EX280 Practice Test 4 — 10 Questions

Question 1

Which component in OpenShift 4.14 serves as the API entry point for managing MachineAPI resources like Machines and MachineSets?

Accepted Answer

Machine API Operator. The Machine API Operator is the component that manages the lifecycle of MachineAPI resources such as Machines, MachineSets, and MachineHealthChecks. It deploys and reconciles the machine-api controllers and CRDs, making it the API entry point for cluster node provisioning in OpenShift 4.

Answer

Cluster Version Operator

Answer

Machine Config Operator

Answer

Operator Lifecycle Manager

Question 2

An administrator wants to check the logs of the Cluster Version Operator to see why an upgrade failed. In which namespace does the CVO run?

Accepted Answer

openshift-cluster-version. The Cluster Version Operator (CVO) runs in the 'openshift-cluster-version' namespace, where it reconciles the ClusterVersion resource and manages cluster upgrades. To diagnose a failed upgrade, an administrator inspects the CVO pod logs in that namespace. This is the canonical location in OpenShift 4 for all cluster version and upgrade activity.

Answer

openshift-operator-lifecycle-manager

Answer

openshift-config-operator

Answer

kube-system

Question 3

Which TWO pieces of information are needed when defining a new Helm repository?

Accepted Answer

Repository Name. When defining a new Helm repository, the two required pieces of information are the repository name (option D) and the repository URL (option E). The repository name (D) serves as the local alias used by Helm commands such as `helm repo add `, allowing you to reference the repo later (e.g., `helm install mychart /`). The repository URL (E) is the actual endpoint where the `index.yaml` and chart packages are hosted, which Helm fetches to resolve and download charts. A chart version (A) is not needed to define a repository; it is specified later when installing or pulling a specific chart. A username (B) is only required for private repositories that enforce authentication, not for defining a repository in general. A namespace (C) is a Kubernetes concept used at install time to scope resources, not part of a Helm repository definition.

Answer

Chart version

Answer

Username

Answer

Namespace

Question 4

A cluster administrator wants to create a VolumeSnapshot of a database PVC. Which API group must the VolumeSnapshotClass belong to?

Accepted Answer

snapshot.storage.k8s.io. VolumeSnapshotClass resources are part of the Kubernetes CSI snapshot API group 'snapshot.storage.k8s.io'. This API group defines the VolumeSnapshot, VolumeSnapshotContent, and VolumeSnapshotClass custom resources. Therefore, the VolumeSnapshotClass must belong to this API group to be recognized by the CSI snapshot controller.

Answer

storage.k8s.io

Answer

csi.storage.k8s.io

Answer

volumesnapshot.openshift.io

Question 5

An administrator is diagnosing why an authentication token exchange is failing for cluster users. Which THREE sources provide relevant error logs and status information? (Choose THREE)

Accepted Answer

oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>. Option B is correct because the kube-apiserver logs in the openshift-kube-apiserver namespace record authentication and token exchange activity, including OAuth token review and authentication errors, making them a primary source for diagnosing token exchange failures. Option D is correct because 'oc describe clusteroperator authentication' shows the status, conditions, and messages of the authentication ClusterOperator, which reveal whether the OAuth server and related authentication components are degraded or failing. Option E is correct because the oauth-openshift deployment in the openshift-authentication namespace runs the OpenShift OAuth server that issues and exchanges tokens, so its logs directly capture token exchange errors. Option A is not relevant because the ingress-operator logs concern ingress controller management, not authentication token exchange. Option C is not relevant because listing namespaces only shows namespace existence and status, providing no authentication error details.

Answer

oc logs -n openshift-ingress-operator deployment/ingress-operator

Answer

oc get namespaces

Question 6

During a troubleshooting session on a degraded cluster operator, an administrator finds that the operator's operand configuration is controlled by a Custom Resource (CR). Where is the most reliable place to look for error status messages reported by the operator controller loop regarding this CR?

Accepted Answer

The status field of the specific Custom Resource instance (e.g., 'oc get

-o yaml').. Operator controllers reconcile a Custom Resource and write observed state, conditions, and error messages back into the CR's status field. The most reliable place to see controller-reported errors is the status subresource of that specific CR instance, typically viewed with 'oc get

-o yaml'. This reflects the controller's own view of the operand's health and any reconciliation failures.

Answer

The default Kubernetes events in the default namespace.

Answer

The global clusterversion object status conditions.

Answer

The /var/log/messages file on the master nodes.

Question 7

A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?

Accepted Answer

oc auth can-i create pods -n target-ns. The 'oc auth can-i' command is the OpenShift-native way to perform a SelfSubjectAccessReview against the API server, returning yes or no for a specific verb/resource combination. Adding '-n target-ns' scopes the check to the target namespace, so the developer can verify whether their current service account or user can create pods there. This is the exact command documented for permission troubleshooting in OpenShift.

Answer

oc get rolebindings -n target-ns --user=self

Answer

oc check-permission create pods -n target-ns

Answer

oc describe authorization -n target-ns

Question 8

Which command allows you to view the logs of a specific build?

Accepted Answer

oc logs build/[build-name]. The `oc logs` command can target a build object directly by using the `build/[build-name]` syntax, which streams the logs from the build pod that OpenShift creates for that build. This is the canonical way to inspect build output without first looking up the generated pod name. The build name is the value shown in `oc get builds` output.

Answer

oc get build

Answer

oc describe build

Answer

oc logs [pod-name]

Question 9

Which TWO of the following are valid volume modes supported by PersistentVolumes and PersistentVolumeClaims in OpenShift?

Accepted Answer

Block. In OpenShift/Kubernetes, the PersistentVolume spec.volumeMode field accepts exactly two values: Block and Filesystem. Option B (Block) is correct because a PV/PVC with volumeMode: Block exposes the volume as a raw block device with no filesystem, which is required for workloads like databases that manage their own storage layout. Option D (Filesystem) is correct because it is the default volumeMode, where the volume is formatted with a filesystem and mounted into a directory inside the pod. Options A (Object), C (Database), and E (Stream) are not valid volumeMode values — they are not recognized by the Kubernetes/OpenShift API for PersistentVolumes or PersistentVolumeClaims, so they would be rejected.

Answer

Object

Answer

Database

Answer

Stream

Question 10

An OpenShift 4.14 cluster administrator has installed an Operator from OperatorHub into a custom namespace using a Subscription. The administrator notices that the Operator pod is not being created. Upon checking the Subscription, the installation mode is set to AllNamespaces, but the Operator target namespace is restricted. Which Operator Lifecycle Manager (OLM) object should the administrator inspect to troubleshoot why the CSV (ClusterServiceVersion) is not installing?

Accepted Answer

Inspect the OperatorGroup in the target namespace to ensure its targetNamespaces match or support the Subscription scope.. The OperatorGroup defines the target namespaces that an Operator can watch and install into. When a Subscription uses AllNamespaces mode but the OperatorGroup restricts targetNamespaces, OLM cannot reconcile the CSV into the desired scope, so the Operator pod never gets created. Inspecting the OperatorGroup in the target namespace reveals the mismatch.

Answer

Check the MachineConfigPool for paused reconciliation flags.

Answer

Review the ClusterVersion resource status for pending updates.

Answer

Inspect the KubeletConfig custom resource for validation errors.