EX280 Practice Test 4 — 25 Questions

Question 1

A cluster administrator notices that a PVC stuck in the Pending state references a StorageClass with volumeBindingMode set to WaitForFirstConsumer. What action will cause the PVC to bind?

Accepted Answer

Create and schedule a Pod that mounts the PVC.. When volumeBindingMode is WaitForFirstConsumer, the PV is not provisioned or bound until a Pod referencing that PVC is scheduled onto a node.

Answer

Delete the StorageClass and recreate it with Immediate binding mode.

Answer

Restart the kube-apiserver service on the control plane nodes.

Answer

Manually create a PV matching the exact size and labels of the PVC.

Question 2

An administrator wants to prevent automatic updates for an Operator installed via OLM while still allowing manual installation of new versions when desired. Which TWO actions or configurations should be performed? (Choose TWO)

Accepted Answer

Approve generated InstallPlans selectively using 'oc patch installplan' or via the web console when an update is desired.. To prevent automatic updates, set installPlanApproval to Manual and approve install plans manually when ready.

Answer

Scale the OLM operator pods to zero.

Answer

Delete the CatalogSource resource entirely.

Answer

Annotate the Subscription with 'olm.openshift.io/block-updates=true'.

Question 3

You need to provide temporary scratch space for a container that shares the pod's lifetime and is cleared when the pod is deleted. Which volume type should you configure in the Pod specification?

Accepted Answer

emptyDir. An emptyDir volume is created when a pod is assigned to a node, and exists as long as that pod is running on that node. It starts empty.

Answer

persistentVolumeClaim

Answer

hostPath

Answer

nfs

Question 4

Which TWO of the following are valid OpenShift Service types? (Choose TWO)

Accepted Answer

ClusterIP. Kubernetes and OpenShift support several standard service types, among which ClusterIP and NodePort are core native types.

Answer

NetworkPort

Answer

RouteIP

Answer

ContainerPort

Question 5

An administrator wants to verify node configuration application status. Which TWO indicators show that a MachineConfigPool has successfully finished applying a new MachineConfig? (Choose TWO)

Accepted Answer

The 'UpdatedMachineCount' equals the 'MachineCount' in the pool status.. A successfully updated MachineConfigPool will show Updating=False and Updated=<total-nodes> matching machine counts.

Answer

The 'ClusterVersion' status reads 'Updating'.

Answer

The pool status condition 'Paused' is set to True.

Answer

The 'DegradedMachineCount' is greater than zero.

Question 6

An administrator needs to inspect all StorageClasses available in an OpenShift cluster using the OpenShift CLI. Which command should be executed?

Accepted Answer

oc get sc. The 'oc get storageclass' (or sc) command lists all StorageClasses defined in the cluster.

Answer

oc describe storageclasses

Answer

oc get pvc

Answer

oc get pv

Question 7

Which THREE actions can be performed when managing Route objects in OpenShift? (Choose THREE)

Accepted Answer

Specifying TLS termination as edge, passthrough, or reencrypt. Routes support custom hostnames, path-based routing, and multiple TLS termination modes.

Answer

Attaching a container storage volume directly inside the Route spec

Answer

Allocating a direct BGP peering session from the Route object

Question 8

A cluster administrator wants to create a VolumeSnapshot of a database PVC. Which API group must the VolumeSnapshotClass belong to?

Accepted Answer

snapshot.storage.k8s.io. Volume snapshots are managed by the snapshot.storage.k8s.io API group.

Answer

storage.k8s.io

Answer

csi.storage.k8s.io

Answer

volumesnapshot.openshift.io

Question 9

A security engineer needs to configure the cluster-wide OAuth identity provider to use an existing LDAP server. The administrator creates an LDAP identity provider object in the cluster OAuth configuration resource (cluster). Which configuration property specifies the attribute mapping to map the LDAP entry's unique identifier to the OpenShift user name?

Accepted Answer

mappingMethod: lookup with attributes.id set to the unique attribute like uid or sAMAccountName.. The LDAP identity provider configuration requires defining attribute mapping fields such as id, preferredUsername, name, and email. The id field maps the unique LDAP attribute to the OpenShift username.

Answer

url specifying the bind DN and attributes.username set to cn.

Answer

identityProviders.ldap.mapping.rules pointing to a ConfigMap containing user maps.

Answer

bindPassword referencing a Secret containing the attribute translation matrix.

Question 10

An administrator is troubleshooting an Operator installed via OperatorHub whose pods are failing to pull images because the Operator's subscription namespace lacks access to the global pull secret. How can the administrator configure OLM to use a custom pull secret for an Operator in a specific namespace?

Accepted Answer

Add the image pull secret to the ServiceAccount used by the Operator deployment in the target namespace.. Administrators can link a pull secret to the ServiceAccount used by the Operator's CSV or patch the operator's deployment/subscription depending on OLM version, or add the pull secret to the default ServiceAccount in that namespace.

Answer

Modify the global ClusterVersion resource with the namespace-specific pull secret.

Answer

Edit the CatalogSource resource to inject credentials into the CSV.

Answer

Annotate the OperatorGroup with 'olm.openshift.io/pull-secret=true'.

Question 11

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

Accepted Answer

In the Deployment configuration spec under template.spec.imagePullSecrets. Image pull secrets can be specified directly in the pod spec under imagePullSecrets, or linked to the ServiceAccount used by the pod.

