EX280 Cluster Installation And Management Practice Test 6 — 15 Questions

Question 1

An administrator is planning an OpenShift 4.14 cluster upgrade and wants to ensure that specific safety checks and conditions are met before proceeding. Which THREE conditions must be true for an upgrade to proceed smoothly? (Choose THREE)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

All MachineConfigPools must be fully updated and not in a degraded state.. Option A is correct because OpenShift's Cluster Version Operator will not begin an upgrade while any MachineConfigPool is still updating or degraded; each pool must report Updated=True and Degraded=False so that node configuration rollouts complete cleanly. Option D is correct because upgrades must follow a supported path in the Cincinnati update graph — the target version must be a recommended or valid next hop from the current version, otherwise the CVO blocks the update. Option E is correct because all cluster operators (including the Cluster Version Operator itself) must report Available=True and Degraded=False; a degraded operator halts the upgrade to prevent further damage. Option B is wrong because 'nightly' channels are for pre-release testing, not production upgrades, which should use stable/eus channels. Option C is wrong because user namespaces and workloads are not deleted before an upgrade; OpenShift upgrades are designed to preserve tenant workloads.

Answer

The cluster must be switched to the 'nightly' channel for all production upgrades.

Answer

All user-created namespaces must be temporarily deleted prior to upgrade.

Question 2

An administrator wants to configure automated remediation for worker nodes that become unresponsive or experience hardware failure. Which TWO configurations or resources are required for a MachineHealthCheck to function properly? (Choose TWO)

Accepted Answer

Unhealthy conditions specifying the node status condition and timeout duration.. Option B is correct because a MachineHealthCheck must define unhealthyConditions, which specify the node status condition type (for example Ready) and a timeout duration that determines how long the condition must persist before the node is considered unhealthy and remediation is triggered. Option C is correct because a MachineHealthCheck uses a selector with matchLabels to identify the target MachineSet or machine pool whose machines it will monitor and remediate. Option A is incorrect because MachineHealthCheck does not use a replica count for remediation pods; remediation is performed by deleting and recreating the unhealthy Machine via its MachineSet. Option D is incorrect because ContainerRuntimeConfig is used to configure container runtime settings like pidsLimit or logLevel, not node health remediation. Option E is incorrect because an OperatorGroup defines the namespaces an Operator watches and is unrelated to MachineHealthCheck configuration.

Answer

A replica count specifying how many remediation pods to run.

Answer

A ContainerRuntimeConfig specifying reboot parameters.

Answer

An OperatorGroup defining the namespace for the health check.

Question 3

An administrator wants to prevent automatic updates for an Operator installed via OLM while still allowing manual installation of new versions when desired. Which TWO actions or configurations should be performed? (Choose TWO)

Accepted Answer

Approve generated InstallPlans selectively using 'oc patch installplan' or via the web console when an update is desired.. Option D is correct because setting spec.installPlanApproval: Manual on the Operator's Subscription tells OLM to create InstallPlans for new versions but not apply them automatically, which is exactly the mechanism for preventing automatic updates while retaining the ability to upgrade later. Option A is correct because with Manual approval, each generated InstallPlan must be explicitly approved, either by patching it (e.g., oc patch installplan <name> --type merge -p '{"spec":{"approved":true}}') or by clicking Approve in the OpenShift web console, which is how an administrator manually installs a new version when desired. Option B is wrong because scaling OLM operator pods to zero disables the entire Operator Lifecycle Manager and would break InstallPlan generation and approval rather than selectively pausing updates. Option C is wrong because deleting the CatalogSource removes the source of available Operator versions and would prevent discovering or installing new versions at all. Option E is wrong because olm.openshift.io/block-updates is not a valid OLM Subscription annotation for controlling update approval; the supported control is the installPlanApproval field.

Answer

Scale the OLM operator pods to zero.

Answer

Delete the CatalogSource resource entirely.

Answer

Annotate the Subscription with 'olm.openshift.io/block-updates=true'.

