EX280 Practice Test 37 — 15 Questions

Question 1

A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

bob lacks the 'self-provisioner' cluster role, which can be granted via cluster-admin binding. In OpenShift, self-provisioning of projects is controlled by a ClusterRoleBinding that binds the 'self-provisioner' ClusterRole to the 'system:authenticated:oauth' group. If this is removed or restricted, users cannot create projects.

Answer

bob needs an explicit RoleBinding for the 'admin' role in the default namespace

Answer

bob's user object is missing the 'project-creator' annotation

Answer

bob must be added to the cluster-admin group in the oauth configuration

Question 2

Which THREE of the following fields are required when defining a custom Role or ClusterRole resource YAML? (Choose THREE)

Accepted Answer

apiVersion. A Role or ClusterRole YAML requires 'apiVersion', 'kind', 'metadata' (with name), and 'rules' (with API groups, resources, and verbs).

Answer

namespace

Answer

subjects

Question 3

Which TWO of the following actions occur when a user is deleted from an OpenShift cluster using 'oc delete user <username>'? (Choose TWO)

Accepted Answer

The User resource object is removed from the cluster database.. Deleting a User object removes the user entity, but existing RBAC bindings referencing that username remain until cleaned up, and their active OAuth tokens are revoked.

Answer

External identity provider records are automatically deleted from LDAP or OIDC servers.

Answer

All namespaces owned or created by the user are permanently deleted.

Answer

All RoleBindings and ClusterRoleBindings referencing the user are automatically deleted.

Question 4

You are troubleshooting project requests. A developer runs 'oc new-project test-proj' and receives an error that project requests are disabled or forbidden. Where is the global project request template or configuration managed?

Accepted Answer

In the cluster-scoped 'project.config.openshift.io/cluster' resource. Project request configurations are managed via the 'Project' cluster operator configuration resource ('cluster' instance of project.config.openshift.io).

Answer

In the 'kube-system' namespace as a Secret

Answer

In the 'openshift-config' namespace as a ConfigMap named 'project-request'

Answer

In the OAuth configuration file on master nodes

Question 5

An administrator configures a LimitRange with a max CPU limit of 2 cores and max memory limit of 4Gi. A developer submits a pod specification where a container requests 3 cores of CPU. How does the OpenShift API server handle this request during admission?

Accepted Answer

The API server rejects the pod creation because the container's CPU request violates the LimitRange maximum constraint.. The API server rejects the pod creation request immediately because the container resource limit exceeds the maximum allowed by the LimitRange.

Answer

The API server throttles the container CPU usage at runtime to 2 cores automatically.

Answer

The pod enters a CrashLoopBackOff state while waiting for resource allocation.

Answer

The API server accepts the pod and caps the container spec value to 2 cores.

Question 6

Which TWO of the following tasks can a user with the default OpenShift 'admin' role perform within their project? (Choose TWO)

Accepted Answer

Create, modify, and delete workloads and services within the project.. The 'admin' role permits managing project resources as well as creating and modifying Roles and RoleBindings within the project.

Answer

Modify cluster-wide ClusterRoles and ClusterRoleBindings.

Answer

Create new projects cluster-wide without restrictions.

Answer

Modify global SecurityContextConstraints.

Question 7

Which TWO of the following characteristics apply to OpenShift SecurityContextConstraints (SCCs)? (Choose TWO)

Accepted Answer

SCCs evaluate and can mutate pod specifications during admission control.. SCCs are cluster-scoped resources that dictate what security context fields a pod can specify, and they are evaluated based on user/group/serviceaccount associations or priority when pods are created.

Answer

SCCs replace Kubernetes NetworkPolicies entirely.

Answer

SCCs can be created as namespaced resources using standard RoleBindings.

Answer

SCCs apply only to stateful workloads and daemonsets.

Question 8

A cluster administrator wants to grant a group of users read access to all Pod logs across every namespace in the cluster. Which ClusterRole and binding approach should be used?

Accepted Answer

ClusterRole with apiGroups: [''], resources: ['pods/log'], verbs: ['get'] bound via ClusterRoleBinding. Reading pod logs requires permissions on the 'pods/log' subresource. A ClusterRole granting 'get' on 'pods/log' combined with a ClusterRoleBinding achieves this cluster-wide.

