EX280 Practice Test 28 — 15 Questions

Question 1

Which command-line argument can you use to change the output format of 'oc get' to YAML?

Accepted Answer

-o yaml. The `-o` flag (short for `--output`) is the standard way to specify the output format for `oc get` and other `oc` commands. It accepts values like `yaml`, `json`, `wide`, `name`, etc. Therefore, `-o yaml` correctly changes the output to YAML.

Answer

--format yaml

Answer

--yaml

Answer

-f yaml

Question 2

You need to allow a specific service account to run pods as root. Which command should you use to associate the 'privileged' SCC with the 'default' service account in the 'web-apps' namespace?

Accepted Answer

oc adm policy add-scc-to-user privileged -z default -n web-apps. The correct command to associate a Security Context Constraint (SCC) with a service account in OpenShift is 'oc adm policy add-scc-to-user'. The '-z' flag specifies the service account name, and '-n' specifies the namespace. This command adds the 'privileged' SCC to the 'default' service account in the 'web-apps' namespace, allowing pods running under that service account to request privileged access and run as root. This is the standard administrative operation for granting SCC permissions.

Answer

oc add scc privileged default -n web-apps

Answer

oc apply scc privileged --user=default -n web-apps

Answer

oc patch scc privileged -p '{"users": ["default"]}'

Question 3

You have a Helm chart that requires custom values for different environments. Which flag allows you to pass a custom values file?

Accepted Answer

--values. The --values flag (or -f) is used with Helm commands like helm install or helm upgrade to specify a YAML file containing custom values that override the chart's default values.yaml. This is the standard way to provide environment-specific configurations. The flag can be used multiple times, with later files taking precedence.

Answer

--override

Answer

--config

Answer

--set-file

Question 4

When managing ImageStreams in OpenShift, which TWO tasks can an administrator perform using oc commands? (Choose two.)

Accepted Answer

Creating an alias or tag pointing one ImageStream tag to another using oc tag. Option A is correct because the `oc tag` command creates or updates tags and aliases within an ImageStream, allowing one tag to point to another tag or image (e.g., `oc tag myis:latest myis:stable`). Option D is correct because `oc import-image` imports image metadata from an external container registry into an ImageStream, creating or updating the ImageStream tags with the remote image's manifest and layers. Option B is incorrect because there is no `oc test-image` subcommand in OpenShift; unit testing of images is not an `oc` function. Option C is incorrect because `oc tag` only manages image tag references and does not compile source code into binaries. Option E is incorrect because `oc image` does not modify kernel parameters on worker nodes; kernel tuning is done via MachineConfig or node-level tooling, not image commands.

Answer

Running unit tests against container image layers using oc test-image

Answer

Compiling raw source code into an executable binary using oc tag

Answer

Directly modifying kernel parameters on worker nodes via oc image

Question 5

Which THREE of the following commands are valid OpenShift CLI commands for managing user policies and role assignments? (Choose THREE)

Accepted Answer

oc adm policy add-role-to-user. Option C, `oc adm policy add-role-to-user`, is correct because it is the standard administrative command for binding a role to a user within a specific project namespace, granting that user the permissions defined by the role. Option D, `oc adm policy remove-role-from-user`, is correct because it is the counterpart command that removes an existing role binding from a user in a project, revoking those permissions. Option E, `oc adm policy add-cluster-role-to-group`, is correct because it binds a ClusterRole to a group at the cluster scope, which is the proper way to grant cluster-wide permissions to multiple users at once. Option A, `oc user modify-role`, is not a valid OpenShift CLI command; user objects are managed with commands like `oc adm policy` or `oc create user`, and there is no `modify-role` subcommand. Option B, `oc set policy-binding`, is also invalid; the `oc set` command manages resources like env, image, and resources, not policy bindings, which are handled exclusively through `oc adm policy`.

Answer

oc user modify-role

Answer

oc set policy-binding

Question 6

An OpenShift cluster node is reporting High CPU and Memory pressure. Which THREE commands or tools can an administrator use to investigate resource bottlenecks on that node? (Choose THREE)

Accepted Answer

oc describe node . Option A, `oc describe node `, is correct because it surfaces the node's Conditions (MemoryPressure, DiskPressure, PIDPressure), Allocatable vs Capacity, and the resource requests/limits of every scheduled pod, which directly reveals what is consuming the node. Option B, `oc adm top nodes`, is correct because it queries the metrics pipeline (metrics-server) to show live CPU and memory usage and percentage per node, giving an immediate quantitative view of the bottleneck. Option E, `oc debug node/ -- chroot /host top`, is correct because it launches a privileged debug pod on the node, chroots into the host filesystem, and runs `top` against the host's processes, exposing the actual OS-level consumers of CPU and memory. Option C, `oc get events --namespace=default`, is not appropriate because events are namespaced and scoped to workloads in that namespace, not node-level resource pressure. Option D, `oc logs deployment/cluster-version-operator`, is not appropriate because CVO logs concern cluster version upgrades and reconciliation, not node resource bottleneck diagnosis.

