EX280 Practice Test 2 — 30 Questions

Question 1

Which component in OpenShift 4.14 serves as the API entry point for managing MachineAPI resources like Machines and MachineSets?

Accepted Answer

Machine API Operator. The Machine API Operator is the component that manages the lifecycle of MachineAPI resources such as Machines, MachineSets, and MachineHealthChecks. It deploys and reconciles the machine-api controllers and CRDs, making it the API entry point for cluster node provisioning in OpenShift 4.

Answer

Cluster Version Operator

Answer

Machine Config Operator

Answer

Operator Lifecycle Manager

Question 2

An administrator wants to check the logs of the Cluster Version Operator to see why an upgrade failed. In which namespace does the CVO run?

Accepted Answer

openshift-cluster-version. The Cluster Version Operator (CVO) runs in the 'openshift-cluster-version' namespace, where it reconciles the ClusterVersion resource and manages cluster upgrades. To diagnose a failed upgrade, an administrator inspects the CVO pod logs in that namespace. This is the canonical location in OpenShift 4 for all cluster version and upgrade activity.

Answer

openshift-operator-lifecycle-manager

Answer

openshift-config-operator

Answer

kube-system

Question 3

Which TWO pieces of information are needed when defining a new Helm repository?

Accepted Answer

Repository Name. When defining a new Helm repository, the two required pieces of information are the repository name (option D) and the repository URL (option E). The repository name (D) serves as the local alias used by Helm commands such as `helm repo add `, allowing you to reference the repo later (e.g., `helm install mychart /`). The repository URL (E) is the actual endpoint where the `index.yaml` and chart packages are hosted, which Helm fetches to resolve and download charts. A chart version (A) is not needed to define a repository; it is specified later when installing or pulling a specific chart. A username (B) is only required for private repositories that enforce authentication, not for defining a repository in general. A namespace (C) is a Kubernetes concept used at install time to scope resources, not part of a Helm repository definition.

Answer

Chart version

Answer

Username

Answer

Namespace

Question 4

A cluster administrator wants to create a VolumeSnapshot of a database PVC. Which API group must the VolumeSnapshotClass belong to?

Accepted Answer

snapshot.storage.k8s.io. VolumeSnapshotClass resources are part of the Kubernetes CSI snapshot API group 'snapshot.storage.k8s.io'. This API group defines the VolumeSnapshot, VolumeSnapshotContent, and VolumeSnapshotClass custom resources. Therefore, the VolumeSnapshotClass must belong to this API group to be recognized by the CSI snapshot controller.

Answer

storage.k8s.io

Answer

csi.storage.k8s.io

Answer

volumesnapshot.openshift.io

Question 5

An administrator is diagnosing why an authentication token exchange is failing for cluster users. Which THREE sources provide relevant error logs and status information? (Choose THREE)

Accepted Answer

oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>. Option B is correct because the kube-apiserver logs in the openshift-kube-apiserver namespace record authentication and token exchange activity, including OAuth token review and authentication errors, making them a primary source for diagnosing token exchange failures. Option D is correct because 'oc describe clusteroperator authentication' shows the status, conditions, and messages of the authentication ClusterOperator, which reveal whether the OAuth server and related authentication components are degraded or failing. Option E is correct because the oauth-openshift deployment in the openshift-authentication namespace runs the OpenShift OAuth server that issues and exchanges tokens, so its logs directly capture token exchange errors. Option A is not relevant because the ingress-operator logs concern ingress controller management, not authentication token exchange. Option C is not relevant because listing namespaces only shows namespace existence and status, providing no authentication error details.

Answer

oc logs -n openshift-ingress-operator deployment/ingress-operator

Answer

oc get namespaces

Question 6

During a troubleshooting session on a degraded cluster operator, an administrator finds that the operator's operand configuration is controlled by a Custom Resource (CR). Where is the most reliable place to look for error status messages reported by the operator controller loop regarding this CR?

Accepted Answer

The status field of the specific Custom Resource instance (e.g., 'oc get

-o yaml').. Operator controllers reconcile a Custom Resource and write observed state, conditions, and error messages back into the CR's status field. The most reliable place to see controller-reported errors is the status subresource of that specific CR instance, typically viewed with 'oc get

-o yaml'. This reflects the controller's own view of the operand's health and any reconciliation failures.

Answer

The default Kubernetes events in the default namespace.

Answer

The global clusterversion object status conditions.

Answer

The /var/log/messages file on the master nodes.

Question 7

A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?

