EX280 Application Deployment And Lifecycle — 40 Questions

Question 1

A BuildConfig uses an S2I strategy and needs to pull private base images from a secured external container registry. Where must the administrator configure the pull credentials so the builder pod can authenticate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the BuildConfig spec under strategy.dockerStrategy.pullSecret or source/strategy configuration. For an S2I BuildConfig, pull credentials for private base images are configured in the BuildConfig's strategy section, specifically under `strategy.sourceStrategy.pullSecret` (for S2I) or `strategy.dockerStrategy.pullSecret` (for Docker strategy). This secret is used by the builder pod to authenticate to the registry.

Answer

In the ImageStream tag policy

Answer

In the Route resource annotations

Answer

In the global cluster OAuth configuration

Question 2

An OpenShift cluster administrator needs to ensure that custom S2I builder images stored in an insecure internal registry can be successfully pulled by build pods without failing TLS verification. Where must the insecure registry be defined?

Accepted Answer

In the cluster Image resource configuration (imageregistry.config.openshift.io/cluster or image.config.openshift.io). The cluster-wide image configuration resource (image.config.openshift.io/cluster) contains the registrySources section where insecure registries are listed. This configuration is consumed by the internal registry, build pods, and kubelet to determine which registries should be contacted without TLS verification. By defining the insecure registry here, all builds and pods across the cluster can pull from it without certificate errors.

Answer

In the OAuth client definition

Answer

In the individual BuildConfig strategy environment variables

Answer

In the Project request template metadata

Question 3

An administrator is troubleshooting a failed OpenShift build. Which THREE resources or logs should the administrator check to diagnose the failure? (Choose three.)

Accepted Answer

The logs of the specific build pod using oc logs build/. Option A is correct because running `oc logs build/` retrieves the aggregated logs of the build pod, showing the exact output of the build steps and any errors that caused the failure. Option C is correct because inspecting the BuildConfig with `oc get bc/ -o yaml` reveals the build strategy (Source, Docker, or Custom), source references, triggers, and output configuration, which are common sources of build misconfiguration. Option E is correct because `oc get events` in the namespace surfaces scheduling failures, image pull errors, quota or limit issues, and other Kubernetes-level events that explain why a build pod could not run or complete. Option B is not relevant because storage class definitions are cluster-scoped and only matter if the build uses a volume that depends on them, which is not indicated here. Option D is not relevant because the default OAuth client secret relates to authentication and identity provider configuration, not to build execution or build pod failures.

Answer

The cluster-wide storage class definitions

Answer

The default OAuth client secret

Question 4

An administrator needs to configure a Deployment strategy in OpenShift. Which THREE deployment strategy types are natively supported by standard Kubernetes/OpenShift Deployments? (Choose three.)

Accepted Answer

Rolling (for DeploymentConfigs) / RollingUpdate (for Deployments). Option A is correct because OpenShift's DeploymentConfig resource natively supports the Rolling strategy (with parameters like maxSurge and maxUnavailable), which is the equivalent of the RollingUpdate strategy used by standard Kubernetes Deployments. Option C is correct because Recreate is a natively supported strategy in both Kubernetes Deployments and OpenShift DeploymentConfigs, terminating all existing pods before creating new ones, which is useful when the application cannot run multiple versions concurrently. Option E is correct because RollingUpdate is the default strategy for standard Kubernetes Deployments (and thus OpenShift Deployments), incrementally replacing pods to maintain availability during an update. Option B is not correct because BlueGreen is not a native strategy type; it must be implemented manually or via routes/services and additional tooling such as Argo Rollouts. Option D is not correct because Canvas is not a deployment strategy in Kubernetes or OpenShift; it is unrelated to the Deployment spec's strategy field.

Answer

BlueGreen

Answer

Canvas

Question 5

A production Deployment using the Rolling update strategy is failing its readiness probe during a rollout, causing the update to block and eventually time out. You need to inspect the reason for the rollout failure using the OpenShift CLI without deleting the failing pods immediately. Which oc command provides the most direct diagnostic information regarding the rollout status and blockage reason?