Question 4

Which TWO commands or tools can an administrator use to inspect cluster logs or events when troubleshooting node or pod issues? (Choose TWO)

Accepted Answer

oc logs . Option B, `oc logs `, is correct because it retrieves the stdout/stderr container logs for a specific pod (with flags like `-c` for a container, `-f` to follow, or `--previous` for a crashed container), which is the primary way to inspect application-level output when troubleshooting a pod. Option E, `oc get events`, is correct because it lists Kubernetes Events in the current namespace (or with `-A`/`--all-namespaces`), showing scheduling failures, image pull errors, probe failures, and node-related warnings useful for diagnosing node or pod issues. Option A, `oc adm cluster-logs --tail=all`, is not a valid OpenShift command for this purpose. Option C, `oc system-log dump`, is not a real `oc` subcommand for collecting logs. Option D, `oc adm tail-events`, is not a valid command; events are viewed with `oc get events` or `oc describe`.

Answer

oc adm cluster-logs --tail=all

Answer

oc system-log dump

Answer

oc adm tail-events

Question 5

An administrator is troubleshooting a custom MachineConfig that failed to apply across a worker MachineConfigPool. Which THREE diagnostic steps or resources should the administrator check? (Choose THREE)

Accepted Answer

Review the logs of the machine-config-daemon pods on the affected nodes.. To diagnose MachineConfig application failures, check pool status conditions, machine-config-daemon pod logs, and rendered MachineConfigs.

Answer

Check the Cluster Version Operator logs for container registry pull errors.

Answer

Verify the OLM CatalogSource status.

Question 6

An administrator is managing cluster machine configurations and needs to understand how Ignition configuration files are processed. Which THREE statements are correct regarding Ignition and the Machine Config Operator in OpenShift 4.14? (Choose THREE)

Accepted Answer

The Machine Config Daemon runs on every node to apply updates delivered by the MCO.. Option A is correct because the Machine Config Daemon (MCD) runs as a DaemonSet on every node in the cluster and is responsible for applying MachineConfig changes delivered by the Machine Config Operator, including rebooting or draining nodes as needed. Option B is correct because Ignition is a provisioning-time utility used by RHCOS during initial node installation and first boot to perform disk partitioning, filesystem creation, and writing configuration files before the node joins the cluster. Option C is correct because the MCO renders a merged MachineConfig for each machine config pool by combining the appropriate MachineConfigs (including the rendered-worker or rendered-master configs) into a single Ignition config that the MCD applies. Option D is incorrect because Ignition configs are not stored in etcd; they are served by the MCS and consumed by nodes during provisioning, and etcd stores Kubernetes objects, not raw Ignition files. Option E is incorrect because Ignition is not a continuously running daemon and does not re-parse configs every 5 seconds; it runs only during early boot/provisioning, while ongoing configuration changes are handled by the MCD.

Answer

Ignition files are stored directly inside etcd without encryption or serialization.

Answer

Ignition configs are dynamically parsed and executed continuously by a background daemon every 5 seconds during normal runtime.

Question 7

An administrator wants to check the status of Machine API provisioning and verify that all machines are in a running state. Which TWO commands or resource inspections should the administrator perform? (Choose TWO)

Accepted Answer

Run 'oc get machines -A' to list all provisioned machines across namespaces.. Option C is correct because 'oc get machines -A' lists all Machine objects across all namespaces, letting the administrator inspect each machine's PHASE (e.g., Running, Provisioned, Provisioning) to confirm they are in a running state. Option D is correct because 'oc get machinesets -A' shows each MachineSet's DESIRED, CURRENT, and READY replica counts, which verifies that the desired number of machines has been provisioned and is healthy. Option A is wrong because 'oc adm machine-status' is not a valid oc adm subcommand. Option B is wrong because 'oc get clusteroperators' does not accept a '--machines' flag and reports ClusterOperator status, not Machine API provisioning. Option E is wrong because 'oc get machineconfigpools' does not accept a '--machines' flag and reports MachineConfigPool node configuration status, not Machine provisioning state.

Answer

Run 'oc adm machine-status'.

Answer

Run 'oc get clusteroperators --machines'.

Answer

Run 'oc get machineconfigpools --machines'.

