EX280 Practice Test 8 — 10 Questions

Question 1

An administrator needs to prune or reclaim dangling VolumeSnapshotContent objects whose parent VolumeSnapshots have already been deleted, but the reclaim policy was set incorrectly. How can this be resolved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Manually delete the orphaned VolumeSnapshotContent object or remove its finalizers if stuck.. Orphaned VolumeSnapshotContent objects left behind when their parent VolumeSnapshot is deleted (due to a misconfigured deletionPolicy of Retain instead of Delete) must be cleaned up manually. You delete the VolumeSnapshotContent object directly, or if it is stuck due to finalizers, remove the finalizers (e.g., snapshot.storage.kubernetes.io/volumesnapshotcontent-bound-protection) and then delete it.

Answer

Recreate the deleted VolumeSnapshot with the exact same UID.

Answer

Restart the snapshot-controller deployment.

Answer

Run 'oc prune snapshots --force'.

Question 2

A developer needs to expose a service via a route with re-encryption. What is required in the Route configuration?

Accepted Answer

Set 'termination: reencrypt' in the spec.tls section. A re-encrypt route terminates TLS at the router and then re-encrypts traffic to the backend pod using a separate certificate. This is configured by setting termination: reencrypt in the route's spec.tls section, along with a destination CA certificate so the router can validate the backend's certificate. The reencrypt termination type is the defining configuration element.

Answer

Enable 'insecureEdgeTerminationPolicy: Allow'

Answer

Configure a ServiceMesh resource

Answer

Set 'termination: edge' and add a proxy

Question 3

Which THREE of the following are valid identity provider types supported natively in OpenShift Container Platform? (Choose THREE)

Accepted Answer

OpenIDConnectIdentityProvider. Option C, OpenIDConnectIdentityProvider, is correct because OpenShift Container Platform natively supports OpenID Connect (OIDC) as an identity provider type, allowing integration with OIDC-compliant providers such as Keycloak or Google. Option D, LDAPPasswordIdentityProvider, is correct because OCP natively supports LDAP-based authentication via the LDAPPasswordIdentityProvider, which validates credentials against an LDAP directory using a bind operation. Option E, HTPasswdPasswordIdentityProvider, is correct because OCP natively supports the HTPasswdPasswordIdentityProvider, which validates usernames and passwords against a flat file generated by htpasswd. Option A, ActiveDirectoryDirectIdentityProvider, is not a valid native provider type; Active Directory is integrated through the LDAP identity provider rather than a dedicated Active Directory provider. Option B, LocalDatabaseIdentityProvider, is not a valid native provider type; OCP does not provide a built-in local user database identity provider.

Answer

ActiveDirectoryDirectIdentityProvider

Answer

LocalDatabaseIdentityProvider

Question 4

An administrator creates a new project request template that includes a custom RoleBinding. However, when users create new projects, the RoleBinding fails to bind because it references a ClusterRole that does not exist in the template namespace. How are ClusterRoles referenced in project templates resolved?

Accepted Answer

ClusterRoles must be created cluster-wide prior to template instantiation because RoleBindings within the template reference them.. RoleBindings inside a project request template reference ClusterRoles by name, and those ClusterRoles must already exist cluster-wide before the template is instantiated. The template does not embed or create ClusterRoles; it only creates namespaced resources in the new project. If the referenced ClusterRole is missing, the RoleBinding fails to bind.

Answer

ClusterRoles must be defined inside the same project request template YAML file.

Answer

Project request templates do not support RoleBindings; only ResourceQuotas are allowed.

Answer

The RoleBinding must use a Namespaced Role instead of a ClusterRole.

Question 5

An administrator wants to prevent developers from accidentally deploying containers that request excessive CPU resources in the 'analytics' namespace. Which object should the administrator create in that namespace?

Accepted Answer

LimitRange. A LimitRange constrains per-pod or per-container resource requests and limits within a namespace, which is exactly what prevents a developer from submitting a pod that requests excessive CPU. It can set default, min, and max values for CPU/memory per container or pod, and the API server rejects any pod spec that violates those bounds. This is the correct object for per-object resource guardrails.

