EX280 Practice Test 5 — 25 Questions

Question 1

An administrator needs to configure a custom default certificate for all routes created in the cluster without specifying a certificate on every individual Route object. Where should this wildcard certificate be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the IngressController resource named 'default' in openshift-ingress-operator. The wildcard default certificate for all routes is configured in the IngressController resource named 'default' in the `openshift-ingress-operator` namespace, specifically in `spec.defaultCertificate` with a Secret reference. This tells the OpenShift ingress operator to use that certificate as the fallback for any Route that does not specify its own TLS certificate. It is the cluster-wide default for edge/re-encrypt routes.

Answer

In a ConfigMap named 'router-certs' in the default namespace

Answer

In the apiserver.config.openshift.io cluster object

Answer

In the DNS cluster operator configuration

Question 2

Which command allows an administrator to view all currently configured SecurityContextConstraints in an OpenShift cluster?

Accepted Answer

oc get securitycontextconstraints. SecurityContextConstraints (SCCs) are cluster-scoped resources in OpenShift, so they are queried with the standard 'oc get' verb using the resource name 'securitycontextconstraints' (or its short form 'scc'). The command 'oc get securitycontextconstraints' returns the list of all SCCs currently defined in the cluster, such as restricted, anyuid, hostaccess, and privileged. Because SCCs are not namespaced, no -n flag is required or meaningful.

Answer

oc describe scc-cluster

Answer

oc get scc --namespaced

Answer

oc get policies -n openshift-config

Question 3

An OpenShift administrator needs to restrict developers so they cannot delete any PersistentVolumeClaims in the 'finance-prod' namespace, even though they have the 'admin' role. How can this override be achieved?

Accepted Answer

Create a custom Role that omits the 'delete' verb for persistentvolumeclaims, remove the 'admin' role binding, and bind this custom Role instead.. To prevent deletion of PVCs despite the 'admin' role, you must remove the role binding that grants the admin role and instead bind a custom Role that includes all necessary permissions except the 'delete' verb for persistentvolumeclaims. This effectively overrides the default admin permissions by not granting delete rights.

Answer

Add a negative annotation to the user's account object.

Answer

Configure a LimitRange object with delete blocks.

Answer

Create a DenyRoleBinding specifying delete verb exclusion for persistentvolumeclaims.

Question 4

Which TWO actions are required when configuring an external OpenID Connect (OIDC) identity provider in OpenShift Container Platform?

Accepted Answer

Reference a Secret containing the clientSecret used to authenticate against the OIDC provider.. When configuring an external OIDC identity provider in OpenShift Container Platform, the OAuth configuration (a custom resource of kind OAuth) requires an identityProvider entry of type OpenIDConnect that references a Secret holding the clientSecret used to authenticate the cluster's OAuth server against the OIDC provider, so option A is correct. The same identityProvider stanza must also specify the issuer URL, which points to the OIDC provider's discovery endpoint (/.well-known/openid-configuration) so OpenShift can retrieve the provider's metadata such as authorization and token endpoints, making option D correct. Option B is wrong because OAuthClient resources represent OAuth clients that consume the cluster's OAuth server (for example, service accounts or external applications), not individual cluster users, and they are not created per user for an external IdP. Option C is wrong because LDAP synchronization is only relevant to the LDAP identity provider and is not part of OIDC configuration. Option E is wrong because openshift-install is used for cluster installation and does not generate a self-signed CA for the API server as part of configuring an external OIDC identity provider.

Answer

Create a dedicated OAuthClient resource for every single cluster user.

Answer

Deploy an internal LDAP directory synchronization cronjob inside the openshift-authentication namespace.

Answer

Generate a self-signed CA certificate for the API server using openshift-install.

Question 5

The OpenShift SDN (or OVN-Kubernetes) network plugin reports a failure. The administrator needs to inspect the iptables rules on a worker node to verify packet mangling and NAT configurations. How can they view the host's iptables rules?

Accepted Answer

oc debug node/ -- chroot /host iptables-save. The `oc debug node/` command creates a privileged debug pod that runs on the target node and mounts the host's root filesystem at /host. Using `chroot /host` switches the process root into the host's filesystem, allowing the administrator to run the host's own `iptables-save` binary against the host's netfilter tables. This is the only option that actually inspects the node's kernel-level iptables rules rather than pod-level or non-existent resources.

Answer

oc logs daemonset/iptables-analyzer

Answer

oc adm diagnostics iptables

Answer

oc exec deployment/router-default -- iptables -L

Question 6

Which THREE items are required to successfully deploy a basic application using S2I?

