EX280 Practice Test 7 — 10 Questions

Question 1

An OpenShift cluster integrates with an LDAP server where user attribute names differ from default settings (e.g., mail instead of preferredUsername). Where are these LDAP attribute mappings configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the LDAP identity provider specification under the 'attributes' mapping fields. LDAP attribute mappings are configured in the LDAP identity provider specification under the `attributes` field. This section maps LDAP attributes (e.g., mail, uid) to OpenShift identity attributes like preferredUsername, name, and email. Administrators edit the OAuth custom resource to set these mappings.

Answer

In the kube-apiserver ConfigMap under LDAP settings

Answer

In the GroupSync CRD resource settings

Answer

In the project request template annotations

Question 2

An administrator wants to verify which CSI driver plugins are registered and active in an OpenShift cluster. Which cluster-scoped resource should they query?

Accepted Answer

csidrivers.storage.k8s.io. The cluster-scoped resource that lists registered CSI drivers is csidrivers.storage.k8s.io. This resource represents the CSI drivers that are registered with the Kubernetes cluster and provides information about their capabilities, such as whether they support attach/detach operations. Querying this resource shows which CSI drivers are active and available for use.

Answer

volumesnapshotclasses.snapshot.storage.k8s.io

Answer

storageclasses.storage.k8s.io

Answer

csinodes.storage.k8s.io

Question 3

Which YAML key in a StorageClass definition specifies the CSI plugin responsible for provisioning the storage?

Accepted Answer

provisioner. The provisioner field in a StorageClass identifies the CSI driver (or in-tree provisioner) responsible for dynamically provisioning PersistentVolumes. For CSI-based storage, its value is the driver name registered by the CSI plugin, such as ebs.csi.aws.com or csi.ceph.com. Without a valid provisioner, the StorageClass cannot create PVs.

Answer

storagePlugin

Answer

plugin

Answer

driverName

Question 4

An ImageStream named 'frontend' in a project contains multiple tags, including 'latest' and 'v1.0'. You want to update an existing Deployment to specifically use the 'v1.0' tag of this ImageStream. Where must this reference be updated in the Deployment specification?

Accepted Answer

In the spec.template.spec.containers[].image field pointing to image-registry.openshift-image-registry.svc:5000/namespace/frontend:v1.0.. In OpenShift, an ImageStream tag is consumed by referencing the internal registry image path in the container's image field. The correct form is image-registry.openshift-image-registry.svc:5000//:, which the kubelet resolves through the internal registry and the ImageStream tag. Updating spec.template.spec.containers[].image to this fully qualified reference with the v1.0 tag ensures the Deployment pulls that specific tag.

Answer

In the spec.imageStreamRef field.

Answer

In the metadata.annotations['openshift.io/image.in-cluster'] field.

Answer

In the spec.strategy.rollingUpdate.image field.

Question 5

An administrator wants to check the cluster-wide resource consumption of nodes (CPU and Memory percentages). Which command provides this tabular overview?

Accepted Answer

oc adm top nodes. 'oc adm top nodes' is the OpenShift CLI command that queries the metrics subsystem and returns a tabular view of each node's CPU and memory consumption as a percentage of capacity. It is the node-level analog of 'oc adm top pods' and is the standard way to get a cluster-wide resource overview from the command line.

Answer

oc get nodes --metrics

Answer

oc cluster-capacity

Answer

oc describe nodes --usage

Question 6

You are configuring an OAuth identity provider using 'htpasswd'. Which secret must contain the file?

Accepted Answer

A secret in 'openshift-config'. When configuring an OAuth identity provider using htpasswd in OpenShift, the htpasswd file must be stored in a Secret in the 'openshift-config' namespace. The OAuth configuration references this secret by name, and the OpenShift authentication operator mounts it into the OAuth pods. This is the documented and required location for identity provider secrets.

Answer

A ConfigMap in 'openshift-config'

Answer

A local file on the master node

Answer

A secret in 'openshift-authentication'

Question 7

An administrator needs to update the global pull secret for an OpenShift 4.14 cluster so that nodes can pull images from a new authenticated private registry. Which resource stores the global pull secret?

Accepted Answer

A Secret named 'pull-secret' in the 'openshift-config' namespace.. The global pull secret for an OpenShift cluster is stored as a Secret named 'pull-secret' in the openshift-config namespace. Updating this secret causes the MCO to propagate the new credentials to every node's /var/lib/kubelet/config.json (and to the internal registry), enabling pulls from the new authenticated registry. This is the documented location for cluster-wide registry credentials.

Answer

The MachineConfigPool resource named 'worker'.

Answer

The ClusterVersion custom resource spec field 'pullSecret'.

Answer

A ConfigMap named 'global-pull-registry' in 'kube-system'.

Question 8

An administrator needs to restrict pod creation based on Pod Security Standards namespaces. Which TWO of the following are valid Pod Security Standard levels defined by Kubernetes and supported in OpenShift? (Choose TWO)

Accepted Answer

restricted. Option B (restricted) is correct because the Kubernetes Pod Security Standards define exactly three levels — privileged, baseline, and restricted — and restricted is the most stringent, enforcing hardening such as requiring non-root execution, dropping all capabilities, and disallowing hostPath/host namespaces. Option C (baseline) is correct because it is the minimally restrictive level that still blocks known privilege escalations (e.g., hostNetwork, hostPID, privileged containers) while allowing default pod configurations. OpenShift supports these levels via namespace labels such as pod-security.kubernetes.io/enforce=baseline or restricted, which is how an administrator restricts pod creation per namespace. Options A (hardened), D (secured), and E (isolated) are not valid Pod Security Standard levels defined by Kubernetes; they are not recognized values for the pod-security.kubernetes.io/enforce label and therefore would not restrict pod creation as intended.

Answer

hardened

Answer

secured

Answer

isolated

Question 9

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

Accepted Answer

The cluster OAuth custom resource named cluster. In OpenShift, the cluster OAuth custom resource named `cluster` is the central configuration point for identity providers, including LDAP. Administrators configure the `spec.identityProviders` field to add an LDAP identity provider, specifying connection details, bind credentials, and attribute mappings. This resource is cluster-scoped and resides in the `openshift-config` namespace, and changes trigger a redeployment of the OAuth server pods.

Answer

A Secret named identity-provider in the openshift-authentication namespace

Answer

An Authentication custom resource named cluster in the kube-system namespace

Answer

A ConfigMap named ldap-config in the openshift-config namespace

Question 10

An OpenShift administrator needs to restrict external access to a specific application Route by limiting access to a predefined list of allowed client IP addresses. How can this be accomplished?

Accepted Answer

Add the annotation 'haproxy.router.openshift.io/ip_whitelist' to the Route object.. The annotation 'haproxy.router.openshift.io/ip_whitelist' on a Route object instructs the HAProxy router to allow only the specified client IP addresses (or CIDR ranges) to access that route. This is the standard OpenShift method for per-route IP whitelisting without affecting other routes or the entire router. The annotation is processed by the router's HAProxy configuration, which adds ACL rules to enforce the whitelist.

Answer

Configure spec.clientIP in the Service object definition.

Answer

Create a NetworkPolicy with spec.ingress.ipBlock restricting the router pod.

Answer

Update the IngressController CR with a global clientIP blacklist.