Question 8

An administrator is managing operator subscriptions and wants to ensure that an operator is automatically updated when new versions are released in the channel. Which THREE conditions or configuration settings must be satisfied? (Choose THREE)

Accepted Answer

The OperatorGroup must correctly encompass the target namespace scope.. Option A is correct because the OperatorGroup defines the set of target namespaces (its spec.targetNamespaces or the namespace it resides in) that the operator's CSV will be deployed to, and OLM will not resolve or upgrade a Subscription whose OperatorGroup scope does not cover the intended namespace. Option B is correct because OLM resolves available operator versions from the package manifests served by a CatalogSource; if that CatalogSource is unhealthy or missing, no new bundles are discovered and no upgrade can be triggered. Option C is correct because spec.installPlanApproval: Automatic on the Subscription causes OLM to automatically approve the generated InstallPlan when a newer bundle appears in the channel, which is exactly what enables unattended updates. Option D is not correct because the Cluster Version Operator manages OpenShift platform components, not third-party OLM operators, and has no auto-upgrade setting governing them. Option E is not correct because deleting the global pull secret would break image pulls from authenticated registries; OLM uses the existing pull secrets and does not require unauthenticated catalog access.

Answer

The Cluster Version Operator must have auto-upgrade enabled for third-party operators.

Answer

The global pull secret must be deleted so OLM can fetch unauthenticated updates.

Question 9

Which TWO files or directories are commonly configured or injected via MachineConfig objects for node customization? (Choose TWO)

Accepted Answer

Custom files placed in arbitrary file paths on the node filesystem.. MachineConfig objects in OpenShift are used to apply node-level customizations by injecting Ignition configs, and they commonly include custom files placed at arbitrary paths on the node filesystem (option A) — for example, dropping a config file into /etc or a systemd unit — because MachineConfig supports specifying file contents, path, mode, and ownership. They also commonly configure authorized SSH keys for the core user (option D), which is a standard MachineConfig use case (e.g., the 99-master-ssh and 99-worker-ssh MachineConfigs) to enable SSH access to nodes. Option B is incorrect because PVCs are Kubernetes storage resources for application pods, not node customization injected via MachineConfig. Option C is incorrect because MachineConfig does not modify the Kubernetes API server binary code; it manages node OS-level configuration through Ignition. Option E is incorrect because container image layer caches are managed by the container runtime and are not a MachineConfig-injected node customization.

Answer

Persistent Volume Claims (PVCs) for user applications.

Answer

Direct modifications to the Kubernetes API server binary code.

Answer

Dynamic container image layer storage caches.

Question 10

Which TWO tasks are typically performed by an OpenShift cluster administrator when managing worker node lifecycles? (Choose TWO)

Accepted Answer

Cordoning and draining nodes for operating system maintenance.. Option D is correct because cordoning a node marks it as unschedulable (kubectl cordon) and draining it evicts running pods (kubectl drain) so the node can safely undergo OS patching, reboots, or other maintenance without disrupting workloads. Option E is correct because node labels are the mechanism that determines which nodes belong to a given MachineConfigPool, allowing the administrator to target specific MachineConfig updates to defined groups of worker nodes. Option A is not a typical administrator task, since etcd data files on control plane nodes are managed by the etcd operator and should not be edited directly. Option B is incorrect because OpenShift manages the OS via immutable RHCOS and MachineConfig, not by manually compiling kernels over SSH. Option C is incorrect because writing Kubernetes API server source code is upstream development work, not cluster administration.

Answer

Directly editing etcd data files on control plane nodes.

Answer

Manually compiling custom Linux kernel binaries on every node via SSH.

Answer

Writing custom source code for the Kubernetes API server.

Question 11

An administrator is investigating why cluster operator upgrades are failing. Which TWO locations or commands provide detailed diagnostic information about cluster operators? (Choose TWO)

Accepted Answer

Run 'oc describe clusteroperator ' to inspect status conditions and messages.. Option A is correct because 'oc describe clusteroperator ' surfaces the ClusterOperator object's status.conditions, including Available, Progressing, Degraded, and their human-readable messages, which directly reveal why an upgrade is stuck or failing. Option C is correct because the actual controller pods (for example, the cluster-version-operator pod in openshift-cluster-version or an operator's own controller pods in its namespace) emit detailed logs that explain reconciliation errors, failed image pulls, or API conflicts behind the conditions. Option B is wrong because the DNS configuration map in the default namespace only holds cluster DNS settings and has nothing to do with operator upgrade diagnostics. Option D is wrong because 'oc adm cluster-operator-reset --all' is not a valid diagnostic command and would not report operator status. Option E is wrong because MachineConfigPool status conditions report node configuration rollout state, not OLM or cluster operator errors.

