EX280 Practice Test 5 — 10 Questions

Question 1

An administrator wants to use raw block storage (Block Volume Mode) rather than a mounted filesystem for a high-performance database running on OpenShift. How should the volume mode be specified in the PersistentVolumeClaim?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

volumeMode: Block. Raw block storage is requested by setting 'volumeMode: Block' in the PersistentVolumeClaim spec. This tells the CSI driver and kubelet to expose the volume as an unformatted block device (e.g., /dev/xvda) inside the pod rather than mounting a filesystem, which is required for databases that manage their own I/O and formatting.

Answer

mountOptions: [ "raw" ]

Answer

accessMode: RawBlock

Answer

storageType: Unformatted

Question 2

A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?

Accepted Answer

bob lacks the 'self-provisioner' cluster role, which can be granted via cluster-admin binding. In OpenShift, the ability for authenticated users to create their own projects is controlled by the 'self-provisioner' ClusterRole, bound via the 'self-provisioners' ClusterRoleBinding to the 'system:authenticated' group by default. If an administrator removes or restricts this binding, users like bob lose the ability to run 'oc new-project' even though they can still view existing projects.

Answer

bob needs an explicit RoleBinding for the 'admin' role in the default namespace

Answer

bob's user object is missing the 'project-creator' annotation

Answer

bob must be added to the cluster-admin group in the oauth configuration

Question 3

Which OpenShift 4.14 command is used to uncordon a worker node and return it to a schedulable state after maintenance?

Accepted Answer

oc adm uncordon. The correct command is `oc adm uncordon <node-name>`. This command removes the unschedulable taint from the node, allowing the scheduler to place new pods on it. It is the standard OpenShift/Kubernetes administrative command for reversing a cordon operation.

Answer

oc node enable

Answer

oc adm schedulable

Answer

oc scale node

Question 4

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

Accepted Answer

In the Deployment configuration spec under template.spec.imagePullSecrets. The image pull secret must be referenced in the pod template spec under template.spec.imagePullSecrets so that the kubelet uses those credentials when pulling the image for each pod. This field accepts a list of Secret names in the same namespace, and OpenShift injects them into the pod's service account context at pull time. Placing it in the Deployment's pod template ensures every replica created by the ReplicaSet inherits the credential reference.

Answer

As an annotation on the cluster-scoped Namespace object

Answer

Inside the Route object spec under tls.imagePullSecret

Answer

As an environment variable named IMAGE_PULL_SECRET in the container specification

Question 5

An administrator wants to verify if all required cluster operators are available and not degraded after an installation. Which command provides this summary?

Accepted Answer

oc get clusteroperators. The `oc get clusteroperators` command lists all ClusterOperators in an OpenShift cluster, showing their AVAILABLE, PROGRESSING, and DEGRADED status columns. This directly answers whether all required operators are available and not degraded after installation. It is the standard, high-level health check for the operator framework that manages core cluster components.

Answer

oc adm cluster-status

Answer

oc get nodes

Answer

oc get pods --all-namespaces

Question 6

Which OpenShift resource defines the desired state of a containerized application, including replica count and image version?

Accepted Answer

Deployment. A Deployment in OpenShift defines the desired state of a containerized application, including the replica count, container image version, and update strategy. It manages ReplicaSets and Pods declaratively, ensuring the specified number of replicas and image version are maintained. This makes Deployment the correct resource for defining desired state including replicas and image version.

Answer

Pod

Answer

ImageStream

Answer

Service

Question 7

An administrator needs to create a passthrough Route that preserves client certificates and forwards encrypted traffic directly to the backend pod. Which spec configuration is required?

Accepted Answer

spec:
  tls:
    termination: passthrough. A passthrough Route uses 'spec.tls.termination: passthrough', which tells the HAProxy router to forward the encrypted TLS connection directly to the backend pod without decrypting it. This preserves client certificates end-to-end and is required when the backend must handle TLS itself.

Answer

spec:
  tls:
    termination: reencrypt

Answer

spec:
  tls:
    termination: edge

Answer

spec:
  tls:
    insecureEdgeTerminationPolicy: Allow

Question 8

An administrator notices that client source IP addresses are lost when traffic hits a Service of type NodePort, appearing instead as a node IP. Which field in the Service specification should be changed to 'Local' to preserve client source IPs?

Accepted Answer

externalTrafficPolicy: Local. externalTrafficPolicy: Local preserves the client source IP by only routing traffic to pods on the same node that received the request, avoiding the SNAT that occurs when kube-proxy forwards to a pod on another node. With the default Cluster policy, traffic can be forwarded to any node's pod, causing the source IP to be rewritten to the node's IP. Setting it to Local ensures the original client IP is retained for the backend pod.

Answer

publishNotReadyAddresses: true

Answer

sessionAffinity: ClientIP

Answer

ipFamilyPolicy: RequireDualStack

Question 9

An administrator needs to check the IP address and network status assigned to a running pod. Which command displays this information quickly?

Accepted Answer

oc get pod -o wide. The command `oc get pod -o wide` extends the default tabular output to include additional columns such as the pod's IP address and the node it is running on. This is the fastest way to retrieve the IP address of a running pod without needing to inspect detailed YAML or describe output. It directly answers the question by displaying the assigned IP in a concise, readable format.

Answer

oc ip pod <pod-name>

Answer

oc describe pod <pod-name> --network

Answer

oc get network-attachment-definitions

Question 10

An administrator is inspecting an OpenShift 4.14 cluster and notices that the MachineConfigPool for workers is in a degraded state because a MachineConfig failed to apply. Where should the administrator look to find the exact error encountered by the Machine Config Daemon on the affected nodes?

Accepted Answer

Check the logs of the machine-config-daemon pods in the openshift-machine-config-operator namespace.. The Machine Config Daemon runs as a pod on each node in the openshift-machine-config-operator namespace and is responsible for applying rendered MachineConfigs and reporting errors back to the MCO. When a MachineConfig fails to apply and the pool goes degraded, the exact error (e.g., failed systemd unit, invalid Ignition, file conflict) is recorded in the machine-config-daemon pod logs on the affected node.

Answer

Review the OperatorHub catalog source logs in openshift-marketplace.

Answer

Run 'oc adm node-logs --role=worker' to view kernel panic messages.

Answer

Inspect the Cluster Version Operator logs in openshift-cluster-version.