EX280 Practice Test 33 — 15 Questions

Question 1

Which THREE factors influence whether a pod requesting a storage volume can be successfully scheduled to a specific worker node when using topology-aware storage?

Accepted Answer

Volume accessibility constraints reported by the CSI driver. Topology-aware scheduling considers node topology labels, volume accessibility constraints, and availability zones matching the provisioned PV.

Answer

The cluster OAuth token expiration time

Answer

The number of container image layers in the pod spec

Question 2

A node in an OpenShift cluster goes into 'NotReady' status. The administrator uses 'oc debug node/<node-name>' to inspect the node's root filesystem. Where are the host's system logs mounted inside the debug chroot environment?

Accepted Answer

/host/var/log. When using oc debug to access a node, the host's root filesystem is mounted under /host, making host logs available under /host/var/log.

Answer

/rootfs/var/log

Answer

/mnt/host/log

Answer

/var/log

Question 3

An administrator needs to tail the logs of all pods with the label 'tier=frontend' across the current namespace. Which command should be used?

Accepted Answer

oc logs -l tier=frontend. oc logs with the label selector flag (-l) streams logs from all matching pods simultaneously.

Answer

oc watch logs tier=frontend

Answer

oc logs pods --selector=tier=frontend -f

Answer

oc tail -l tier=frontend

Question 4

A pod fails to start with a 'CreateContainerConfigError' error message. What is the most common cause of this error that an administrator should investigate?

Accepted Answer

A referenced ConfigMap or Secret in the pod specification does not exist.. CreateContainerConfigError typically occurs when a referenced ConfigMap or Secret does not exist or is misspelled in the pod specification.

Answer

The liveness probe timed out before the application started.

Answer

The container image pull policy is set to Always and the registry is down.

Answer

The container exceeded its memory limit upon initialization.

Question 5

An administrator needs to drain a worker node safely for hardware maintenance, but some pods have local emptyDir storage that would be permanently deleted. Which flag must be added to the drain command to allow eviction of these pods?

Accepted Answer

--delete-emptydir-data. Pods with emptyDir volumes are protected by default during drains. The --delete-emptydir-data flag overrides this protection.

Answer

--allow-local-volumes

Answer

--ignore-daemonsets=false

Answer

--force-local-storage

Question 6

An administrator notices that the 'storage' ClusterOperator is degraded. Which TWO resources or logs should be inspected to diagnose the underlying CSI driver or provisioner failure? (Choose TWO)

Accepted Answer

oc describe clusteroperator storage. Inspecting the cluster operator status YAML and the logs of the cluster storage operator or CSI provisioner pods provides targeted diagnostic data.

Answer

oc logs -n openshift-apiserver deployment/openshift-apiserver

Answer

oc get routes --all-namespaces

Answer

oc describe clusterversion

Question 7

An administrator wants to prevent non-admin users from creating any new projects in the OpenShift cluster. How can this be accomplished?

Accepted Answer

Delete the 'self-provisioner' ClusterRoleBinding attached to the 'system:authenticated' group.. Removing the 'self-provisioner' cluster role binding from the 'system:authenticated' group prevents regular users from self-provisioning new projects.

Answer

Set the project request limit quota to zero globally.

Answer

Delete the 'cluster-admin' role from all users.

Answer

Modify the OAuth configuration to reject all login requests.

Question 8

An administrator needs to configure resource requests and limits such that any pod created without explicit CPU requests in the 'web-tier' namespace automatically gets assigned a default CPU request of 200m and a default CPU limit of 500m. Which object achieves this?

Accepted Answer

LimitRange with default and defaultRequest parameters. A LimitRange object defines default resource requests and limits applied to containers that do not specify them.

Answer

ResourceQuota

Answer

PodPreset

Answer

ClusterResourceQuota

Question 9

You need to assign a custom ClusterRole named 'operator-viewer' to all authenticated users cluster-wide. Which command accomplishes this?

Accepted Answer

oc adm policy add-cluster-role-to-group operator-viewer system:authenticated. The 'oc adm policy add-cluster-role-to-group' command binding to the 'system:authenticated' group achieves this.

Answer

oc adm policy add-cluster-role-to-user operator-viewer --all-users

Answer

oc set role operator-viewer --cluster --to-all

Answer

oc create clusterrolebinding all-users --clusterrole=operator-viewer --user=system:everyone

Question 10

The 'dns' ClusterOperator is reporting Degraded=True because CoreDNS pods are failing health checks. The administrator suspects DNS request loops or upstream forwarding failures. Which log source is most effective for diagnosing CoreDNS resolution errors?

Accepted Answer

oc logs -n openshift-dns -l dns.operator.openshift.io/daemonset-dns=default. CoreDNS runs as a deployment in the openshift-dns namespace. Its pod logs show incoming query failures and forwarding timeouts.

Answer

oc logs -n kube-system deployment/kube-dns

Answer

journalctl -u coredns

Answer

oc logs -n openshift-network-operator deployment/network-operator

Question 11

An administrator wants to check the detailed configuration and current status of a specific Route named 'my-app-route'. Which command provides this?

Accepted Answer

oc describe route my-app-route. oc describe route my-app-route displays route hostnames, TLS settings, service weights, and backend service targets.

Answer

oc get route my-app-route --status

Answer

oc show route my-app-route

Answer

oc adm route-status my-app-route

Question 12

An administrator is troubleshooting a deployment where pods fail to pull container images. Which TWO potential issues should be checked? (Choose TWO)

Accepted Answer

The image pull secret is missing or misconfigured in the service account.. Incorrect image pull secrets and invalid image tags/registry paths are the two most common causes of image pull failures.

Answer

The PersistentVolumeClaim is stuck in Pending.

Answer

The route hostname is invalid.

Answer

The liveness probe timeout is configured too short.

Question 13

A security audit requires identifying all users who have direct cluster-admin privileges assigned via individual user bindings rather than groups. How can an administrator inspect the cluster-admin ClusterRoleBinding subjects?

Accepted Answer

oc get clusterrolebinding cluster-admin -o jsonpath='{.subjects[*]}'. Inspecting the 'cluster-admin' ClusterRoleBinding object using jsonpath or yaml output displays all subjects (users, groups, service accounts).

Answer

oc describe clusterrolebinding cluster-admin --users-only

Answer

oc get users --filter='cluster-admin'

Answer

oc adm policy list-cluster-admins

Question 14

A pod is stuck in the 'ContainerCreating' state for an extended period. The administrator suspects a persistent volume mount timeout. Which resource events should they examine to confirm if the volume plugin is failing to attach the disk?

Accepted Answer

oc describe pvc <pvc-name>. Describing the persistent volume claim (PVC) or the pod itself displays storage attachment events from the attach/detach controller.

Answer

oc adm diagnostics storage

Answer

oc logs deployment/<deployment-name>

Answer

oc get pv -o json

Question 15

An administrator receives an alert that the Cluster Monitoring Operator is degraded because Prometheus cannot scrape metrics from a custom application namespace. Where should the administrator check to verify the ServiceMonitor configuration targeting the application?

Accepted Answer

oc get servicemonitor -n <app-namespace>. ServiceMonitor custom resources define how Prometheus scrapes application endpoints, and checking their status or YAML spec is essential.

Answer

oc describe clusteroperator monitoring

Answer

oc logs deployment/prometheus-k8s

Answer

oc get prometheus-rules