepted Answer

In the 'openshift-config' namespace as a Secret referenced by the OAuth configuration. When configuring an LDAP identity provider in OpenShift, the bind DN password must be stored as a Secret in the 'openshift-config' namespace and referenced in the OAuth configuration. This is the required location for sensitive credentials used by the OAuth server to authenticate against LDAP.

Answer

On each worker node at '/etc/origin/master/ldap.pass'

Answer

As an environment variable on the oauth-openshift deployment

Answer

In the 'openshift-authentication' namespace as a ConfigMap

Question 20

An administrator is troubleshooting a certificate signing request (CSR) that is stuck in the Pending state for a newly added worker node. Which command should they use to approve the pending CSR?

Accepted Answer

oc adm certificate approve . `oc adm certificate approve ` is the documented OpenShift command to approve a pending CSR, which triggers the signer controller to issue the node client certificate. It is the standard administrative action for unblocking node bootstrap. The command is idempotent and safe to re-run.

Answer

oc cluster-version approve-csr <csr-name>

Answer

oc patch csr <csr-name> --type=json -p='[{"op": "replace", "path": "/status/conditions", "value": "Approved"}]'

Answer

oc approve csr <csr-name>