Accepted Answer

oc rollout status deployment/. 'oc rollout status deployment/' streams the rollout progress and reports the specific reason the rollout is blocked, such as 'Waiting for deployment spec update to be observed' or 'deployment is not progressing: ReplicaSet has timed out progressing'. It is the most direct CLI command for diagnosing rollout blockage without deleting pods.

Answer

oc get events --sort-by='.metadata.creationTimestamp'

Answer

oc describe deployment <deployment-name>

Answer

oc debug deployment/<deployment-name>

Question 6

An administrator needs to deploy a packaged Helm chart onto an OpenShift 4.14 cluster from a private Helm repository. Which oc command should be used to install the chart while securely managing repository credentials?

Accepted Answer

helm install my-release private-repo/chart-name --repo https://charts.example.com. The 'oc helm' CLI wrapper does not exist natively as 'oc helm'; however, Helm v3 integrates directly with Kubernetes/OpenShift clusters using standard 'helm install' or by configuring Helm repository add commands before installing. Alternatively, using 'oc apply' with pre-rendered manifests or 'helm install' directly against the cluster context is standard. Let's look at the standard Helm workflow used in OpenShift contexts.

Answer

oc adm helm install my-release private-repo/chart-name

Answer

oc create helmchart --name=my-release --source=private-repo

Answer

oc new-app --helm-chart=private-repo/chart-name

Question 7

You have modified a set of Kubernetes manifests using Kustomize and want to preview the exact output that will be applied to your OpenShift cluster without actually executing the changes. Which command should you run?

Accepted Answer

oc kustomize .. 'oc kustomize .' renders the Kustomize overlay in the current directory and prints the fully-resolved YAML to stdout without contacting the cluster or applying anything. It is the canonical way to preview the exact manifests that would be applied, making it ideal for dry inspection of Kustomize output.

Answer

oc diff -f kustomization.yaml

Answer

oc convert -k .

Answer

oc apply -k . --dry-run=client

Question 8

Which THREE of the following mechanisms can be used to automatically trigger a new build in an OpenShift BuildConfig? (Choose three.)

Accepted Answer

ImageChange trigger. Option B (ImageChange trigger) is correct because an OpenShift BuildConfig can define an ImageChange trigger that automatically starts a new build whenever the image stream tag referenced in the build's source or output is updated. Option D (Webhook trigger, GitHub or Generic) is correct because BuildConfigs expose webhook endpoints (GitHub, GitLab, Bitbucket, and Generic) that, when called by the SCM or CI system, cause OpenShift to start a new build immediately. Option E (ConfigChange trigger) is correct because it starts a build automatically whenever the BuildConfig itself is created or modified, which is useful for producing an initial build on configuration changes. Option A (Route health-check trigger) is not a BuildConfig trigger at all — routes only perform HTTP/TCP health checks for traffic routing and cannot initiate builds. Option C (CronJob schedule trigger) is not a BuildConfig trigger either; scheduled builds in OpenShift are handled by a separate BuildConfig-level cron-like mechanism or by external CronJobs, not by a CronJob schedule trigger on the BuildConfig.

Answer

Route health-check trigger

Answer

CronJob schedule trigger

Question 9

You are troubleshooting a BuildConfig that fails during the source clone phase due to an untrusted custom internal Certificate Authority (CA) used by your corporate Git server. Where must you configure the custom CA certificate so that the OpenShift cluster's build pods trust the Git server during S2I builds?

Accepted Answer

In a ConfigMap referenced by the build.openshift.io/inject-trusted-cabundle annotation or build defaults in the cluster.. OpenShift BuildConfigs run in build pods that need to trust the Git server's custom CA. The build.openshift.io/inject-trusted-cabundle annotation on a ConfigMap causes the cluster to inject the CA bundle into the build pod's trust store. Alternatively, you can configure build defaults in the cluster-wide Build configuration (build.config.openshift.io/cluster) to reference a ConfigMap containing the CA, which is then mounted into all build pods. This ensures S2I builds can clone from the Git server without TLS errors.

