EX280 Practice Test 27 — 15 Questions

Question 1

A cluster administrator wishes to enforce the restricted Pod Security Standard across an entire namespace named auditing-ns. Which label should the administrator apply to the namespace to enforce this policy while generating audit warnings for non-compliant pods?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

pod-security.kubernetes.io/enforce: restricted and pod-security.kubernetes.io/audit: restricted. Namespace-level Pod Security Standards are enforced using standard Kubernetes labels. To enforce while auditing, the enforce label is set to restricted, and the audit label can also be set.

Answer

security.openshift.io/scc.enforce: restricted-v2

Answer

security.openshift.io/pod-security-standard: enforce-restricted

Answer

admission.cluster.openshift.io/validate-psa: true

Question 2

You have a private image registry that requires credentials. Where should you place the 'imagePullSecret' so that it is automatically injected into all pods created by a specific service account?

Accepted Answer

oc secrets link default <secret-name>. Adding the imagePullSecret to the service account ensures it is used for all pods using that service account.

Answer

oc annotate sa default imagePullSecret=<secret-name>

Answer

oc edit namespace --add-secret=

Answer

oc set image-pull-secret <secret-name>

Question 3

An administrator needs to ensure that a newly created ServiceAccount automatically receives a long-lived API token when created in OpenShift 4.14+. What is the correct procedure?

Accepted Answer

Create a Secret of type kubernetes.io/service-account-token and reference the ServiceAccount name in the secret metadata annotations. In OpenShift 4.14+, bound service account tokens are ephemeral by default. To create a legacy long-lived token, a Secret object must be explicitly created and linked to the service account.

Answer

Patch the default cluster authentication profile to revert to automountServiceAccountToken globally

Answer

Add the annotation serviceaccounts.openshift.io/want-token: "true" to the ServiceAccount metadata

Answer

Execute the oc create token command and store the output in a ConfigMap

Question 4

An administrator is reviewing the default Security Context Constraints in OpenShift 4.14+. Which THREE of the following SCCs are built-in and provided out-of-the-box by OpenShift? (Choose THREE)

Accepted Answer

nonroot. OpenShift provides several built-in SCCs including restricted-v2, privileged, and nonroot.

Answer

root-container-v1

Answer

custom-app-scc

Question 5

When configuring a NetworkPolicy in OpenShift, which THREE options represent valid components or fields within a NetworkPolicy specification? (Choose THREE)

Accepted Answer

podSelector. NetworkPolicy specifications include podSelector, policyTypes, and ingress/egress rule blocks.

Answer

routeSelector

Answer

clusterIP

Question 6

An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?

Accepted Answer

Create a dedicated ServiceAccount, a Role granting get and list on pods, and a RoleBinding linking them in the namespace. To grant least privilege API access, create a dedicated ServiceAccount, bind a custom Role or ClusterRole with limited verbs (get, list, watch) on pods via a RoleBinding in that namespace.

Answer

Bind the cluster-admin ClusterRole to the default ServiceAccount in the namespace using a ClusterRoleBinding

Answer

Annotate the default ServiceAccount with rbac.authorization.k8s.io/authtype: reader

Answer

Grant the system:openshift:scc:restricted ClusterRole to the ServiceAccount using a RoleBinding

Question 7

Which TWO things must be configured to use a Private Image Registry?

Accepted Answer

A docker-registry type secret. You must create a secret with the credentials and then link it to the service account.

Answer

A route to the registry

Answer

Creating a new ClusterRole

Answer

Updating the node configuration

Question 8

An administrator configures a Pod with a volume type of hostPath. What is a key security risk or operational limitation of using hostPath in a production multi-tenant OpenShift cluster?

Accepted Answer

Pods using hostPath can access node filesystems, breaking container isolation and posing security risks.. hostPath mounts node filesystem paths directly into containers, which can allow containerized workloads to read/write sensitive host files or compromise node security.

Answer

hostPath volumes automatically expire and delete data after 24 hours.

Answer

hostPath requires an external CSI driver to be installed.

Answer

hostPath is incompatible with Linux nodes and only works on Windows worker nodes.

Question 9

An administrator wants to check the exit code of a container that terminated earlier today in a pod that has since been restarted. Which command displays the previous termination details?

Accepted Answer

oc logs <pod-name> --previous. oc logs --previous retrieves the log output from the previous container instance before it restarted.

Answer

oc describe pod <pod-name> --history

Answer

oc adm pod-logs --last

Answer

oc get pod <pod-name> -o exit-code

Question 10

An administrator is troubleshooting an Ingress routing issue where external clients receive a 503 error when trying to access a secure application through a Route configured with passthrough TLS termination. What is the most likely cause of this issue?

Accepted Answer

The target application pod is not configured to terminate TLS and present a valid certificate matching the route hostname. With passthrough TLS termination, the router passes encrypted traffic directly to the backend pod, meaning the pod must handle TLS termination and present a valid certificate matching the hostname.

Answer

The Route manifest is missing the spec.tls.destinationCACertificate field

Answer

The default Ingress controller wildcard certificate has expired

Answer

The Route object lacks an annotation specifying openshift.io/router.router-credentials

Question 11

An administrator is auditing Security Context Constraints and wants to identify which settings can be controlled within a custom SCC definition. Which THREE fields are valid configuration options inside an SCC resource? (Choose THREE)

Accepted Answer

requiredDropCapabilities. Valid SCC fields include allowPrivilegedContainer, requiredDropCapabilities, and volumes.

Answer

routeAdmissionLimit

Answer

networkPolicyMode

Question 12

An application pod needs to run with a specific user ID (UID 10005000) that falls outside the restricted-v2 SCC default allocated range for the namespace. The administrator decides to create a custom SCC. Which SCC security context strategy parameter must be adjusted to allow this specific UID?

Accepted Answer

runAsUser with type: RunAsAny or specifying the UID range in uidRanges.. The runAsUser strategy in an SCC determines how UIDs are assigned. Setting it to MustRunAsRange with an expanded range or RunAsAny (depending on cluster security posture) allows specific UIDs.

Answer

supplementalGroups with type: RunAsAny and fsGroup set to 10005000.

Answer

seLinuxContext with type: MustRunAs and level set to s0:c100,c200.

Answer

runAsUser with type: MustRunAs and uidRange or uid settings covering the required value.

Question 13

Where do you define the default image pull secrets for all service accounts in a namespace?

Accepted Answer

By linking the secret to the 'default' service account. You can link a secret to the 'builder' or 'default' service accounts, but creating a secret and linking it to the default service account is the standard method.

Answer

In the ClusterOperator configuration

Answer

In the Namespace metadata

Answer

In the project configuration object

Question 14

You need to update the CA certificate used for the web console. Where is this configured?

Accepted Answer

In the 'console' operator configuration. The console CA is configured via the 'console' operator object in 'openshift-console' namespace.

Answer

In the cluster config map

Answer

In the authentication operator

Answer

In the 'ingress' operator configuration

Question 15

An administrator creates a StorageClass with volumeBindingMode: WaitForFirstConsumer. A user creates a PVC using this StorageClass. What will be the initial phase of the PVC?

Accepted Answer

Pending. When using WaitForFirstConsumer, a newly created PVC remains in the Pending state until a pod referencing it is created and scheduled.

Answer

Provisioning

Answer

Bound

Answer

Available