EX280 Practice Test 29 — 15 Questions

Question 1

An administrator is planning an OpenShift 4.14 cluster upgrade and wants to ensure that specific safety checks and conditions are met before proceeding. Which THREE conditions must be true for an upgrade to proceed smoothly? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

All MachineConfigPools must be fully updated and not in a degraded state.. Option A is correct because OpenShift's Cluster Version Operator will not begin an upgrade while any MachineConfigPool is still updating or degraded; each pool must report Updated=True and Degraded=False so that node configuration rollouts complete cleanly. Option D is correct because upgrades must follow a supported path in the Cincinnati update graph — the target version must be a recommended or valid next hop from the current version, otherwise the CVO blocks the update. Option E is correct because all cluster operators (including the Cluster Version Operator itself) must report Available=True and Degraded=False; a degraded operator halts the upgrade to prevent further damage. Option B is wrong because 'nightly' channels are for pre-release testing, not production upgrades, which should use stable/eus channels. Option C is wrong because user namespaces and workloads are not deleted before an upgrade; OpenShift upgrades are designed to preserve tenant workloads.

Answer

The cluster must be switched to the 'nightly' channel for all production upgrades.

Answer

All user-created namespaces must be temporarily deleted prior to upgrade.

Question 2

A cluster administrator has created a VolumeSnapshotClass and a VolumeSnapshot object targeting an active PVC. However, the VolumeSnapshot status never shows ready to use, and the underlying storage provider logs indicate snapshot creation failed due to missing cluster permissions. Which core OpenShift operator is primarily responsible for managing volume snapshot controllers and CRDs in OpenShift 4.14?

Accepted Answer

The Cluster Storage Operator. The Cluster Storage Operator is responsible for deploying and managing the CSI drivers, snapshot controllers, and associated CRDs (VolumeSnapshotClass, VolumeSnapshot, VolumeSnapshotContent) in OpenShift 4.x. When snapshot creation fails due to missing cluster permissions, the Cluster Storage Operator's deployed controller is the component that requires the RBAC to create snapshots via the CSI driver.

Answer

The Ingress Operator

Answer

The Authentication Operator

Answer

The Machine Config Operator

Question 3

An administrator configures an OAuth provider with user mapping method 'lookup'. What does this mapping method do when a user authenticates for the first time?

Accepted Answer

It requires that a User object already exists and is pre-associated with the identity; otherwise, login fails.. The 'lookup' mapping method in OpenShift's OAuth configuration requires that a User object already exists and is pre-associated with the incoming Identity. When a user authenticates for the first time, the OAuth server checks if an Identity exists for the provider's user ID; if not, it attempts to find a User with that identity. If no such User exists, login fails. This is in contrast to the 'claim' method, which dynamically creates User and Identity objects based on claims from the identity provider.

Answer

It rejects all login attempts unless the user is member of the 'system:masters' group.

Answer

It automatically creates a new User object and links it to the incoming Identity.

Answer

It maps all incoming users to a single shared service account.

Question 4

An administrator wants to check the status of all cluster operators, specifically verifying that the Network and DNS operators are healthy. Which command should be run?

Accepted Answer

oc get clusteroperators. The `oc get clusteroperators` command lists all ClusterOperators in an OpenShift cluster, showing their AVAILABLE, PROGRESSING, DEGRADED, and other status conditions. This is the standard way to verify the health of core operators like the Network operator (network.operator.openshift.io) and DNS operator (dns.operator/default). Administrators use this command to quickly assess whether any operator is degraded or unavailable.

Answer

oc get operators --cluster

Answer

oc describe operators

Answer

oc adm check health

Question 5

An administrator needs to configure a Route that handles encrypted communication both from the client to the router AND from the router to the backend pod. Which termination type is required?

Accepted Answer

reencrypt. The reencrypt termination type allows the router to decrypt incoming TLS traffic and then re-encrypt it before forwarding to the backend pod, enabling end-to-end encryption with separate certificates for the client-to-router and router-to-pod legs. This satisfies the requirement for encrypted communication both from client to router and router to backend. Edge termination only encrypts client-to-router, while passthrough does not decrypt at the router at all.

Answer

passthrough

Answer

edge

Answer

secure-tunnel

Question 6

Which THREE components are involved in TLS termination for routes?