Answer

oc get events --namespace=default

Answer

oc logs deployment/cluster-version-operator

Question 7

An administrator wants to configure a NetworkPolicy that allows incoming traffic only from pods with the label 'role=frontend' residing in any namespace, provided those namespaces have the label 'environment=production'. How should the namespaceSelector and podSelector be combined?

Accepted Answer

In the same ingress 'from' array item, combining namespaceSelector and podSelector. In Kubernetes NetworkPolicy, when you specify a single ingress rule with a 'from' array item that contains both namespaceSelector and podSelector, the two selectors are ANDed together. This means traffic is allowed only from pods that match the podSelector AND reside in namespaces that match the namespaceSelector. This exactly meets the requirement: pods with label 'role=frontend' in any namespace labeled 'environment=production'.

Answer

By referencing an external ClusterRole binding with label selectors

Answer

Using a peerSelector object that nests both labels

Answer

In separate ingress rules, where one rule has namespaceSelector and another has podSelector

Question 8

An application team reports that their application cannot connect to an external database due to a firewall blocking port 3306. The administrator wants to test network connectivity from inside a running application pod to the external database host. Which tool can they run using 'oc exec'?

Accepted Answer

oc exec <pod-name> -- nc -zv db.example.com 3306. `oc exec` allows running arbitrary commands inside a running container, and `nc` (netcat) with the `-zv` flags is a standard tool for testing TCP connectivity to a specific host and port. The `-z` flag performs a scan without sending data, and `-v` provides verbose output, making it ideal for verifying whether port 3306 is reachable from the pod's network namespace. This directly addresses the application team's issue by simulating the connection attempt from the same environment.

Answer

oc network test db.example.com 3306

Answer

oc adm port-forward pod/<pod-name> 3306:3306

Answer

oc debug pod/<pod-name> -- test-connection

Question 9

Which TWO conditions will prevent a pod from successfully mounting a PersistentVolumeClaim?

Accepted Answer

The PVC is in a Pending state because it failed to bind or provision.. Option B is correct because a PersistentVolumeClaim must be Bound before a pod can mount it; if the PVC remains Pending due to a binding or dynamic provisioning failure (e.g., no matching PV, missing StorageClass, or provisioner error), the kubelet cannot attach and mount the volume, so the pod stays in ContainerCreating. Option C is correct because a ReadWriteOnce (RWO) PersistentVolume can only be attached to a single node at a time; if the volume is already attached to another node, the new pod's mount fails with a Multi-Attach error until the volume is detached. Option A is wrong because running in the default namespace does not by itself prevent PVC mounting—namespaces only affect which PVCs/PVs are visible, and a valid PVC in the same namespace works fine. Option D is wrong because allowVolumeExpansion=true merely permits resizing a PVC after creation and has no negative effect on mounting. Option E is wrong because CPU limits are a scheduling/resource concern and do not block volume attach or mount operations.

Answer

The pod is running in the default project.

Answer

The StorageClass has allowVolumeExpansion set to true.

Answer

The pod namespace has excess CPU limits.

Question 10

An administrator wants to verify if the OpenShift cluster upgrade to version 4.14 has successfully completed for all core components. Which status field in the ClusterVersion resource should show 'True' for the progressing and available conditions?

Accepted Answer

Available=True and Progressing=False. The ClusterVersion resource exposes two key conditions: Available and Progressing. When an upgrade finishes successfully, the cluster reports Available=True (the cluster is healthy and all components are operational) and Progressing=False (no upgrade or configuration change is currently in flight). This combination is the canonical signal that the OpenShift 4.14 upgrade has completed for all core components.