Accepted Answer

oc auth can-i create pods -n target-ns. The 'oc auth can-i' command is the OpenShift-native way to perform a SelfSubjectAccessReview against the API server, returning yes or no for a specific verb/resource combination. Adding '-n target-ns' scopes the check to the target namespace, so the developer can verify whether their current service account or user can create pods there. This is the exact command documented for permission troubleshooting in OpenShift.

Answer

oc get rolebindings -n target-ns --user=self

Answer

oc check-permission create pods -n target-ns

Answer

oc describe authorization -n target-ns

Question 8

Which command allows you to view the logs of a specific build?

Accepted Answer

oc logs build/[build-name]. The `oc logs` command can target a build object directly by using the `build/[build-name]` syntax, which streams the logs from the build pod that OpenShift creates for that build. This is the canonical way to inspect build output without first looking up the generated pod name. The build name is the value shown in `oc get builds` output.

Answer

oc get build

Answer

oc describe build

Answer

oc logs [pod-name]

Question 9

Which TWO of the following are valid volume modes supported by PersistentVolumes and PersistentVolumeClaims in OpenShift?

Accepted Answer

Block. In OpenShift/Kubernetes, the PersistentVolume spec.volumeMode field accepts exactly two values: Block and Filesystem. Option B (Block) is correct because a PV/PVC with volumeMode: Block exposes the volume as a raw block device with no filesystem, which is required for workloads like databases that manage their own storage layout. Option D (Filesystem) is correct because it is the default volumeMode, where the volume is formatted with a filesystem and mounted into a directory inside the pod. Options A (Object), C (Database), and E (Stream) are not valid volumeMode values — they are not recognized by the Kubernetes/OpenShift API for PersistentVolumes or PersistentVolumeClaims, so they would be rejected.

Answer

Object

Answer

Database

Answer

Stream

Question 10

An OpenShift 4.14 cluster administrator has installed an Operator from OperatorHub into a custom namespace using a Subscription. The administrator notices that the Operator pod is not being created. Upon checking the Subscription, the installation mode is set to AllNamespaces, but the Operator target namespace is restricted. Which Operator Lifecycle Manager (OLM) object should the administrator inspect to troubleshoot why the CSV (ClusterServiceVersion) is not installing?

Accepted Answer

Inspect the OperatorGroup in the target namespace to ensure its targetNamespaces match or support the Subscription scope.. The OperatorGroup defines the target namespaces that an Operator can watch and install into. When a Subscription uses AllNamespaces mode but the OperatorGroup restricts targetNamespaces, OLM cannot reconcile the CSV into the desired scope, so the Operator pod never gets created. Inspecting the OperatorGroup in the target namespace reveals the mismatch.

Answer

Check the MachineConfigPool for paused reconciliation flags.

Answer

Review the ClusterVersion resource status for pending updates.

Answer

Inspect the KubeletConfig custom resource for validation errors.

Question 11

An administrator wants to use raw block storage (Block Volume Mode) rather than a mounted filesystem for a high-performance database running on OpenShift. How should the volume mode be specified in the PersistentVolumeClaim?

Accepted Answer

volumeMode: Block. Raw block storage is requested by setting 'volumeMode: Block' in the PersistentVolumeClaim spec. This tells the CSI driver and kubelet to expose the volume as an unformatted block device (e.g., /dev/xvda) inside the pod rather than mounting a filesystem, which is required for databases that manage their own I/O and formatting.

Answer

mountOptions: [ "raw" ]

Answer

accessMode: RawBlock

Answer

storageType: Unformatted

Question 12

A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?

Accepted Answer

bob lacks the 'self-provisioner' cluster role, which can be granted via cluster-admin binding. In OpenShift, the ability for authenticated users to create their own projects is controlled by the 'self-provisioner' ClusterRole, bound via the 'self-provisioners' ClusterRoleBinding to the 'system:authenticated' group by default. If an administrator removes or restricts this binding, users like bob lose the ability to run 'oc new-project' even though they can still view existing projects.

Answer

bob needs an explicit RoleBinding for the 'admin' role in the default namespace

Answer

bob's user object is missing the 'project-creator' annotation

Answer

bob must be added to the cluster-admin group in the oauth configuration

Question 13

Which OpenShift 4.14 command is used to uncordon a worker node and return it to a schedulable state after maintenance?

Accepted Answer

oc adm uncordon. The correct command is `oc adm uncordon <node-name>`. This command removes the unschedulable taint from the node, allowing the scheduler to place new pods on it. It is the standard OpenShift/Kubernetes administrative command for reversing a cordon operation.

