EX280 Practice Test 8 — 10 Questions

Question 1

An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

pod-security.kubernetes.io/enforce: restricted. To enforce a standard while generating audit log violations, the audit level is set to enforce while warning/audit levels are configured via namespace labels.

Answer

pod-security.openshift.io/standard: restricted

Answer

security.openshift.io/scc.enforce: restricted

Answer

openshift.io/cluster-monitoring: "true"

Question 2

Which TWO of the following are valid Service types supported natively in OpenShift? (Choose TWO)

Accepted Answer

ClusterIP. ClusterIP, NodePort, and LoadBalancer are standard Kubernetes/OpenShift service types. (ExternalName is also valid, Route is not a service type).

Answer

VirtualIP

Answer

IngressObject

Answer

Route

Question 3

A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?

Accepted Answer

allowHostPorts: true. Allowing pods to bind to privileged ports (< 1024) is controlled by setting allowHostPorts to true or defining allowedHostPorts in a custom SCC.

Answer

runAsUser.type: RunAsAny

Answer

allowPrivilegedContainer: true

Answer

privileged: true

Question 4

An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?

Accepted Answer

Set runAsUser.type to MustRunAs and specify uid: 1000 in the uidRange. To force a specific UID execution, the runAsUser strategy must be set to MustRunAs with a uidRange specifying UID 1000.

Answer

Set runAsUser.type to RunAsAny and add securityContext.runAsUser: 1000 in the pod spec

Answer

Configure fsGroup.type to MustRunAs with uid: 1000

Answer

Set privileged: true and map the container user via supplementalGroups

Question 5

Which THREE commands can an administrator use to inspect existing routes in an OpenShift cluster? (Choose THREE)

Accepted Answer

oc get routes. oc get routes, oc describe route, and oc get route are standard commands. (oc explain route is also valid for documentation). Let's select get, describe, and explain.

Answer

oc top route

Answer

oc logs route/<route-name>

Question 6

A cluster administrator notices that a PVC stuck in the Pending state references a StorageClass with volumeBindingMode set to WaitForFirstConsumer. What action will cause the PVC to bind?

Accepted Answer

Create and schedule a Pod that mounts the PVC.. When volumeBindingMode is WaitForFirstConsumer, the PV is not provisioned or bound until a Pod referencing that PVC is scheduled onto a node.

Answer

Delete the StorageClass and recreate it with Immediate binding mode.

Answer

Restart the kube-apiserver service on the control plane nodes.

Answer

Manually create a PV matching the exact size and labels of the PVC.

Question 7

An administrator wants to prevent automatic updates for an Operator installed via OLM while still allowing manual installation of new versions when desired. Which TWO actions or configurations should be performed? (Choose TWO)

Accepted Answer

Approve generated InstallPlans selectively using 'oc patch installplan' or via the web console when an update is desired.. To prevent automatic updates, set installPlanApproval to Manual and approve install plans manually when ready.

Answer

Scale the OLM operator pods to zero.

Answer

Delete the CatalogSource resource entirely.

Answer

Annotate the Subscription with 'olm.openshift.io/block-updates=true'.

Question 8

You need to provide temporary scratch space for a container that shares the pod's lifetime and is cleared when the pod is deleted. Which volume type should you configure in the Pod specification?

Accepted Answer

emptyDir. An emptyDir volume is created when a pod is assigned to a node, and exists as long as that pod is running on that node. It starts empty.

Answer

persistentVolumeClaim

Answer

hostPath

Answer

nfs

Question 9

Which TWO of the following are valid OpenShift Service types? (Choose TWO)

Accepted Answer

ClusterIP. Kubernetes and OpenShift support several standard service types, among which ClusterIP and NodePort are core native types.

Answer

NetworkPort

Answer

RouteIP

Answer

ContainerPort

Question 10

An administrator wants to verify node configuration application status. Which TWO indicators show that a MachineConfigPool has successfully finished applying a new MachineConfig? (Choose TWO)

Accepted Answer

The 'UpdatedMachineCount' equals the 'MachineCount' in the pool status.. A successfully updated MachineConfigPool will show Updating=False and Updated=<total-nodes> matching machine counts.

Answer

The 'ClusterVersion' status reads 'Updating'.

Answer

The pool status condition 'Paused' is set to True.

Answer

The 'DegradedMachineCount' is greater than zero.