Answer

In the global cluster proxy configuration under spec.trustedCA.

Answer

In the Node configuration file on each worker node under /etc/origin/node/.

Answer

In the imagestream spec.trust.ca field.

Question 10

You have a S2I build that fails because the builder image is not accessible by the restricted ServiceAccount. What is the most secure way to resolve this?

Accepted Answer

Grant the 'system:image-puller' role to the ServiceAccount. The 'system:image-puller' role is a ClusterRole that grants permission to pull images from ImageStreams. When a ServiceAccount lacks this role, it cannot access the builder image, causing S2I builds to fail. Granting this role to the specific ServiceAccount follows the principle of least privilege, as it only provides the necessary pull access without exposing the image to all users or changing the build strategy. This is the most secure and OpenShift-native solution.

Answer

Change the build strategy to Docker

Answer

Make the ImageStream public

Answer

Create an ImagePullSecret for the ServiceAccount

Question 11

When configuring a custom build strategy, where do you define the Dockerfile to use?

Accepted Answer

In the strategy block of the BuildConfig. In OpenShift, a custom build strategy is defined within the BuildConfig's `spec.strategy` block, specifically under `strategy.customStrategy`, where you specify the Dockerfile inline via the `dockerfile` field or reference it from an image. The BuildConfig is the top-level object that declares how a build should run, so the Dockerfile location belongs there. This allows the build to pull a builder image, inject the Dockerfile, and execute the build inside the resulting pod.

Answer

In the DeploymentConfig

Answer

In the Build object

Answer

In the ImageStream

Question 12

You have a build that fails because it requires access to a private repository. What is the correct way to provide credentials to the build?

Accepted Answer

Associate a secret with the BuildConfig. To let a build pull from a private repository, you associate a Secret containing the registry credentials with the BuildConfig via `spec.strategy.sourceStrategy.pullSecret` (or `spec.output` for push secrets). OpenShift injects this secret into the build pod so it can authenticate to the private registry. This keeps credentials out of the Dockerfile and source code, aligning with security best practices.

Answer

Hardcode credentials in the Dockerfile

Answer

Use an environment variable in the deployment

Answer

Mount a ConfigMap

Question 13

How do you define a command to run immediately before a container starts, such as a database migration?

Accepted Answer

pre-deployment hook. A 'pre' lifecycle hook in the Deployment strategy allows you to run commands before the deployment starts.

Answer

startup-command

Answer

init-container

Answer

post-deployment hook

Question 14

Which TWO deployment triggers are supported by a DeploymentConfig?

Accepted Answer

ConfigChange. In OpenShift, a DeploymentConfig supports three deployment triggers: ConfigChange, ImageChange, and Manual. Option B (ConfigChange) is correct because this trigger automatically starts a new deployment whenever the DeploymentConfig's pod template (its configuration) changes. Option C (ImageChange) is correct because this trigger starts a new deployment whenever a new version of the image referenced by an ImageStreamTag is pushed to the internal registry. Option A (Manual) is a valid trigger type, but it is not marked as correct here, so it is excluded from the answer set. Option D (Cron) is not a DeploymentConfig trigger; scheduled deployments are not natively supported by DeploymentConfig triggers. Option E (Webhook) is not a trigger type for DeploymentConfig; webhooks are used with BuildConfigs to trigger builds, not deployments.

Answer

Manual

Answer

Cron

Answer

Webhook

Question 15

Which TWO commands are typically used to check the status of an application rollout?

Accepted Answer

oc get dc. Option A, `oc get dc`, is correct because it lists DeploymentConfigs and shows their current replica counts and rollout state (e.g., READY, LATEST), letting you verify whether an application rollout has completed or is still progressing. Option B, `oc rollout status`, is correct because it actively reports the progress of a rollout for a DeploymentConfig or Deployment, blocking until the rollout finishes or reporting failure, which is the canonical way to check rollout status. Option C, `oc build logs`, is not correct because it streams logs from a build (BuildConfig), which is unrelated to application rollout status. Option D, `oc trigger`, is not correct because it manually starts a new build or deployment rather than checking an existing rollout's status. Option E, `oc watch`, is not correct because it is not a standard standalone oc command for checking rollout status; continuous observation is typically done with flags like `-w` on get commands.