Answer

oc node enable

Answer

oc adm schedulable

Answer

oc scale node

Question 14

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

Accepted Answer

In the Deployment configuration spec under template.spec.imagePullSecrets. The image pull secret must be referenced in the pod template spec under template.spec.imagePullSecrets so that the kubelet uses those credentials when pulling the image for each pod. This field accepts a list of Secret names in the same namespace, and OpenShift injects them into the pod's service account context at pull time. Placing it in the Deployment's pod template ensures every replica created by the ReplicaSet inherits the credential reference.

Answer

As an annotation on the cluster-scoped Namespace object

Answer

Inside the Route object spec under tls.imagePullSecret

Answer

As an environment variable named IMAGE_PULL_SECRET in the container specification

Question 15

An administrator wants to verify if all required cluster operators are available and not degraded after an installation. Which command provides this summary?

Accepted Answer

oc get clusteroperators. The `oc get clusteroperators` command lists all ClusterOperators in an OpenShift cluster, showing their AVAILABLE, PROGRESSING, and DEGRADED status columns. This directly answers whether all required operators are available and not degraded after installation. It is the standard, high-level health check for the operator framework that manages core cluster components.

Answer

oc adm cluster-status

Answer

oc get nodes

Answer

oc get pods --all-namespaces

Question 16

Which OpenShift resource defines the desired state of a containerized application, including replica count and image version?

Accepted Answer

Deployment. A Deployment in OpenShift defines the desired state of a containerized application, including the replica count, container image version, and update strategy. It manages ReplicaSets and Pods declaratively, ensuring the specified number of replicas and image version are maintained. This makes Deployment the correct resource for defining desired state including replicas and image version.

Answer

Pod

Answer

ImageStream

Answer

Service

Question 17

An administrator needs to create a passthrough Route that preserves client certificates and forwards encrypted traffic directly to the backend pod. Which spec configuration is required?

Accepted Answer

spec:
  tls:
    termination: passthrough. A passthrough Route uses 'spec.tls.termination: passthrough', which tells the HAProxy router to forward the encrypted TLS connection directly to the backend pod without decrypting it. This preserves client certificates end-to-end and is required when the backend must handle TLS itself.

Answer

spec:
  tls:
    termination: reencrypt

Answer

spec:
  tls:
    termination: edge

Answer

spec:
  tls:
    insecureEdgeTerminationPolicy: Allow

Question 18

An administrator notices that client source IP addresses are lost when traffic hits a Service of type NodePort, appearing instead as a node IP. Which field in the Service specification should be changed to 'Local' to preserve client source IPs?

Accepted Answer

externalTrafficPolicy: Local. externalTrafficPolicy: Local preserves the client source IP by only routing traffic to pods on the same node that received the request, avoiding the SNAT that occurs when kube-proxy forwards to a pod on another node. With the default Cluster policy, traffic can be forwarded to any node's pod, causing the source IP to be rewritten to the node's IP. Setting it to Local ensures the original client IP is retained for the backend pod.

Answer

publishNotReadyAddresses: true

Answer

sessionAffinity: ClientIP

Answer

ipFamilyPolicy: RequireDualStack

Question 19

An administrator needs to check the IP address and network status assigned to a running pod. Which command displays this information quickly?

Accepted Answer

oc get pod -o wide. The command `oc get pod -o wide` extends the default tabular output to include additional columns such as the pod's IP address and the node it is running on. This is the fastest way to retrieve the IP address of a running pod without needing to inspect detailed YAML or describe output. It directly answers the question by displaying the assigned IP in a concise, readable format.

Answer

oc ip pod <pod-name>

Answer

oc describe pod <pod-name> --network

Answer

oc get network-attachment-definitions

Question 20

An administrator is inspecting an OpenShift 4.14 cluster and notices that the MachineConfigPool for workers is in a degraded state because a MachineConfig failed to apply. Where should the administrator look to find the exact error encountered by the Machine Config Daemon on the affected nodes?

Accepted Answer

Check the logs of the machine-config-daemon pods in the openshift-machine-config-operator namespace.. The Machine Config Daemon runs as a pod on each node in the openshift-machine-config-operator namespace and is responsible for applying rendered MachineConfigs and reporting errors back to the MCO. When a MachineConfig fails to apply and the pool goes degraded, the exact error (e.g., failed systemd unit, invalid Ignition, file conflict) is recorded in the machine-config-daemon pod logs on the affected node.

Answer

Review the OperatorHub catalog source logs in openshift-marketplace.

Answer

Run 'oc adm node-logs --role=worker' to view kernel panic messages.

Answer

Inspect the Cluster Version Operator logs in openshift-cluster-version.