EX280 Practice Test 3 — 10 Questions

Question 1

An administrator is configuring topology-aware storage provisioning. A StorageClass uses volumeBindingMode: WaitForFirstConsumer. When is the PersistentVolume actually created?

Accepted Answer

When the scheduler places the pod referencing the PVC onto a specific worker node.. With volumeBindingMode: WaitForFirstConsumer, the PV is not provisioned when the PVC is created. Instead, the scheduler delays binding until a pod using the PVC is scheduled, so it can pick a node and provision the volume in the correct topology zone. The PV is created at that point, ensuring the volume lands in the same zone as the pod.

Answer

When the PVC object is successfully created in the namespace.

Answer

When the user executes 'oc adm pv create'.

Answer

When the CSI driver operator starts up during cluster bootstrap.

Question 2

An administrator needs to check the status of all MachineSets in an OpenShift 4.14 cluster to see how many worker machines are currently provisioned and running. Which command should be used?

Accepted Answer

oc get machinesets -A (or within openshift-machine-api). MachineSets are the OpenShift 4 resource that manages the desired and current number of machines per availability zone for a pool. Running 'oc get machinesets -A' (or scoped to openshift-machine-api) lists all MachineSets with their desired, current, and ready replica counts, which is exactly what the administrator needs to see how many worker machines are provisioned and running.

Answer

oc adm get machines

Answer

oc get cluster-infrastructure

Answer

oc get machineconfigpools

Question 3

Which command is used to switch the active project context to a namespace named 'staging' in the OpenShift CLI?

Accepted Answer

oc project staging. The `oc project <name>` command is the documented OpenShift CLI method for switching the active project (namespace) context for subsequent commands. It updates the current context in the kubeconfig so that all future `oc` commands target the 'staging' namespace without needing `-n staging`. This is functionally equivalent to `oc config set-context --current --namespace=staging` but is the idiomatic OpenShift shortcut.

Answer

oc config set-namespace staging

Answer

oc use project staging

Answer

oc switch-context staging

Question 4

Which THREE conditions must be met for a NetworkPolicy to successfully allow traffic from another pod? (Choose THREE)

Accepted Answer

If an ingress policy is present, the connection must be explicitly permitted by at least one rule.. Option C is correct because Kubernetes NetworkPolicy is default-deny for ingress once any policy selects the pod: if an ingress policy exists, the connection must be explicitly allowed by at least one ingress rule, otherwise the traffic is dropped. Option D is correct because the policy's ports and protocol fields (e.g., port: 6379, protocol: TCP) must match the actual destination port and L4 protocol of the traffic for the rule to permit it. Option E is correct because the ingress rule's from selectors — podSelector and/or namespaceSelector — must match the source pod's labels and namespace for the connection to be allowed. Option A is wrong because NetworkPolicy enforcement is independent of the number of worker nodes; it depends on a CNI plugin that implements NetworkPolicy (e.g., Calico, Cilium), not cluster size. Option B is wrong because NetworkPolicy operates at the pod/CNI layer inside the cluster and does not require any top-of-rack switch port trunk configuration.

Answer

The cluster must have exactly three worker nodes.

Answer

The physical switch port on the top-of-rack switch must be configured in trunk mode.

Question 5

An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?

Accepted Answer

spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate. For edge termination, the Route's spec.tls section holds the certificate, key, and optional CA certificate as plain string fields (not base64). The router terminates TLS at the edge using these values, then forwards plain HTTP to the pods. The correct fields are spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate.

Answer

spec.endpoint.tls with base64 encoded string data

Answer

metadata.annotations containing openshift.io/tls-cert and openshift.io/tls-key

Answer

status.ingress.tls for automatic cert-manager synchronization

Question 6

An administrator needs to temporarily prevent the Machine Config Operator from applying pending MachineConfig changes to the worker nodes while performing troubleshooting. How should the administrator accomplish this?