Answer

Completed=True and Ready=True

Answer

Available=False and Progressing=True

Answer

Upgraded=True and Finished=True

Question 11

Which TWO of the following statements regarding OpenShift Projects and Namespaces are correct? (Choose TWO)

Accepted Answer

Every Project in OpenShift has a corresponding underlying Kubernetes Namespace.. Option C is correct because OpenShift Projects are implemented as an abstraction layer over Kubernetes Namespaces: every Project object has a 1:1 relationship with an underlying Namespace of the same name, which is where the actual workloads and resources reside. Option E is correct because a Project is essentially a Kubernetes Namespace enriched with OpenShift-specific annotations (such as openshift.io/display-name, openshift.io/requester, and openshift.io/sa.scc.*) plus additional management features like project request templates, self-provisioning, and role bindings. Option A is incorrect because the relationship is one-to-one, not one-to-many: a single Namespace maps to exactly one Project, and a Project cannot span multiple Namespaces. Option B is incorrect because project request templates are applied when a user creates a Project via 'oc new-project' or the web console's project request flow, not when a Namespace is created directly with 'oc create namespace', which bypasses the ProjectRequest API. Option D is incorrect because Projects and Namespaces are flat, non-hierarchical constructs; OpenShift does not support nesting Projects within other Projects.

Answer

A single namespace can contain multiple distinct OpenShift projects.

Answer

Namespaces created via 'oc create namespace' automatically instantiate project request templates.

Answer

Projects can be nested hierarchically within other projects.

Question 12

An administrator notices that pods on different worker nodes cannot communicate with each other. Upon checking the cluster network operator, it appears the MTU settings between the underlying physical network and the cluster overlay network mismatch. Which OpenShift command checks the cluster network operator status?

Accepted Answer

oc get clusteroperator network. The Cluster Network Operator (CNO) status is exposed as a clusteroperator resource named 'network'. Running 'oc get clusteroperator network' shows the operator's availability, progress, and any degraded conditions, which is the standard way to check network operator health. This command directly queries the operator's status.

Answer

oc get cni cluster

Answer

oc describe networkconfig

Answer

oc get nodes --show-mtu

Question 13

An administrator needs to configure a BuildConfig so that whenever a new image is pushed to a dependent ImageStream tag, a new build is automatically triggered. Which trigger type must be added to the BuildConfig?

Accepted Answer

ImageChange. The ImageChange trigger is specifically designed to watch an ImageStreamTag and automatically start a new BuildConfig run whenever the referenced image stream tag is updated (e.g., a new image is pushed). This is the standard mechanism for chaining builds or rebuilding an application when its base/builder image changes. It is configured under spec.triggers with type: ImageChange and an imageChange.imageStreamTag reference.

Answer

Webhook

Answer

Periodic

Answer

ConfigChange

Question 14

An administrator wants to view the last 50 lines of logs for a pod named 'api-server-xyz' and keep the stream open for new log entries. Which command should they use?

Accepted Answer

oc logs api-server-xyz --tail=50 -f. 'oc logs api-server-xyz --tail=50 -f' retrieves the last 50 lines and then follows the stream, printing new entries as they arrive. The --tail flag limits historical output, and -f (short for --follow) keeps the connection open. This is the standard pattern for live-tailing pod logs in OpenShift.

Answer

oc describe pod api-server-xyz --lines=50

Answer

oc logs api-server-xyz --lines=50 --follow

Answer

oc tail api-server-xyz -n 50

Question 15

An administrator wants to configure automated remediation for worker nodes that become unresponsive or experience hardware failure. Which TWO configurations or resources are required for a MachineHealthCheck to function properly? (Choose TWO)

Accepted Answer

Unhealthy conditions specifying the node status condition and timeout duration.. Option B is correct because a MachineHealthCheck must define unhealthyConditions, which specify the node status condition type (for example Ready) and a timeout duration that determines how long the condition must persist before the node is considered unhealthy and remediation is triggered. Option C is correct because a MachineHealthCheck uses a selector with matchLabels to identify the target MachineSet or machine pool whose machines it will monitor and remediate. Option A is incorrect because MachineHealthCheck does not use a replica count for remediation pods; remediation is performed by deleting and recreating the unhealthy Machine via its MachineSet. Option D is incorrect because ContainerRuntimeConfig is used to configure container runtime settings like pidsLimit or logLevel, not node health remediation. Option E is incorrect because an OperatorGroup defines the namespaces an Operator watches and is unrelated to MachineHealthCheck configuration.

Answer

A replica count specifying how many remediation pods to run.

Answer

A ContainerRuntimeConfig specifying reboot parameters.

Answer

An OperatorGroup defining the namespace for the health check.