EX280 Practice Test 5 — 10 Questions

Question 1

Which OpenShift resource defines the desired state of a containerized application, including replica count and image version?

Accepted Answer

Deployment. A Deployment (or DeploymentConfig) object defines the desired state of the pods.

Answer

Pod

Answer

ImageStream

Answer

Service

Question 2

An OpenShift administrator needs to restrict access so that pods in namespace 'dev' cannot initiate any outbound connections to pods in namespace 'secure-db'. Which resource should be created in namespace 'secure-db' to achieve this?

Accepted Answer

A NetworkPolicy with an empty ingress rule set in namespace 'secure-db'. A NetworkPolicy with ingress rules applied in the destination namespace ('secure-db') controls which sources are allowed to connect to it.

Answer

A NetworkPolicy blocking egress in namespace 'dev'

Answer

A ClusterNetwork policy blocking all cross-namespace traffic cluster-wide

Answer

An EgressFirewall object in namespace 'dev'

Question 3

An administrator needs to modify the default Ingress controller configuration to change its replica count and adjust the router deployment parameters. Which resource should the administrator edit?

Accepted Answer

ingresscontroller.operator.openshift.io named 'default'. The default Ingress controller is managed by the Ingress operator via the 'default' Ingress resource in the operator.openshift.io API group.

Answer

deployment named router-default in openshift-ingress namespace

Answer

configmap named router-config in openshift-ingress-operator

Answer

service named router-default-http in openshift-ingress

Question 4

An OpenShift administrator needs to expose an internal web application securely using a Route that terminates TLS at the router. Which Route type and configuration requires the administrator to provide the certificate, private key, and CA certificate?

Accepted Answer

Edge TLS termination. Edge termination terminates TLS at the Ingress controller/router and requires the user to supply the TLS certificate and key in the Route specification.

Answer

Re-encrypt TLS termination

Answer

Unsecured Route with an external proxy

Answer

Insecure plain HTTP route

Answer

Passthrough TLS termination

Question 5

An OpenShift cluster is configured with a custom Cluster Network CIDR. An administrator needs to verify the cluster network subnet settings and host subnet assignments. Which operator status or configuration resource contains this cluster-wide network configuration?

Accepted Answer

networks.config.openshift.io named 'cluster'. The networks.config.openshift.io cluster singleton resource holds the cluster network, service network, and CNI provider configuration.

Answer

network.operator.openshift.io named 'default'

Answer

cluster-network.openshift.io

Answer

sdn.openshift.io/config

Question 6

An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?

Accepted Answer

Via the /etc/resolv.conf file automatically managed inside the pod container. Kubernetes automatically injects the nameserver configuration into the /etc/resolv.conf file of every container based on the cluster DNS configuration.

Answer

By querying the OpenShift API server directly on port 6443 for DNS records

Answer

Through an environment variable named CLUSTER_DNS injected into every container

Answer

By parsing the /etc/hosts file updated dynamically by the OpenShift SDN controller

Question 7

An administrator needs to identify worker nodes that require attention during an upgrade or maintenance. Which TWO conditions or states on a node object indicate potential issues or special maintenance states? (Choose TWO)

Accepted Answer

SchedulingDisabled. SchedulingDisabled (cordoned) and NotReady indicate maintenance or health issues on nodes.

Answer

Running=Normal

Answer

Active=True

Answer

Schedulable=True

Question 8

An administrator needs to test internal cluster DNS resolution from a temporary troubleshooting pod. Which command creates a temporary pod with the 'dig' utility installed for DNS debugging?

Accepted Answer

oc run dns-test --rm -it --image=registry.redhat.io/rhel9/support-tools --command -- bash. The 'oc debug' command or running a temporary debug pod using 'oc run' with an image containing DNS tools (like utils or busybox) is standard. Specifically, 'oc run' with an interactive shell or debug container provides access.

Answer

oc test dns --cluster

Answer

oc adm diagnose network-dns

Answer

oc debug node/worker-1 --image=registry.redhat.io/rhel9/support-tools:latest

Question 9

An administrator is setting up a new custom MachineConfigPool for GPU-enabled worker nodes. After creating the MachineConfigPool resource, the administrator creates a MachineConfig that should apply exclusively to these nodes. What must the administrator include in the MachineConfig to ensure it only applies to the GPU pool?

Accepted Answer

Labels matching the machineconfigpool selector (e.g., 'pools.operator.machineconfiguration.openshift.io/gpu-worker: ""').. MachineConfigs must include node role labels matching the MachineConfigPool (e.g., pools.operator.machineconfiguration.openshift.io/<pool-name>: '') so the MCO targets the correct nodes.

Answer

Placing the MachineConfig object directly inside the GPU namespace.

Answer

A field in the spec named 'targetPool: gpu-worker'.

Answer

An annotation specifying 'machineconfigpool.openshift.io/target: gpu-worker'.

Question 10

When troubleshooting network policies or container connectivity in an OVN-Kubernetes environment, which THREE tools or logs are useful for diagnosing packet drops and flow issues? (Choose THREE)

Accepted Answer

Querying the OVN southbound database using ovn-sbctl. OVN-Kubernetes logs, node ovn-controller logs, and ovn-sbctl are key diagnostic tools.

Answer

Running systemctl restart firewalld on all worker nodes simultaneously

Answer

Editing the master /etc/hosts file to add custom pod IP mappings