Accepted Answer

BuildConfig. Option A (BuildConfig) is required because S2I builds are driven by an OpenShift BuildConfig that defines the source, strategy (Source-to-Image), and output image stream for the application. Option D (Builder Image) is required because the S2I build strategy needs an S2I-enabled builder image (e.g., a builder image stream such as nodejs or python) that contains the assemble and run scripts to compile and package the source. Option E (Source Code) is required because S2I takes application source (from a Git repository, binary, or local directory) as the input that the builder image's assemble script transforms into a runnable image. Option B (External Load Balancer) is not required for a basic S2I deployment, since OpenShift Routes or Services handle exposure internally. Option C (A pre-existing Database) is not required, as a basic application deployment does not depend on an external database being present.

Answer

External Load Balancer

Answer

A pre-existing Database

Question 7

An administrator is configuring a new StorageClass in OpenShift Container Platform 4.14. Which TWO parameters or fields are valid and commonly used specifications within a StorageClass manifest? (Choose TWO)

Accepted Answer

reclaimPolicy. Option C (reclaimPolicy) is correct because a StorageClass manifest supports the reclaimPolicy field, which determines what happens to a PersistentVolume after its PersistentVolumeClaim is deleted—valid values are Delete and Retain, with Delete being the default for dynamically provisioned volumes. Option E (volumeBindingMode) is correct because it is a standard StorageClass field that controls when volume binding and dynamic provisioning occur, with valid values Immediate and WaitForFirstConsumer, the latter being essential for topology-aware scheduling. The other options are not StorageClass fields: podSecurityContext (A) is a Pod/container security setting, nodeAffinityRules (B) is not a valid StorageClass parameter (node affinity belongs to PersistentVolume nodeAffinity or Pod scheduling), and maximumSnapshotLimit (D) is not a recognized StorageClass specification in OpenShift 4.14.

Answer

podSecurityContext

Answer

nodeAffinityRules

Answer

maximumSnapshotLimit

Question 8

Which TWO of the following commands can an administrator use to verify the identity and permissions of the currently logged-in user? (Choose TWO)

Accepted Answer

oc whoami. Option A, `oc whoami`, is correct because it queries the OpenShift API server and returns the username of the identity associated with the current session's credentials, directly verifying who the logged-in user is. Option C, `oc auth can-i --list`, is correct because it performs a SelfSubjectRulesReview against the API server and prints the full list of verbs and resources the current user is permitted to perform, thereby verifying the user's permissions. Option B, `oc get user --current`, is not a valid command—`oc get user` lists User objects but has no `--current` flag to identify the logged-in user. Option D, `oc adm who-can-i`, is not a real subcommand; the actual command is `oc adm policy who-can `, which checks which users can perform an action, not the current user's identity. Option E, `oc describe authentication`, is not valid because `authentication` is a cluster-scoped configuration resource (operator.openshift.io) and describing it shows cluster auth configuration, not the current user's identity or permissions.

Answer

oc get user --current

Answer

oc adm who-can-i

Answer

oc describe authentication

Question 9

An OpenShift cluster operator is stuck in a Progressing state during an update. Which THREE diagnostic steps help determine why the operator reconciliation loop is blocked? (Choose THREE)

Accepted Answer

Check cluster-wide events related to the operator namespace.. Option B is correct because cluster-wide events (e.g., oc get events -n openshift-) reveal scheduling failures, image pull errors, RBAC denials, or dependency issues that can stall the operator's reconciliation loop. Option C is correct because the operator deployment's pod logs in its openshift-* namespace show the actual reconciliation errors, failed API calls, or exceptions the controller is hitting while trying to progress. Option D is correct because inspecting the Custom Resource's status conditions (e.g., oc get -o yaml) exposes the operator's own reported state, including Degraded/Progressing reasons and messages that pinpoint the blocking condition. Option A is not appropriate because rebooting all control plane nodes simultaneously causes an outage and does not diagnose the reconciliation issue. Option E is not appropriate because deleting persistent volumes destroys data and is unrelated to diagnosing why an operator is stuck Progressing.

Answer

Reboot all control plane nodes simultaneously.

Answer

Delete all persistent volumes in the cluster.

Question 10

Which TWO files or directories are commonly configured or injected via MachineConfig objects for node customization? (Choose TWO)

Accepted Answer

Custom files placed in arbitrary file paths on the node filesystem.. MachineConfig objects in OpenShift are used to apply node-level customizations by injecting Ignition configs, and they commonly include custom files placed at arbitrary paths on the node filesystem (option A) — for example, dropping a config file into /etc or a systemd unit — because MachineConfig supports specifying file contents, path, mode, and ownership. They also commonly configure authorized SSH keys for the core user (option D), which is a standard MachineConfig use case (e.g., the 99-master-ssh and 99-worker-ssh MachineConfigs) to enable SSH access to nodes. Option B is incorrect because PVCs are Kubernetes storage resources for application pods, not node customization injected via MachineConfig. Option C is incorrect because MachineConfig does not modify the Kubernetes API server binary code; it manages node OS-level configuration through Ignition. Option E is incorrect because container image layer caches are managed by the container runtime and are not a MachineConfig-injected node customization.