Accepted Answer

Secret. In OpenShift, TLS termination for routes requires a Secret (option A) that holds the TLS certificate and private key, which the router uses to serve HTTPS. The Route (option B) is the object where you configure TLS termination (e.g., spec.tls.termination: edge, passthrough, or reencrypt) and reference the certificate. The IngressController (option C) is the router component that actually performs TLS termination and enforces the route's TLS settings. A Service (option D) only provides internal load balancing to pods and does not handle TLS certificates or termination. A ConfigMap (option E) stores non-sensitive configuration data and is not used to hold TLS certificates or keys for route termination.

Answer

Service

Answer

ConfigMap

Question 7

An administrator is preparing a custom Security Context Constraint (SCC) that will be granted to a specific ServiceAccount used by a log-forwarding DaemonSet. The DaemonSet pods must be able to mount a hostPath volume at /var/log but must not run as UID 0 and must not use the host network. Which SCC field combination must the administrator set to allow only the hostPath mount while still blocking privileged escalation and host networking?

Accepted Answer

Set allowHostDirVolumePlugin: true, allowPrivilegedContainer: false, and allowHostNetwork: false in the custom SCC.. A custom SCC must explicitly enable the host directory volume plugin so the DaemonSet can mount /var/log, while privileged containers and host networking remain disabled to preserve isolation. The other combinations either grant excessive privileges that the scenario forbids or disable the hostPath plugin and break the workload's core function.

Answer

Set allowHostDirVolumePlugin: true, allowPrivilegedContainer: true, and allowHostNetwork: false in the custom SCC.

Answer

Set allowHostDirVolumePlugin: false, allowPrivilegedContainer: false, and allowHostNetwork: false in the custom SCC.

Answer

Set allowHostDirVolumePlugin: false, allowPrivilegedContainer: false, and allowHostNetwork: true in the custom SCC.

Question 8

An OpenShift administrator must give the user 'dana' permission to list and watch pods and services across every project in the cluster, but nothing else. The administrator decides to create a new ClusterRole named 'ns-reader' containing only those rules and bind it to dana. Which command correctly creates this ClusterRole?

Accepted Answer

oc create clusterrole ns-reader --verb=list,watch --resource=pods,services. The task requires a new cluster-scoped ClusterRole with only list and watch on pods and services. The oc create clusterrole subcommand is the direct imperative way to author that object from the CLI, producing a ClusterRole that can later be bound cluster-wide. Creating a namespaced Role, binding the broad view role, or using add-cluster-role-to-user all fail to produce the narrowly scoped ClusterRole described.

Answer

oc adm policy add-cluster-role-to-user ns-reader dana --verb=list,watch --resource=pods,services

Answer

oc create role ns-reader --verb=list,watch --resource=pods,services -n default

Answer

oc create clusterrolebinding ns-reader --clusterrole=view --user=dana

Question 9

An administrator is preparing a custom SecurityContextConstraints (SCC) named app-scc to allow pods to run with a specific user ID and to use the host network. Which two fields must be set in the SCC to achieve these requirements? (Choose two.)

Accepted Answer

allowHostNetwork: true. The runAsUser field with MustRunAs ensures the pod runs with a specific UID, and allowHostNetwork enables the use of the host network namespace. These two fields directly address the stated requirements. Other fields like allowPrivilegedContainer or seLinuxContext are unrelated and would unnecessarily broaden the SCC's permissions.

Answer

allowPrivilegedContainer: true

Answer

readOnlyRootFilesystem: true

Answer

seLinuxContext: RunAsAny

Question 10

An administrator runs 'oc debug node/worker-1' and gets a shell in the debug pod, but when they try to run 'crictl ps' to list running containers on the node, the command is not found. They confirm the node's kubelet is healthy and workloads are running. What is the correct explanation and fix?

Accepted Answer

The debug pod must be started with 'chroot /host' executed inside it, because the host binaries are mounted at /host but the shell starts in the container root.. 'oc debug node' intentionally isolates the administrator: the host filesystem is bind-mounted at /host rather than made the process root, so host-only binaries are not on PATH. Entering the host namespace with 'chroot /host' makes crictl, journalctl, and other node utilities resolvable, which is the supported method for inspecting CRI containers on a node.

Answer

crictl has been deprecated in favor of 'oc adm node-logs', so the administrator should use that command for container inspection instead.

Answer

The debug pod uses a minimal image without crictl; they must add '--image=registry.access.redhat.com/ubi9/ubi' to install it manually.

Answer

The administrator lacks the cluster-admin role, so crictl is hidden by RBAC; granting cluster-admin will make the binary visible.