Answer

As an annotation on the cluster-scoped Namespace object

Answer

Inside the Route object spec under tls.imagePullSecret

Answer

As an environment variable named IMAGE_PULL_SECRET in the container specification

Question 12

An administrator wants to stream logs from all pods belonging to a specific Deployment named 'web-frontend' in real-time. Which command achieves this?

Accepted Answer

oc logs deployment/web-frontend -f. oc logs supports targeting a Deployment directly via the resource type, streaming logs from all associated pods.

Answer

oc watch deployment/web-frontend

Answer

oc logs pods -l app=web-frontend

Answer

oc rsh deployment/web-frontend

Question 13

An administrator wants to prevent developers from creating pods that run as the root user across the entire cluster. Which OpenShift resource or admission mechanism is best suited to enforce this restriction globally?

Accepted Answer

Modifying the restricted-v2 SCC to ensure root execution is disallowed via user ID restrictions. OpenShift enforces user restrictions cluster-wide primarily through Security Context Constraints (SCC) where runAsUser.type is set to MustRunAsRange or MustRunAs, restricting root execution.

Answer

Disabling the ServiceAccount controller in the cluster operator configuration

Answer

Adding a cluster-wide ValidatingWebhookConfiguration that intercepts Route creations

Answer

Creating a global ConfigMap in the openshift-config namespace named root-blocker

Question 14

A cluster administrator has created a VolumeSnapshotClass and a VolumeSnapshot object targeting an active PVC. However, the VolumeSnapshot status never shows ready to use, and the underlying storage provider logs indicate snapshot creation failed due to missing cluster permissions. Which core OpenShift operator is primarily responsible for managing volume snapshot controllers and CRDs in OpenShift 4.14?

Accepted Answer

The Cluster Storage Operator. The OpenShift Storage Operator or specialized CSI operator handles deployment of the snapshot controller, but the cluster-storage-operator or ODF operator manages the storage stack components. Specifically, snapshot validation and controller logic are typically driven by the external snapshot controller deployed via the Cluster Storage Operator or CSI addon operator.

Answer

The Ingress Operator

Answer

The Authentication Operator

Answer

The Machine Config Operator

Question 15

Which command allows an administrator to view details, including events and current binding status, of a specific PersistentVolume named 'pv-data01'?

Accepted Answer

oc describe pv pv-data01. The 'oc describe pv pv-data01' command displays detailed information and recent events for the PersistentVolume.

Answer

oc status pv-data01

Answer

oc get pv pv-data01 -o yaml

Answer

oc logs pv/pv-data01

Question 16

A developer requests a PersistentVolumeClaim using ReadWriteMany access mode. Which default storage type in a standard AWS ODF (OpenShift Data Foundation) deployment natively supports RWX?

Accepted Answer

openshift-storage.cephfs.csi.ceph.com. CephFS, provided by OpenShift Data Foundation, supports ReadWriteMany (RWX) access modes, unlike standard AWS EBS CSI (which is RWO).

Answer

openshift-storage.rbd.csi.ceph.com

Answer

gp2-csi.storage.k8s.io

Answer

ebs.csi.aws.com

Question 17

An administrator needs to provision persistent storage dynamically using an NFS server. Which provisioner is required in the StorageClass definition since OpenShift removed the in-tree NFS provisioner?

Accepted Answer

sig-storage.k8s.io/nfs-subdir-external-provisioner. OpenShift removed in-tree provisioners. The external NFS subdir external provisioner is the standard Red Hat-supported way to dynamically provision NFS volumes.

Answer

nfs.csi.k8s.io

Answer

kubernetes.io/nfs

Answer

openshift.io/nfs-dynamic

Question 18

A pod in the 'production' namespace is crashing repeatedly due to a segmentation fault in the application binary. The administrator needs to inspect the file system of the crashing container without altering the deployment spec permanently. Which command is most appropriate?

Accepted Answer

oc debug pod/my-app-6b79f-abcde. oc debug with a pod target creates a debugging pod that shares the namespace and mounts the containers of the target pod, allowing file system inspection.

Answer

oc logs pod/my-app-6b79f-abcde --previous

Answer

oc rsh deployment/my-app

Answer

oc exec -it pod/my-app-6b79f-abcde -- /bin/sh

Question 19

An administrator needs to check the cluster events across all namespaces sorted by timestamp to identify recent infrastructure warnings. Which command should they use?

Accepted Answer

oc get events --sort-by='.metadata.creationTimestamp'. oc get events --sort-by='.metadata.creationTimestamp' lists all events ordered by creation time.

Answer

oc adm events --all

Answer

oc show events --recent

Answer

oc cluster-events

Question 20

A developer deploys a custom application pod that requires the hostIPC capability, but the pod creation is rejected by the apiserver. Upon inspecting the cluster SCCs, the administrator determines that the application uses a ServiceAccount named app-sa in the production namespace. How should the administrator grant the restricted SCC privileges safely without compromising cluster security?

Accepted Answer

Create a RoleBinding in the production namespace referencing the system:openshift:scc:hostaccess cluster role and the app-sa ServiceAccount. To grant specific SCC privileges, the administrator must bind the SCC's corresponding cluster role to the target service account.

Answer

Add a subject entry referencing system:serviceaccount:production:app-sa to the users list inside the restricted SCC definition

Answer

Annotate the app-sa ServiceAccount with openshift.io/scc.constraint: hostaccess

Answer

Create a ClusterRoleBinding that binds the system:openshift:scc:restricted cluster role to system:serviceaccount:production:app-sa