Answer

oc build logs

Answer

oc trigger

Answer

oc watch

Question 16

You are preparing a deployment strategy for an application in OpenShift 4.14. The application requires zero downtime during updates and must support both the Rolling and Recreate strategies. Which deployment strategy should you choose?

Accepted Answer

Rolling. The Rolling strategy is designed to update pods incrementally while maintaining availability, thus achieving zero downtime. It is one of the built-in strategies and is suitable for applications that can run multiple versions concurrently. The Recreate strategy causes downtime, and Custom or Blue-Green are not native strategies. Therefore, Rolling is the correct choice for zero-downtime deployments.

Answer

Custom

Answer

Blue-Green

Answer

Recreate

Question 17

An administrator must expose an application running as a Deployment named reports in project analytics so that users inside the cluster can reach it by the DNS name reports.analytics.svc.cluster.local on port 80. The pods listen on container port 8080. Which oc command creates the required object with the least configuration?

Accepted Answer

oc expose deployment/reports --port=80 --target-port=8080. Creating a Service from an existing Deployment with the expose subcommand automatically derives the pod selector, names the Service after the Deployment, and maps the requested service port to the container's target port. That produces the internal DNS name on port 80 as required. Creating a Route targets external access, and creating a Service manually risks the wrong port mapping or selector.

Answer

oc create route edge reports --service=reports --port=8080

Answer

oc create service clusterip reports --tcp=8080:8080

Answer

oc expose svc/reports --port=80 --target-port=8080

Question 18

A developer needs to run a one-off database migration task in project billing that uses the image registry.example.com/tools/migrate:1.4 and must not be restarted after completion. Which oc command creates the appropriate workload?

Accepted Answer

oc run db-migrate --image=registry.example.com/tools/migrate:1.4 --restart=Never. A one-off task that must run to completion and not restart is best created as a Pod with a restart policy of Never, which the run subcommand supports directly with the restart flag. Policies of Always, or controllers such as Deployments that maintain replicas, would recreate or restart the container and re-run the migration. The job generator also does not accept an image flag.

Answer

oc create job db-migrate --image=registry.example.com/tools/migrate:1.4

Answer

oc create deployment db-migrate --image=registry.example.com/tools/migrate:1.4

Answer

oc run db-migrate --image=registry.example.com/tools/migrate:1.4 --restart=Always

Question 19

An administrator is preparing a Deployment named inventory in project storefront for a controlled rollout. The administrator wants the new version to receive no production traffic until it is validated, while still allowing a small amount of test traffic to reach it. Which TWO OpenShift features allow directing a subset of traffic to the new pods during the rollout? (Choose two.)

Accepted Answer

A Route with multiple backends and per-backend weights. Directing a portion of traffic to a new version requires both a way to select the new pods and a way to weight traffic between versions. A Service whose selector matches the new labels isolates the canary pods, and a Route with multiple weighted backends splits requests between the stable and canary Services. Network policies, disruption budgets, and image triggers affect connectivity, availability, and automation, not traffic distribution.

Answer

An ImageStreamTag trigger on the DeploymentConfig

Answer

A PodDisruptionBudget on the Deployment

Answer

A NetworkPolicy that limits ingress to the new pods

Question 20

An OpenShift administrator needs to trigger a rollback of a Deployment to its previous working revision after a failed update. Which oc command should be used?

Accepted Answer

oc rollout undo deployment/my-app. The correct command to rollback a Deployment to its previous revision is oc rollout undo deployment/my-app. This command reverts the Deployment to the last successful revision.

Answer

oc update deployment/my-app --revision=previous

Answer

oc revert deployment/my-app

Answer

oc rollback deployment/my-app