Question 11

A developer reports that a Service in the project `webapp` is not exposing the expected endpoints, even though the Deployment shows all replicas Running. The administrator inspects the Service and sees the selector is `app: web-frontend`. Which command should the administrator run to verify whether the Pods actually carry the labels the Service selector expects?

Accepted Answer

oc get pods -n webapp --show-labels. A Service selects backend Pods purely by label matching against its selector. When a Deployment is healthy but the Service has no endpoints, the most common cause is a mismatch between the Service selector and the labels applied to the Pod template. Listing Pods with their labels exposes that mismatch directly, allowing the administrator to correct either the selector or the Pod labels.

Answer

oc get endpoints webapp -n webapp

Answer

oc get networkpolicy -n webapp

Answer

oc describe deployment webapp -n webapp

Question 12

You are preparing to deploy an application to an OpenShift Container Platform 4.14 cluster. The application is defined across multiple Kubernetes manifests, and you need to ensure that a set of common labels and a namespace prefix are applied to all resources. You want to use Kustomize to manage this without writing custom scripts. Which of the following best describes how to achieve this using the oc CLI?

Accepted Answer

Create a kustomization.yaml file that references the base manifests, then run oc apply -k . to apply the customized resources.. Kustomize is integrated into the oc CLI, and the oc apply -k command is the correct way to apply a kustomization directory. It reads the kustomization.yaml, applies transformations like common labels and name prefixes, and then applies the resulting resources to the cluster. This declarative approach is preferred over manual generation and piping.

Answer

Run oc apply -f kustomization.yaml to apply the customized resources directly.

Answer

Run oc new-app --kustomize . to deploy the application from the Kustomize directory.

Answer

Use the oc kustomize command to generate the customized manifests, then pipe the output to oc apply -f -.

Question 13

An administrator notices that the `openshift-apiserver` cluster operator reports `Available=True` but `Progressing=True` with the message `APIServerDeploymentProgressing: deployment/openshift-apiserver: 1/3 pods ready`. The administrator wants to determine which specific pod is not ready and why. Which command provides the most direct diagnostic information about the individual pod's readiness?

Accepted Answer

oc describe pod -n openshift-apiserver <pod-name>. When a cluster operator reports a deployment progressing with unready pods, the next step is to inspect the affected pod directly. The oc describe pod output includes the pod's conditions, container statuses, and recent events, which together explain why the pod is not Ready, such as a failing readiness probe or an image pull error. Higher-level operator status and pod lists lack this granularity.

Answer

oc get clusteroperator openshift-apiserver -o yaml

Answer

oc get pods -n openshift-apiserver -o wide

Answer

oc logs -n openshift-apiserver <pod-name> --tail=50

Question 14

An administrator notices that a Deployment named 'webapp' in the namespace 'production' is not reaching its desired replica count. Running 'oc get deployment webapp -n production' shows READY 2/3 but no events appear on the Deployment itself. The administrator wants to determine why the third ReplicaSet pod cannot be scheduled. Which command best reveals the scheduling failure reason?

Accepted Answer

oc describe pod -n production -l app=webapp. The Deployment controller only records aggregate replica counts; the actual scheduling decision is made for the pod object by the scheduler, and its reasoning is written to the pod's status conditions and Events. Describing the pods matched by the Deployment's selector surfaces messages such as taint toleration mismatches, insufficient CPU, or unsatisfied node affinity, which directly explain the missing replica.

Answer

oc rollout status deployment/webapp -n production

Answer

oc get deployment webapp -n production -o yaml

Answer

oc logs deployment/webapp -n production --tail=50

Question 15

A cluster administrator wants to prevent any pod in the `finance` namespace from requesting the `NET_RAW` capability, which is not needed by the applications there. The administrator plans to modify the SCC bound to the namespace's default ServiceAccount. Which SCC field should be used to explicitly drop `NET_RAW`?

Accepted Answer

`requiredDropCapabilities: ["NET_RAW"]`. Capability restrictions in an SCC are enforced through `requiredDropCapabilities`, which removes the listed capabilities from every container admitted under that SCC. Listing `NET_RAW` there prevents pods in the `finance` namespace from retaining it, regardless of what the pod manifest requests. The allow list and default-add list have the opposite effect, and SELinux fields govern labels rather than capabilities.

Answer

`defaultAddCapabilities: ["NET_RAW"]`

Answer

`seLinuxContext: MustRunAs` with a custom `seLinuxOptions` type of `net_raw`

Answer

`allowedCapabilities: ["NET_RAW"]`