EX280 Practice Test 5 — 25 Questions

Question 1

Which OpenShift CLI command is used to display all PersistentVolumeClaims in the current project along with their bound PersistentVolumes and storage classes?

Accepted Answer

oc get pvc. The 'oc get pvc' command lists all PVCs in the current namespace along with status, volume, and storage class details.

Answer

oc get pv

Answer

oc get sc

Answer

oc describe volume

Question 2

What is the primary function of a CSI (Container Storage Interface) Driver Operator in OpenShift?

Accepted Answer

To deploy, upgrade, and manage the CSI driver components (controller and node plugins) in the cluster.. CSI Driver Operators manage the lifecycle of CSI plugins, deploying controller and node plugin pods that enable communication between OpenShift and storage backends.

Answer

To automatically back up etcd data onto persistent volumes.

Answer

To act as an NFS server running directly on control plane nodes.

Answer

To convert emptyDir volumes into encrypted block devices.

Question 3

Which tool should be used to troubleshoot why an SCC is being rejected for a pod?

Accepted Answer

oc adm policy scc-review. The 'oc adm policy scc-review' command helps determine why an SCC is or is not being assigned.

Answer

oc adm top scc

Answer

oc get scc --debug

Answer

oc explain scc

Question 4

An administrator notices that the Cluster Version Operator (CVO) is blocked during an upgrade because a cluster operator is missing version annotations. Which command allows checking the current status and payload version of the CVO?

Accepted Answer

oc get clusterversion. oc get clusterversion provides the high-level status of the cluster upgrade, available updates, and active version history.

Answer

oc adm upgrade status

Answer

oc get clusteroperators

Answer

oc version

Question 5

An OpenShift cluster's SDN (OVN-Kubernetes) experiences packet loss between nodes. The administrator needs to inspect the Open vSwitch (OVS) flow tables on a specific worker node. How should they access the node to run 'ovs-ofctl dump-flows'?

Accepted Answer

oc debug node/ -- chroot /host ovs-ofctl dump-flows br-int. Using oc debug node/ provides a shell where chroot /host allows executing host-level commands like ovs-ofctl.

Answer

oc adm diagnostics ovs

Answer

oc exec daemonset/ovn-controller -- ovs-ofctl dump-flows

Answer

oc rsh daemonset/ovnkube-node

Question 6

An administrator is securing routes in an OpenShift cluster. Which THREE TLS termination types are supported natively by OpenShift Routes? (Choose THREE)

Accepted Answer

Passthrough. OpenShift Routes support edge, re-encrypt, and passthrough TLS termination types.

Answer

Proxy

Answer

FullMesh

Question 7

An administrator needs to increase the size of an existing PVC bound to a gp3 storage class in an OpenShift cluster. What is the mandatory first step before editing the PVC spec?

Accepted Answer

Ensure allowVolumeExpansion: true is set on the corresponding StorageClass.. Before editing the PVC size, the StorageClass must have 'allowVolumeExpansion: true' configured. Otherwise, the volume expansion request will be rejected.

Answer

Manually update the underlying cloud provider disk size via the AWS console.

Answer

Delete the PV and recreate it with the new size.

Answer

Scale down all pods using the PVC to zero replicas.

Question 8

A user creates a VolumeSnapshot and notices that the resulting VolumeSnapshotContent status is marked as readyToUse: false. What is the most likely cause?

Accepted Answer

The PVC being snapshotted has active writes and the storage backend is still synchronizing snapshot data.. The CSI driver or storage backend has not finished creating the snapshot or data protection sync, or the underlying storage controller hasn't reported back readiness yet.

Answer

The VolumeSnapshot object must be manually promoted before it becomes ready.

Answer

The VolumeSnapshotClass is missing the deletionPolicy parameter.

Answer

The PVC must be unmounted from all running pods before a snapshot can be marked ready.

Question 9

An administrator wants to verify if all required cluster operators are available and not degraded after an installation. Which command provides this summary?

Accepted Answer

oc get clusteroperators. oc get clusteroperators lists all cluster operators along with their Available, Progressing, and Degraded status conditions.

Answer

oc adm cluster-status

Answer

oc get nodes

Answer

oc get pods --all-namespaces

Question 10

A developer deploys an application using a Route that terminates TLS using the Edge termination strategy. The developer wants to ensure that all insecure HTTP traffic to the route is automatically redirected to HTTPS. Where must this setting be configured?

Accepted Answer

In the Route resource spec.tls.insecureEdgeTerminationPolicy field set to Redirect.. Insecure edge termination policy can be set on the Route resource itself using the spec.tls.insecureEdgeTerminationPolicy field set to Redirect.

Answer

By modifying the haproxy.config global template ConfigMap in the openshift-ingress namespace.

Answer

In the IngressController custom resource under spec.routeAdmission.wildcardPolicy.

Answer

In the Service resource annotations using route.openshift.io/termination: redirect.

Question 11

A developer needs to configure a Pod where multiple containers need concurrent read-write access to the exact same PersistentVolumeClaim. Which access mode is mandatory on the PVC?

