EX280 Practice Test 27 — 15 Questions

Question 1

Which TWO commands are used to check the health and status of the cluster networking operator? (Choose TWO)

Accepted Answer

oc describe clusteroperator network. Option B, `oc describe clusteroperator network`, is correct because it shows the detailed status of the network ClusterOperator, including its conditions (Available, Progressing, Degraded), related messages, and version, which directly reflects the health of the cluster networking operator. Option D, `oc get clusteroperators`, is correct because it lists all ClusterOperators with their AVAILABLE, PROGRESSING, and DEGRADED columns, letting you quickly verify whether the network operator is healthy. Option A, `oc get routes --all-nodes`, is invalid since `--all-nodes` is not a valid flag for `oc get routes` and routes are not the operator's status object. Option C, `oc adm network status`, is not a real OpenShift command for checking the network operator. Option E, `oc top network`, is not a valid subcommand of `oc top`, which supports resources like pods and nodes, not network operator health.

Answer

oc get routes --all-nodes

Answer

oc adm network status

Answer

oc top network

Question 2

An administrator wants to check the status of all api-server instances in the cluster. Which TWO commands are helpful? (Choose TWO)

Accepted Answer

oc get pods -n openshift-kube-apiserver. Option B, `oc get pods -n openshift-kube-apiserver`, is correct because in OpenShift the static api-server pods run in the `openshift-kube-apiserver` namespace, so listing pods there shows the running status of each kube-apiserver instance. Option C, `oc get clusteroperator kube-apiserver`, is correct because the `kube-apiserver` ClusterOperator reports the aggregated availability, progressing, and degraded status of the API server across the cluster. Option A, `oc get storageclass`, only lists storage classes and has nothing to do with API server health. Option D, `oc adm top storage`, is not a valid command for checking API server instances (top subcommands target nodes/pods). Option E, `oc get routes --all-namespaces`, lists OpenShift routes and is unrelated to api-server status.

Answer

oc get storageclass

Answer

oc adm top storage

Answer

oc get routes --all-namespaces

Question 3

A developer deploys an application using a Route that terminates TLS using the Edge termination strategy. The developer wants to ensure that all insecure HTTP traffic to the route is automatically redirected to HTTPS. Where must this setting be configured?

Accepted Answer

In the Route resource spec.tls.insecureEdgeTerminationPolicy field set to Redirect.. For an edge-terminated Route, the redirect of insecure HTTP to HTTPS is controlled by spec.tls.insecureEdgeTerminationPolicy set to Redirect. The router (HAProxy) reads this field and issues a 301/302 redirect for any plain HTTP request hitting the route. This is the supported, declarative way to enforce HTTPS on a Route.

Answer

By modifying the haproxy.config global template ConfigMap in the openshift-ingress namespace.

Answer

In the IngressController custom resource under spec.routeAdmission.wildcardPolicy.

Answer

In the Service resource annotations using route.openshift.io/termination: redirect.

Question 4

An OpenShift cluster's Ingress controller is failing to route external traffic because the router pods are crashing with 'Bind: address already in use'. What is the most likely cause that an administrator should investigate?

Accepted Answer

Another service or daemon on the worker node is already binding to host ports 80 or 443.. The 'Bind: address already in use' error means the router pod's haproxy process cannot bind to host ports 80/443 because another process on the node already holds them. OpenShift's Ingress Controller runs as a hostNetwork pod binding directly to the node's ports 80 and 443, so any conflicting daemon (nginx, httpd, another load balancer, or a leftover router) will cause the crash. Administrators should check with 'ss -tlnp | grep -E ":80|:443"' or 'netstat -tulpn' on the worker node to identify the conflicting process.

Answer

The OAuth client secret is invalid.

Answer

The default router deployment replica count is set to zero.

Answer

The wildcard DNS record for the cluster points to the wrong IP address.

Question 5

Which THREE parameters are commonly found in the SCC 'spec' section?

