EX280 Practice Test 30 — 15 Questions

Question 1

When creating a custom SCC, what is the best practice for assigning it to users?

Accepted Answer

Bind the SCC to a specific service account in a specific namespace. Binding the SCC to specific groups or service accounts is safer than broad cluster assignments.

Answer

Bind the SCC to the 'cluster-admin' user

Answer

Bind the SCC to the 'system:authenticated' group

Answer

Assign the SCC to the namespace object directly

Question 2

Which TWO service accounts have special roles in OpenShift projects regarding SCCs?

Accepted Answer

default. The 'default' and 'builder' service accounts are commonly used and often have pre-configured roles.

Answer

oauth-proxy

Answer

kube-system

Answer

system-admin

Question 3

An OpenShift cluster uses a CSI driver that supports volume cloning. A user wants to clone an existing PVC named 'data-pvc' into a new PVC named 'clone-pvc'. How should the dataSource be specified?

Accepted Answer

dataSource: { apiGroup: "", kind: "PersistentVolumeClaim", name: "data-pvc" }. To clone a PVC, the dataSource in the new PVC must reference the existing PVC name and kind 'PersistentVolumeClaim'.

Answer

dataSource: { apiGroup: "snapshot.storage.k8s.io", kind: "VolumeSnapshot", name: "data-pvc" }

Answer

spec.cloneSource: "data-pvc"

Answer

spec.volumeName: "data-pvc"

Question 4

Which command removes an SCC from a service account?

Accepted Answer

oc adm policy remove-scc-from-user. The 'oc adm policy remove-scc-from-user' command reverses the policy assignment.

Answer

oc remove-scc

Answer

oc delete scc-binding

Answer

oc patch scc

Question 5

An administrator needs to set a default StorageClass for the entire OpenShift cluster so that PVCs without a storageClassName specified automatically use it. How is this configured?

Accepted Answer

By adding the annotation storageclass.kubernetes.io/is-default-class: "true" to the StorageClass object.. Annotating a StorageClass with 'storageclass.kubernetes.io/is-default-class: "true"' makes it the default storage class.

Answer

By modifying the kube-controller-manager operator configuration.

Answer

By naming the StorageClass 'default-sc' exactly.

Answer

By setting defaultStorageClass: true in the cluster-config ConfigMap.

Question 6

Which TWO of the following are valid ways to secure a route?

Accepted Answer

Using 'edge' termination with a custom certificate. Route security can be handled by choosing the right termination mode and using proper certificates.

Answer

Allowing all traffic on port 80

Answer

Using insecure edge termination

Answer

Disabling TLS completely

Question 7

A cluster operator is reviewing the volume snapshot implementation in an OpenShift 4.14 environment. Which THREE components or resources are required to successfully perform and manage volume snapshots? (Choose THREE)

Accepted Answer

A CSI driver that implements snapshot/restore GRPC services. Volume snapshotting in OpenShift requires the VolumeSnapshotClass to define provisioning settings, the VolumeSnapshot CRD/object to request the snapshot, and the underlying CSI driver/controller supporting snapshot capabilities. StorageClasses and NetworkPolicies are separate concepts.

Answer

A default ClusterRoleBinding for system:authenticated users

Answer

NetworkPolicy resources restricting snapshot traffic

Question 8

Which THREE of the following are required when configuring an OIDC identity provider?

Accepted Answer

Client Secret reference. OIDC requires specific parameters to identify the provider, client, and client secret.

Answer

Htpasswd file path

Answer

LDAP bind password

Question 9

Which object defines the parameters used by a storage provider to take snapshots of persistent volumes in OpenShift?

Accepted Answer

VolumeSnapshotClass. A VolumeSnapshotClass defines the driver and parameters (such as deletion policy) for creating volume snapshots.

Answer

SnapshotterConfiguration

Answer

StorageClass

Answer

VolumeSnapshotContent

Question 10

Which resource represents the physical or cloud storage provisioned in the cluster by an administrator, independent of any user namespace claims?

Accepted Answer

PersistentVolume. A PersistentVolume (PV) represents the cluster-scoped storage resource.

Answer

StorageClass

Answer

PersistentVolumeClaim

Answer

PodVolume

Question 11

An administrator is reviewing PersistentVolumes and notices several PVs stuck in a Terminating state. What is the most common reason a PV cannot be deleted immediately?

Accepted Answer

The volume attachment object still holds an active lock, or a finalizer prevents deletion until unmounted.. A PV in Terminating state usually has a finalizer attached or is still actively mounted/attached by a node/CSI driver attachment object that hasn't cleaned up.

Answer

etcd disk space is full.

Answer

The project quota has been exceeded.

Answer

The apiserver cache is corrupted and requires a cluster reboot.

Question 12

A cluster administrator needs to ensure that a specific PVC can only bind to a pre-allocated PersistentVolume. How can this binding relationship be strictly enforced?

Accepted Answer

Specify the exact PV name in the spec.volumeName field of the PVC.. Setting 'volumeName' in the PVC specification forces the claim to bind exclusively to the PersistentVolume with that exact name.

Answer

Apply matching labels and set volumeBindingMode to Strict.

Answer

Set allowVolumeExpansion to false on the PV.

Answer

Annotate the PVC with 'volume.kubernetes.io/target-pv'.

Question 13

What is the primary difference between PersistentVolumes (PVs) and PersistentVolumeClaims (PVCs)?

Accepted Answer

PVs represent actual cluster storage resources, while PVCs represent user requests for storage.. PVs are actual storage resources in the cluster provisioned by admins, whereas PVCs are requests for storage made by users.

Answer

PVs only support block mode, while PVCs only support filesystem mode.

Answer

PVs are created by developers, while PVCs are created by cluster administrators.

Answer

PVs are namespace-scoped, while PVCs are cluster-scoped.

Question 14

An administrator is diagnosing why an authentication token exchange is failing for cluster users. Which THREE sources provide relevant error logs and status information? (Choose THREE)

Accepted Answer

oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>. Checking the authentication operator status, OAuth server logs, and API server request logs helps trace authentication failures.

Answer

oc logs -n openshift-ingress-operator deployment/ingress-operator

Answer

oc get namespaces

Question 15

An administrator suspects that a memory leak in a system daemon on an RHCOS worker node is causing system instability. Which THREE commands or log sources can be examined via an oc debug node session to investigate system memory consumption? (Choose THREE)

Accepted Answer

chroot /host top -b -n 1. Running 'top', 'free -h', and checking journald kernel logs via oc debug node inspects host memory usage.

Answer

oc get pvc

Answer

oc adm cluster-status