Answer

Persistent Volume Claims (PVCs) for user applications.

Answer

Direct modifications to the Kubernetes API server binary code.

Answer

Dynamic container image layer storage caches.

Question 11

What is the primary role of Operator Lifecycle Manager (OLM) in OpenShift 4.14?

Accepted Answer

Managing the installation, upgrades, and RBAC lifecycle of Operators in the cluster.. Operator Lifecycle Manager (OLM) is the OpenShift component that provides a declarative way to install, upgrade, and manage the lifecycle of Operators and their associated RBAC. It introduces Custom Resource Definitions (CRDs) like ClusterServiceVersion (CSV), Subscription, and InstallPlan to automate dependency resolution, version upgrades, and permission grants. OLM ensures Operators are installed with the correct service accounts, roles, and role bindings, and it handles upgrades through channels and approval strategies. Thus, option A accurately captures OLM's primary role.

Answer

Monitoring node CPU and memory utilization thresholds.

Answer

Provisioning physical bare-metal servers for cluster expansion.

Answer

Encrypting etcd database contents at rest.

Question 12

Which TWO characteristics describe StorageClasses in OpenShift?

Accepted Answer

They specify the provisioner plugin responsible for creating volumes.. Option A is correct because a StorageClass defines the provisioner field (for example kubernetes.io/aws-ebs, ebs.csi.aws.com, or a custom CSI driver) that tells OpenShift which plugin dynamically creates the PersistentVolume backing a PVC. Option E is correct because StorageClasses are cluster-scoped resources, not namespaced, so they are visible across all projects and can be referenced by PVCs in any namespace. Options B, C, and D are incorrect: StorageClasses do not hold application data (that resides on the PersistentVolume), they are not namespace-scoped or project-unique, and creating them typically requires cluster-admin privileges rather than unprivileged developer access.

Answer

They store the actual application data files.

Answer

They are namespace-scoped and unique to each project.

Answer

They can only be created by unprivileged developer users.

Question 13

An administrator needs to configure resource requests and limits such that any pod created without explicit CPU requests in the 'web-tier' namespace automatically gets assigned a default CPU request of 200m and a default CPU limit of 500m. Which object achieves this?

Accepted Answer

LimitRange with default and defaultRequest parameters. A LimitRange object with default and defaultRequest parameters is specifically designed to set default resource requests and limits for containers in a namespace. When a pod is created without explicit CPU requests, the LimitRange's defaultRequest value (200m) is applied as the request, and the default value (500m) is applied as the limit. This ensures consistent resource allocation and prevents pods from being created without any resource constraints.

Answer

ResourceQuota

Answer

PodPreset

Answer

ClusterResourceQuota

Question 14

An OpenShift cluster uses a CSI driver that supports volume cloning. A user wants to clone an existing PVC named 'data-pvc' into a new PVC named 'clone-pvc'. How should the dataSource be specified?

Accepted Answer

dataSource: { apiGroup: "", kind: "PersistentVolumeClaim", name: "data-pvc" }. To clone an existing PVC named 'data-pvc' into a new PVC named 'clone-pvc' using a CSI driver that supports volume cloning, the dataSource field must specify the source PVC. The correct specification is dataSource: { apiGroup: "", kind: "PersistentVolumeClaim", name: "data-pvc" }. The apiGroup is empty because PersistentVolumeClaim is a core Kubernetes resource. This tells the CSI driver to clone the volume from the specified PVC.

Answer

dataSource: { apiGroup: "snapshot.storage.k8s.io", kind: "VolumeSnapshot", name: "data-pvc" }

Answer

spec.cloneSource: "data-pvc"

Answer

spec.volumeName: "data-pvc"

Question 15

Which THREE of the following are valid build strategies supported by OpenShift BuildConfigs? (Choose three.)

Accepted Answer

Custom. Option B (Custom) is correct because OpenShift BuildConfigs support the Custom build strategy, which lets you define your own builder image that runs a user-supplied build logic and produces the resulting image. Option C (Source) is correct because the Source build strategy (Source-to-Image, S2I) uses a builder image with assemble/run scripts to compile source code into a runnable image. Option E (Docker) is correct because the Docker build strategy builds an image by executing a Dockerfile with the docker build process inside the cluster. Option A (Jenkinsfile) is not a BuildConfig strategy; Jenkins pipelines are handled by OpenShift Pipelines/Jenkins, not by BuildConfig strategy types. Option D (HelmBuild) is not a supported OpenShift BuildConfig strategy; Helm is a package manager for Kubernetes manifests and is not a build strategy.