Accepted Answer

seLinuxContext. The SCC (SecurityContextConstraints) 'spec' section defines the security settings that pods may use, and seLinuxContext (A) is a valid spec field that specifies the SELinux context strategy (MustRunAs, RunAsAny) and required level/role/type/user for containers. runAsUser (C) is also a valid spec field that controls the UID strategy (MustRunAsRange, MustRunAsNonRoot, RunAsAny) and the allowed UID range for containers. allowedCapabilities (E) is likewise a valid spec field listing the Linux capabilities containers are permitted to add beyond the default set. namespaceSelector (B) is not an SCC spec parameter—it belongs to NetworkPolicy, PodAffinity, or admission webhook configurations—and imagePullPolicy (D) is a container image field in a Pod spec, not part of SecurityContextConstraints.

Answer

namespaceSelector

Answer

imagePullPolicy

Question 6

An administrator needs to drain a worker node safely for hardware maintenance, but some pods have local emptyDir storage that would be permanently deleted. Which flag must be added to the drain command to allow eviction of these pods?

Accepted Answer

--delete-emptydir-data. The --delete-emptydir-data flag explicitly tells kubectl/oc drain that it is acceptable to evict pods that use emptyDir volumes, which are node-local and will be permanently lost. Without this flag, drain refuses to proceed and reports an error listing pods with local storage. This is the documented way to acknowledge and accept the data loss during maintenance.

Answer

--allow-local-volumes

Answer

--ignore-daemonsets=false

Answer

--force-local-storage

Question 7

An administrator needs to expose an existing deployment using a quick command without writing a YAML manifest. Which command exposes port 8080 of a deployment named 'my-app' as a Service?

Accepted Answer

oc expose deployment my-app --port=8080. The 'oc expose' command creates a Service from an existing resource. Using 'oc expose deployment my-app --port=8080' generates a Service that targets the deployment's pods on port 8080, without requiring a YAML manifest. This is the standard imperative approach.

Answer

oc expose pod my-app --port=8080

Answer

oc service create my-app --port=8080

Answer

oc create service my-app --port=8080

Question 8

An administrator is troubleshooting a service account named 'cicd-bot' in the 'ci-cd' namespace that is failing to read pods in the 'production' namespace, despite a RoleBinding existing. Upon inspection, the RoleBinding references a Role (not a ClusterRole) in the 'ci-cd' namespace. Why is the service account failing to access resources in 'production'?

Accepted Answer

Standard Roles are namespace-scoped and cannot grant permissions to resources in another namespace. Roles in OpenShift are namespace-scoped and can only grant permissions to resources within their own namespace. A RoleBinding in the 'ci-cd' namespace referencing a Role in the same namespace cannot grant access to resources in the 'production' namespace. To grant cross-namespace access, a ClusterRole and ClusterRoleBinding (or RoleBinding referencing a ClusterRole) are required.

Answer

Roles cannot reference service accounts as subjects unless they are in the openshift-infra namespace

Answer

Service accounts cannot use RoleBindings, they require ClusterRoleBindings for any authorization

Answer

The service account token has expired and must be manually regenerated using oc adm ca

Question 9

Which command allows an administrator to view details of a specific project named 'web-app', including its annotations and status?

Accepted Answer

oc describe project web-app. The `oc describe project web-app` command is correct because `oc describe` is the standard OpenShift/Kubernetes subcommand for retrieving detailed, human-readable information about a resource, including its annotations, status, labels, and related events. For a Project resource, this output aggregates metadata such as the project's display name, description, status phase (Active/Terminating), and any annotations. It is the only option that uses a valid `oc` verb (`describe`) to produce the verbose, multi-section output the question requires.

Answer

oc inspect project web-app

Answer

oc show project web-app

Answer

oc get project web-app --details

Question 10

A security audit requires identifying all users who have direct cluster-admin privileges assigned via individual user bindings rather than groups. How can an administrator inspect the cluster-admin ClusterRoleBinding subjects?

Accepted Answer

oc get clusterrolebinding cluster-admin -o jsonpath='{.subjects[*]}'. The cluster-admin ClusterRoleBinding object stores its subjects (Users, Groups, ServiceAccounts) in the .subjects array of its JSON representation. Using 'oc get clusterrolebinding cluster-admin -o jsonpath="{.subjects[*]}"' extracts every subject entry, allowing the administrator to enumerate exactly which individual users, groups, and service accounts hold cluster-admin. This is the canonical way to audit direct user bindings versus group-derived bindings.