Answer

RoleBinding in each individual namespace pointing to the 'view' ClusterRole

Answer

SecurityContextConstraints modification

Answer

ClusterRole with apiGroups: ['apps'], resources: ['deployments/scale'], verbs: ['get']

Question 9

Which THREE of the following components are involved in authenticating a user via an external OAuth identity provider in OpenShift? (Choose THREE)

Accepted Answer

OpenShift OAuth Server. OAuth authentication involves the client/browser, the OpenShift OAuth server, and the external identity provider (such as HTPasswd or OIDC).

Answer

Kubelet node agent

Answer

Cluster Storage Operator

Question 10

Which TWO of the following steps are required when configuring an HTPasswd identity provider in OpenShift? (Choose TWO)

Accepted Answer

Create a Secret containing the htpasswd file in the 'openshift-config' namespace.. Configuring HTPasswd requires creating a Secret containing the htpasswd file in the 'openshift-config' namespace and referencing that Secret in the cluster OAuth configuration resource.

Answer

Create a ClusterRoleBinding for all users in the htpasswd file.

Answer

Place the htpasswd file directly on every control plane node at '/etc/origin/master/'.

Answer

Restart the kube-apiserver static pods manually across all masters.

Question 11

Which THREE of the following rules must be included in a custom ClusterRole to allow monitoring tools to scrape cluster-wide component metrics securely? (Choose THREE)

Accepted Answer

apiGroups: [''], resources: ['services', 'endpoints', 'pods'], verbs: ['get', 'list', 'watch']. Scraping metrics cluster-wide typically requires verbs like 'get' and 'list' on resources such as nodes/metrics, pods, and services or endpoints.

Answer

apiGroups: ['rbac.authorization.k8s.io'], resources: ['clusterroles'], verbs: ['*']

Answer

apiGroups: ['apps'], resources: ['deployments'], verbs: ['delete']

Question 12

Which command is used to create a new cluster role named 'storage-reader' that permits getting and listing PersistentVolumes cluster-wide?

Accepted Answer

oc create clusterrole storage-reader --verb=get,list --resource=persistentvolumes. The 'oc create clusterrole' command creates a cluster role with specified verbs and resources.

Answer

oc new clusterrole storage-reader --permissions=pv:get,list

Answer

oc create role storage-reader --cluster --verb=get,list --resource=persistentvolumes

Answer

oc adm create-role storage-reader --cluster-wide --verbs=get,list --resources=pv

Question 13

An administrator is troubleshooting a service account named 'cicd-bot' in the 'ci-cd' namespace that is failing to read pods in the 'production' namespace, despite a RoleBinding existing. Upon inspection, the RoleBinding references a Role (not a ClusterRole) in the 'ci-cd' namespace. Why is the service account failing to access resources in 'production'?

Accepted Answer

Standard Roles are namespace-scoped and cannot grant permissions to resources in another namespace. A standard Role and RoleBinding are strictly namespace-scoped. A Role in namespace A cannot grant permissions to resources in namespace B. To grant cross-namespace access, a ClusterRole must be used with either a RoleBinding (in the target namespace) or a ClusterRoleBinding.

Answer

Roles cannot reference service accounts as subjects unless they are in the openshift-infra namespace

Answer

Service accounts cannot use RoleBindings, they require ClusterRoleBindings for any authorization

Answer

The service account token has expired and must be manually regenerated using oc adm ca

Question 14

Which THREE of the following objects can be used to enforce resource governance and consumption limits within an OpenShift project? (Choose THREE)

Accepted Answer

LimitRange. Resource quotas, limit ranges, and cluster resource quotas are core mechanisms for managing resource constraints in OpenShift.

Answer

SecurityContextConstraints

Answer

NetworkPolicy

Question 15

An administrator needs to restrict a user group named 'contractors' so they can view pods and services, but cannot view secrets across the 'staging' namespace. Which THREE of the following steps or configurations are valid and necessary to achieve this? (Choose THREE)

Accepted Answer

Create a custom Role in the staging namespace that explicitly includes rules for verbs get, list, watch on resources pods and services. To implement custom restrictions when predefined roles are too broad, an administrator must create a custom Role with explicit rules (allowing pods and services, denying or omitting secrets), and bind it to the contractors group via a RoleBinding in the staging namespace.

Answer

Create a ClusterRoleBinding referencing the view ClusterRole and set an exclusion filter for secrets

Answer

Assign the cluster-admin ClusterRole to the contractors group with a negative weight annotation