Accepted Answer

ReadWriteMany. ReadWriteMany (RWX) or ReadWriteOncePod (RWOP) can be used, but for multiple containers across nodes (or even multiple containers on the same node wanting shared concurrent write access without conflict), RWX is required. Wait, multiple containers in the *same* pod can share a single RWO volume because they share the same node and mount namespace context. However, across pods or when explicitly sharing, RWX is the classic answer. Let's frame it as multiple pods or general multi-reader/writer access.

Answer

ReadOnlyMany

Answer

ReadWriteOnce

Answer

ReadWriteOncePod

Question 12

Which command is used to delete a PersistentVolumeClaim named 'my-app-pvc' in the current project?

Accepted Answer

oc delete pvc my-app-pvc. The 'oc delete pvc my-app-pvc' command deletes the specified PVC.

Answer

oc remove pvc my-app-pvc

Answer

oc destroy pvc my-app-pvc

Answer

oc prune pvc my-app-pvc

Question 13

An administrator wants to view the last 50 lines of logs for a pod named 'api-server-xyz' and keep the stream open for new log entries. Which command should they use?

Accepted Answer

oc logs api-server-xyz --tail=50 -f. Combining --tail=50 and -f in the oc logs command shows the last 50 lines and then tails new log output.

Answer

oc describe pod api-server-xyz --lines=50

Answer

oc logs api-server-xyz --lines=50 --follow

Answer

oc tail api-server-xyz -n 50

Question 14

An administrator is configuring topology-aware storage provisioning. A StorageClass uses volumeBindingMode: WaitForFirstConsumer. When is the PersistentVolume actually created?

Accepted Answer

When the scheduler places the pod referencing the PVC onto a specific worker node.. When using WaitForFirstConsumer, the PV is created only after the pod requesting the PVC has been scheduled to a specific node, ensuring topology alignment.

Answer

When the PVC object is successfully created in the namespace.

Answer

When the user executes 'oc adm pv create'.

Answer

When the CSI driver operator starts up during cluster bootstrap.

Question 15

What happens to a PersistentVolume configured with reclaimPolicy: Delete when its corresponding PersistentVolumeClaim is deleted?

Accepted Answer

The underlying storage asset is automatically deleted from the storage backend.. When reclaimPolicy is Delete, deleting the PVC triggers the deletion of the underlying storage asset on the storage backend via the CSI driver.

Answer

The PV object is deleted, but the underlying storage asset remains intact on the storage backend.

Answer

The PV is automatically archived into an object storage bucket.

Answer

The PV status changes to Released and waits for administrator intervention.

Question 16

A user creates a PVC, but the storage backend fails to provision the volume. Where can the administrator look to find detailed error messages emitted by the external provisioner controller?

Accepted Answer

Review the logs of the CSI external provisioner controller pod in its management namespace.. Checking the logs of the external provisioner pod (usually running in openshift-storage or the respective CSI driver operator namespace) provides detailed API interaction and provisioning failure errors.

Answer

Run 'oc adm diagnostics storage'.

Answer

Inspect the container image registry logs.

Answer

Check /var/log/messages on the control plane nodes.

Question 17

A cluster uses a CSI driver that does not support volume expansion. A user edits an existing PVC to request a larger size. What action does the OpenShift API server take?

Accepted Answer

The resize request fails or is marked with an error condition because expansion is unsupported.. If expansion is not supported by the driver or allowed by the StorageClass, the API server rejects the update or the resize controller marks the expansion condition as unsupported/failed.

Answer

The PVC size is updated in Kubernetes metadata, but physical storage is left unchanged.

Answer

OpenShift automatically converts the PVC to use a default storage class that supports expansion.

Answer

The pod is immediately terminated and restarted on a node with more disk space.

Question 18

Which THREE restrictions or behaviors are enforced by the default restricted-v2 Security Context Constraint in OpenShift Container Platform?

Accepted Answer

Containers are prohibited from running with privileged mode enabled.. The restricted-v2 SCC enforces strict security best practices, including disallowing running as root, forbidding privileged containers, and requiring the drop of all capabilities except NET_BIND_SERVICE.

Answer

Containers are allowed to mount host network, host IPC, and host PID namespaces.

Answer

Pods are automatically assigned a random UID from the namespace's pre-allocated UID range.

Question 19

A developer needs to expose a service via a route with re-encryption. What is required in the Route configuration?

Accepted Answer

Set 'termination: reencrypt' in the spec.tls section. Re-encryption requires a termination configuration that specifies the certificate for the route and potentially the certificate for the destination service.

Answer

Enable 'insecureEdgeTerminationPolicy: Allow'

Answer

Configure a ServiceMesh resource

Answer

Set 'termination: edge' and add a proxy

Question 20

You are hardening a cluster. Which Pod Security Standard level is the default in OpenShift 4.14 for new projects?

Accepted Answer

restricted. OpenShift 4.14 uses the 'restricted' SCC by default, which aligns with the Pod Security Standard 'restricted' profile.

Answer

baseline

Answer

privileged

Answer

enforce