Answer

ResourceQuota

Answer

ClusterRoleBinding

Answer

SecurityContextConstraints

Question 6

A developer wants to track multiple versions and tags of container images within an OpenShift cluster efficiently. Which OpenShift resource provides this capability?

Accepted Answer

ImageStream. An ImageStream is an OpenShift resource that acts as an abstraction layer over container images, allowing you to track multiple versions and tags of an image. It maintains a history of image changes and provides a stable reference that can trigger builds and deployments when new images are pushed or tagged. This makes it ideal for efficiently managing image versions and tags within the cluster.

Answer

Route

Answer

DeploymentConfig

Answer

BuildConfig

Question 7

Which command is used to delete a PersistentVolumeClaim named 'my-app-pvc' in the current project?

Accepted Answer

oc delete pvc my-app-pvc. 'oc delete pvc my-app-pvc' is the correct syntax to remove a PersistentVolumeClaim in the current project. The 'oc delete' verb works uniformly across resource types, and 'pvc' is the accepted short name for PersistentVolumeClaim. The current namespace is used unless -n is specified.

Answer

oc remove pvc my-app-pvc

Answer

oc destroy pvc my-app-pvc

Answer

oc prune pvc my-app-pvc

Question 8

When performing a 'rollout undo' on a Deployment, what is the default behavior if no revision is specified?

Accepted Answer

Roll back to the previous revision. The `oc rollout undo` command (and its kubectl equivalent) defaults to reverting a Deployment to the immediately preceding revision when no `--to-revision` flag is supplied. OpenShift tracks each DeploymentConfig/Deployment revision via ReplicaSets, and the undo operation simply scales up the prior ReplicaSet while scaling down the current one. This makes 'previous revision' the implicit target, not revision 1 or the initial state.

Answer

Delete the current deployment

Answer

Return to the state at initial deployment

Answer

Roll back to revision 1

Question 9

An administrator needs to create a Route that handles multiple subdomains or redirects insecure HTTP traffic to HTTPS automatically. Where is the insecure traffic redirect configured?

Accepted Answer

insecureEdgeTerminationPolicy: Redirect. In OpenShift, a Route's TLS configuration includes the `insecureEdgeTerminationPolicy` field, which controls how non-TLS (HTTP) traffic is handled when the Route is configured for edge or re-encrypt termination. Setting it to `Redirect` makes the router automatically issue an HTTP 302 redirect to the HTTPS URL, ensuring all insecure traffic is upgraded. This is the standard, supported mechanism for enforcing HTTPS on a Route.

Answer

route.openshift.io/handling: insecure-redirect

Answer

tls.allowInsecure: true

Answer

spec.redirectHTTP: enabled

Question 10

An administrator is troubleshooting a failed cluster upgrade in OpenShift 4.14. The upgrade channel is set to 'stable-4.14', but the cluster refuses to update to the latest target version. The administrator runs 'oc get clusterversion' and notes that a specific ClusterOperator reports 'Degraded=True'. What is the recommended next step?

Accepted Answer

Describe or inspect the degraded ClusterOperator to identify the root cause and resolve its configuration or resource issues.. The Cluster Version Operator (CVO) blocks upgrades when any ClusterOperator reports Degraded=True because a degraded operator indicates an unhealthy cluster component that could cause the upgrade to fail or leave the cluster in an unstable state. The correct next step is to investigate the specific degraded operator using 'oc describe clusteroperator ' or 'oc get clusteroperator -o yaml' to identify the root cause, such as misconfiguration, missing resources, or failing pods. Once the underlying issue is resolved and the operator reports Available=True and Degraded=False, the upgrade can proceed normally. This aligns with OpenShift's design principle that upgrades should only occur on a healthy cluster.

Answer

Switch the upgrade channel to 'fast-4.14' to bypass the degraded check.

Answer

Delete the Cluster Version Operator deployment to force a reset of the upgrade state machine.

Answer

Force the upgrade by running 'oc adm upgrade --to=<version> --force-ignore-degraded'.