Accepted Answer

Patch the worker MachineConfigPool to set 'spec.paused: true'.. Setting 'spec.paused: true' on the worker MachineConfigPool tells the Machine Config Operator to stop rendering and applying new MachineConfigs to that pool. This is the documented, supported way to temporarily halt MCO updates during troubleshooting without deleting configs or disrupting the operator itself. Once troubleshooting is complete, setting 'paused: false' resumes normal reconciliation.

Answer

Delete all pending MachineConfig objects from the cluster.

Answer

Scale down the machine-config-operator deployment in openshift-machine-config-operator to zero replicas.

Answer

Annotate all worker nodes with 'machineconfiguration.openshift.io/paused=true'.

Question 7

Which THREE items can be inspected using 'oc describe' when troubleshooting a failing storage attachment in OpenShift?

Accepted Answer

The PersistentVolumeClaim (to check binding status and provisioner errors). Option B is correct because 'oc describe pvc ' shows the PersistentVolumeClaim's status, bound volume, and provisioner-related events, which directly reveal binding failures or dynamic provisioning errors during a storage attachment problem. Option C is correct because 'oc describe pod ' surfaces scheduling decisions and volume mount events (such as FailedMount or FailedAttachVolume), pinpointing why a pod cannot attach or mount its storage. Option E is correct because 'oc describe pv ' reports the PersistentVolume's status, claim reference, reclaim policy, and node affinity/attachment details, helping verify whether the volume is available and attachable to the target node. Option A is not applicable because the cluster image registry configuration is inspected via registry operator resources or configs (for example 'oc get configs.imageregistry.operator.openshift.io'), not as a storage attachment object. Option D is not applicable because OAuth client credentials are stored in a Secret and relate to authentication, not to diagnosing storage attachment failures.

Answer

The cluster image registry configuration

Answer

The OAuth client credentials secret

Question 8

Which resource represents the physical or cloud storage provisioned in the cluster by an administrator, independent of any user namespace claims?

Accepted Answer

PersistentVolume. A PersistentVolume (PV) is the cluster-scoped resource that represents actual storage provisioned by an administrator — an NFS export, EBS volume, or Ceph RBD image — and exists independently of any namespace. It is bound to a PersistentVolumeClaim (PVC) when a user requests storage, but the PV itself is not owned by or scoped to a user namespace.

Answer

StorageClass

Answer

PersistentVolumeClaim

Answer

PodVolume

Question 9

How do you define a health check that verifies if your application is ready to start receiving traffic?

Accepted Answer

ReadinessProbe. A ReadinessProbe determines whether a container is ready to accept traffic. If the probe fails, the pod is removed from the Service's endpoints, so no traffic is routed to it until the probe succeeds. This directly matches the requirement of verifying readiness to receive traffic.

Answer

StartupProbe

Answer

LivenessProbe

Answer

HealthProbe

Question 10

Which TWO of the following conditions must be met for a ServiceAccount from 'namespace-a' to successfully access API resources in 'namespace-b'? (Choose TWO)

Accepted Answer

A RoleBinding must exist in 'namespace-b' referencing the ServiceAccount as 'system:serviceaccount:namespace-a:sa-name'.. Option C is correct because Kubernetes RBAC bindings are namespaced: to grant a ServiceAccount from namespace-a permissions in namespace-b, a RoleBinding must be created in namespace-b that references the subject as 'system:serviceaccount:namespace-a:sa-name'. Option E is correct because the RoleBinding only associates the subject with permissions; the actual API verb permissions (get, list, watch, create, etc.) on the target resources must be defined in a Role (namespaced) or ClusterRole that the binding references. Option A is incorrect because LimitRange objects only enforce resource quota defaults/limits on pods and containers and have no bearing on RBAC authorization. Option B is incorrect because Kubernetes RBAC has no 'administrative override annotation' mechanism for namespaces; access is governed solely by Roles/ClusterRoles and their bindings. Option D is incorrect because cluster-admin is not required and would be excessive; a namespaced Role plus RoleBinding in namespace-b is sufficient and follows least privilege.

Answer

The source namespace must disable its LimitRange objects.

Answer

An administrative override annotation must be placed on the target namespace.

Answer

The ServiceAccount must be granted cluster-admin rights cluster-wide.