Answer

oc describe clusterrolebinding cluster-admin --users-only

Answer

oc get users --filter='cluster-admin'

Answer

oc adm policy list-cluster-admins

Question 11

When configuring a NetworkPolicy in OpenShift, which THREE options represent valid components or fields within a NetworkPolicy specification? (Choose THREE)

Accepted Answer

podSelector. Option A (podSelector) is correct because it is a core field of the Kubernetes/OpenShift NetworkPolicy spec that selects the pods to which the policy applies, using label selectors. Option D (ingress) is correct because ingress is a valid rule block that defines which inbound traffic is allowed to the selected pods, including from, ports, and protocol details. Option E (policyTypes) is correct because it explicitly lists which policy types the NetworkPolicy covers, valid values being Ingress, Egress, or both. Option B (routeSelector) is not a NetworkPolicy field; routes are OpenShift Route objects and are not selected by NetworkPolicy. Option C (clusterIP) is not a NetworkPolicy field; it is a Service attribute assigned to a Service's virtual IP, not part of the NetworkPolicy specification.

Answer

routeSelector

Answer

clusterIP

Question 12

Which THREE items are contained within a Helm Chart structure?

Accepted Answer

values.yaml. B (values.yaml) is correct because it is the default configuration file in a Helm chart that supplies values used to render the templates, allowing users to override settings at install time. C (Chart.yaml) is correct because it is the required chart metadata file containing fields such as apiVersion, name, version, and description that identify and version the chart. D (templates/ directory) is correct because it holds the Kubernetes manifest templates (e.g., deployment.yaml, service.yaml) that Helm renders with values into final YAML. A (Dockerfile) is not part of the Helm chart structure; it is used to build container images, which Helm charts typically reference rather than contain. E (ImageStream) is an OpenShift-specific API object, not a Helm chart component, so it does not belong.

Answer

Dockerfile

Answer

ImageStream

Question 13

An administrator needs to verify that the cluster autoscaler is successfully scaling worker nodes in response to pending pods. Which custom resource should the administrator inspect to check the autoscaler configuration and status?

Accepted Answer

ClusterAutoscaler and MachineAutoscaler. The ClusterAutoscaler and MachineAutoscaler custom resources are used to configure and check the status of the cluster autoscaler in OpenShift. The ClusterAutoscaler defines the overall autoscaling behavior, while MachineAutoscaler specifies which MachineSets are eligible for scaling. Inspecting these resources reveals whether scaling is occurring and any issues.

Answer

NodeScalingOperator resource

Answer

MachineConfigPool autoscaler status

Answer

ClusterVersion autoscaling spec

Question 14

You need to assign the 'cluster-reader' ClusterRole to an LDAP group named 'ldap-auditors' across the entire cluster. Which command accomplishes this?

Accepted Answer

oc adm policy add-cluster-role-to-group cluster-reader ldap-auditors. `oc adm policy add-cluster-role-to-group` is the canonical OpenShift command that binds a ClusterRole to a group at the cluster scope, creating a ClusterRoleBinding. Passing 'cluster-reader' as the role and 'ldap-auditors' as the group grants the LDAP group cluster-wide read access.

Answer

oc set cluster-role cluster-reader --group=ldap-auditors

Answer

oc adm policy add-role-to-group cluster-reader ldap-auditors --global

Answer

oc create rolebinding ldap-auditors --clusterrole=cluster-reader --group=ldap-auditors --cluster

Question 15

You are examining a PersistentVolume in OpenShift and notice its status is Released. What does this indicate?

Accepted Answer

The PVC associated with the PV has been deleted, but the volume has not yet been reclaimed.. A PersistentVolume in Released state means its bound PersistentVolumeClaim was deleted, but the PV has not yet been reclaimed or recycled. The PV still holds the data and remains unavailable for new claims until an administrator manually intervenes (e.g., deletes and recreates the PV, or clears the claimRef). This is distinct from Available (ready for binding) and Bound (actively attached to a PVC).

Answer

The PV is currently bound to an active PVC and is in use by a running pod.

Answer

The PV has failed its health check and has been quarantined by the CSI driver.

Answer

The PV is available for binding by any new incoming PVC request.