Answer

Jenkinsfile

Answer

HelmBuild

Question 16

Which TWO tasks are typically performed by an OpenShift cluster administrator when managing worker node lifecycles? (Choose TWO)

Accepted Answer

Cordoning and draining nodes for operating system maintenance.. Option D is correct because cordoning a node marks it as unschedulable (kubectl cordon) and draining it evicts running pods (kubectl drain) so the node can safely undergo OS patching, reboots, or other maintenance without disrupting workloads. Option E is correct because node labels are the mechanism that determines which nodes belong to a given MachineConfigPool, allowing the administrator to target specific MachineConfig updates to defined groups of worker nodes. Option A is not a typical administrator task, since etcd data files on control plane nodes are managed by the etcd operator and should not be edited directly. Option B is incorrect because OpenShift manages the OS via immutable RHCOS and MachineConfig, not by manually compiling kernels over SSH. Option C is incorrect because writing Kubernetes API server source code is upstream development work, not cluster administration.

Answer

Directly editing etcd data files on control plane nodes.

Answer

Manually compiling custom Linux kernel binaries on every node via SSH.

Answer

Writing custom source code for the Kubernetes API server.

Question 17

Which TWO of the following are valid deployment strategies supported by OpenShift?

Accepted Answer

Recreate. Options D (Rolling) and C (Recreate) are the two deployment strategies natively supported by OpenShift's DeploymentConfig/Deployment resources. Rolling performs a gradual, zero-downtime replacement of pods using a rolling update with configurable maxUnavailable and maxSurge parameters, while Recreate terminates all existing pods before starting new ones, causing a brief outage but avoiding version overlap. Both are explicitly defined strategy types in OpenShift's deployment configuration API. Options A (Parallel), B (Sequential), and E (Canary) are not built-in OpenShift deployment strategies; canary-style rollouts can be approximated via custom techniques or routes but are not a native strategy type.

Answer

Parallel

Answer

Sequential

Answer

Canary

Question 18

Which OpenShift 4.14 command allows an administrator to gather cluster-wide diagnostic logs and configuration data for support cases?

Accepted Answer

oc adm must-gather. The command 'oc adm must-gather' collects a comprehensive set of cluster diagnostics, including logs, resource definitions, and configuration data from all relevant components. It is the standard tool for gathering information for Red Hat support cases. It runs a pod on the cluster that collects data and saves it to a local directory.

Answer

oc adm collect-logs

Answer

oc support dump

Answer

oc cluster-debug bundle

Question 19

Which THREE network-related objects are namespaced in OpenShift? (Choose THREE)

Accepted Answer

NetworkPolicy. NetworkPolicy (C) is namespaced because it is a Kubernetes resource scoped to a namespace, where its podSelector and ingress/egress rules apply only to pods within that namespace. Service (D) is namespaced since a Service is a namespaced Kubernetes object that provides a stable virtual IP and DNS name for pods in the same namespace. Route (E) is namespaced because OpenShift Routes are namespace-scoped resources that expose a Service from within that namespace to external clients. ClusterNetwork (A) is cluster-scoped, as it defines the overall pod network CIDR configuration for the entire cluster. IngressController (B) is also cluster-scoped, since it configures the ingress controller operator for the whole OpenShift cluster rather than a single namespace.

Answer

ClusterNetwork

Answer

IngressController

Question 20

An administrator is configuring a ResourceQuota named 'quota-dev' in the 'development' namespace. Which TWO of the following resource types can be directly tracked and limited by this ResourceQuota? (Choose TWO)

Accepted Answer

persistentvolumeclaims. Option A (persistentvolumeclaims) is correct because Kubernetes ResourceQuota objects support the persistentvolumeclaims field, which limits the number of PVCs that can exist in the namespace, as well as requests.storage to cap total storage requested. Option C (pods) is correct because ResourceQuota natively supports the pods field, allowing the administrator to limit the total number of Pods created in the 'development' namespace. Options B (clusterroles), D (namespaces), and E (nodes) are incorrect because they are cluster-scoped resources, not namespaced resources; ResourceQuota only applies to namespaced objects within the namespace where the quota is defined, so it cannot track or limit ClusterRoles, Namespaces, or Nodes.

Answer

clusterroles

Answer

namespaces

Answer

nodes