Answer

Check the global DNS configuration map in the default namespace.

Answer

Run 'oc adm cluster-operator-reset --all'.

Answer

Inspect the MachineConfigPool status conditions for OLM errors.

Question 12

An administrator needs to configure secure access to a private registry for both node image pulls and OLM operator deployments. Which THREE actions or resources are required across the cluster? (Choose THREE)

Accepted Answer

Update the global pull secret in openshift-config/pull-secret with registry credentials.. Option A is correct because the global pull secret stored in the openshift-config namespace as pull-secret must contain the private registry credentials so that all nodes and the internal registry can authenticate when pulling images. Option B is correct because when the registry uses a custom or self-signed CA, the CA certificate must be distributed to nodes via a ConfigMap referenced in the cluster-wide image config (image.config.openshift.io/cluster) so that CRI-O and related components trust the registry's TLS certificate. Option E is correct because ImageContentSourcePolicy (or the newer ImageTagMirrorSet/ImageDigestMirrorSet) resources redirect image pulls from upstream references to the private registry mirror, which is required for both node image pulls and OLM operator deployments to resolve images correctly. Option C is incorrect because disabling TLS verification globally via ClusterVersion is not a supported or secure practice and would undermine the secure access requirement. Option D is incorrect because scaling the Machine API operator to zero is unrelated to registry credential or trust configuration and would disrupt cluster machine management.

Answer

Modify the ClusterVersion spec to disable TLS verification globally.

Answer

Scale the Machine API operator to zero during credential updates.

Question 13

An administrator is preparing to upgrade an OpenShift Container Platform 4.14 cluster from version 4.13.12 to 4.14.6. Before starting the upgrade, the administrator wants to ensure that all cluster Operators are healthy and that no prerequisites are blocking the upgrade. Which command should the administrator run to view the current upgrade status and any available updates?

Accepted Answer

oc adm upgrade. The `oc adm upgrade` command is designed to show the current cluster version, any available updates, and conditions that might prevent an upgrade. It provides a concise summary that helps administrators decide whether to proceed. Before upgrading, it is essential to confirm that all ClusterOperators are available and not degraded, and that no upgrade blockers exist. This command directly surfaces that information.

Answer

oc get nodes -o wide

Answer

oc describe clusteroperators

Answer

oc get clusterversion version -o yaml

Question 14

An administrator is troubleshooting an OpenShift Container Platform 4.14 cluster that is failing to upgrade. The Cluster Version Operator (CVO) reports that the upgrade is blocked due to an unhealthy ClusterOperator. Which TWO commands should the administrator use to identify the specific ClusterOperator and its error condition? (Choose two.)

Accepted Answer

oc describe clusteroperator . To identify the unhealthy ClusterOperator, the administrator should first list all ClusterOperators with 'oc get clusteroperators' to spot the one with a degraded or unavailable status. Then, 'oc describe clusteroperator ' provides in-depth details, including conditions and events, to pinpoint the root cause. The other commands are either too broad or focus on the CVO rather than the specific operator.

Answer

oc get clusterversion

Answer

oc logs -n openshift-cluster-version cluster-version-operator-<pod>

Answer

oc get pods -n openshift-cluster-version

Question 15

An administrator is managing an OpenShift Container Platform 4.14 cluster on AWS. The administrator wants to configure the cluster so that when a worker node is terminated due to a spot instance interruption, the MachineSet automatically replaces it. Which MachineSet configuration parameter should the administrator verify to ensure that new Machines are created to replace terminated ones?

Accepted Answer

replicas. The MachineSet controller continuously monitors the number of Machines matching its selector. When a Machine is terminated (e.g., due to a spot instance interruption), the actual count falls below the desired `replicas`. The controller then creates a new Machine based on the `template` to bring the count back to the desired state. Therefore, the `replicas` parameter is the key to ensuring automatic replacement.

Answer

selector

Answer

deletePolicy

Answer

template