EX280 Hard Questions — 25 Difficult Questions

Question 1

An administrator needs to deploy a Helm chart into an OpenShift cluster while overriding specific chart values using a local YAML file. Which Helm CLI command should be executed?

Accepted Answer

helm install my-release my-chart --values overrides.yaml. The helm install command with the -f or --values flag allows supplying a YAML file to override default chart values.

Answer

helm push my-chart --override overrides.yaml

Answer

helm deploy my-release my-chart --values overrides.yaml

Answer

helm apply -f overrides.yaml my-chart

Question 2

An administrator wants to configure a NetworkPolicy that allows incoming traffic only from pods with the label 'role=frontend' residing in any namespace, provided those namespaces have the label 'environment=production'. How should the namespaceSelector and podSelector be combined?

Accepted Answer

In the same ingress 'from' array item, combining namespaceSelector and podSelector. A single ingress rule in a NetworkPolicy can contain both a namespaceSelector and a podSelector within the same 'from' array element to target specific pods in specific namespaces.

Answer

By referencing an external ClusterRole binding with label selectors

Answer

Using a peerSelector object that nests both labels

Answer

In separate ingress rules, where one rule has namespaceSelector and another has podSelector

Question 3

An administrator needs to configure custom container runtime parameters (such as the maximum pod log size or maximum number of processes per container) across all worker nodes in an OpenShift 4.14 cluster. Which custom resource should the administrator create?

Accepted Answer

ContainerRuntimeConfig. Container runtime settings such as max log size and storage options are managed using the ContainerRuntimeConfig custom resource in OpenShift.

Answer

MachineHealthCheck

Answer

KubeletConfig

Answer

NodeNetworkConfigurationPolicy

Question 4

An administrator needs to perform a canary deployment strategy using standard OpenShift Deployment resources (not DeploymentConfigs). What is the standard Kubernetes/OpenShift native mechanism to route a small percentage of traffic to the canary deployment?

Accepted Answer

Using an OpenShift Route with weighted backend services pointing to stable and canary Services. Standard Deployments do not have native percentage-based traffic splitting; an administrator must use a Service with multiple underlying selector labels alongside a Service Mesh, Ingress controller, or an OpenShift Route with weight configurations pointing to distinct Services. Specifically, OpenShift Routes support splitting traffic via weighted backends across multiple Services.

Answer

Setting the traffic-split annotation on the Deployment resource

Answer

Configuring weight parameters directly in the Deployment spec rollingUpdate strategy

Answer

Enabling canary mode in the ImageStream tag metadata

Question 5

Which TWO fields are mandatory when defining a standard Kubernetes NetworkPolicy object? (Choose TWO)

Accepted Answer

metadata. A NetworkPolicy requires 'apiVersion', 'kind', 'metadata', and 'spec' (with podSelector). From the specific choices, spec.podSelector and metadata are essential.

Answer

spec.ingress

Answer

spec.egress.to.ipBlock

Answer

metadata.namespace

Question 6

During an upgrade of an OpenShift 4.14 cluster using the Cluster Version Operator (CVO), the upgrade status stalls at a specific component. The administrator wants to check the detailed error messages and reconciling loops of the CVO itself. Where should the administrator look?

Accepted Answer

Review the logs of the cluster-version-operator deployment in the openshift-cluster-version namespace.. The Cluster Version Operator runs in the openshift-cluster-version namespace. Its logs provide detailed reconciliation status and errors during cluster upgrades.

Answer

Inspect the clusteroperators object using 'oc describe clusteroperator base-os'.

Answer

Check the cluster-wide events in the default namespace using 'oc get events'.

Answer

Inspect the MachineConfigPool status in the openshift-machine-api namespace.

Question 7

An administrator wants to add a custom CA certificate trust bundle to all worker nodes in an OpenShift 4.14 cluster so that internal container registries can be accessed securely. Which object should the administrator configure?

Accepted Answer

Create a ConfigMap in openshift-config containing the CA certificate and reference it in the cluster image configuration (imageregistry.config.openshift.io).. In OpenShift 4, administrators add custom CA bundles to the cluster-wide proxy or via a ConfigMap targeted by the image config, or by creating a MachineConfig injecting the CA certificate into /etc/pki/ca-trust/source/anchors/.

Answer

Modify the kube-dns ConfigMap to trust external TLS certificates.

Answer

Update the OAuth custom resource with the CA bundle path.

Answer

Restart the cluster proxy service with the '--ca-file' parameter.

Question 8

An administrator observes that pods in a specific namespace are unable to resolve external domain names (e.g., www.redhat.com) while internal service resolution works perfectly. What is the most likely cause of this issue in CoreDNS configuration?

Accepted Answer

The Corefile in the cluster DNS operator configuration has incorrect or missing forward plugins for external resolvers.. CoreDNS forwards external queries to upstream forwarders (like corporate DNS or public resolvers). If the forwarding block in the Corefile is misconfigured, external resolution fails.

Answer

The API server service is missing endpoint IPs.

Answer

NodePort range exhaustion prevents external DNS packets from traversing worker nodes.

Answer

The cluster ingress controller is blocking external UDP port 53.

Question 9

A production Deployment using the Rolling update strategy is failing its readiness probe during a rollout, causing the update to block and eventually time out. You need to inspect the reason for the rollout failure using the OpenShift CLI without deleting the failing pods immediately. Which oc command provides the most direct diagnostic information regarding the rollout status and blockage reason?

Accepted Answer

oc rollout status deployment/<deployment-name>. The 'oc rollout status' command monitors the progress of a deployment and provides direct feedback on why a rollout is blocked.

Answer

oc get events --sort-by='.metadata.creationTimestamp'

Answer

oc describe deployment <deployment-name>

Answer

oc debug deployment/<deployment-name>

Question 10

Which THREE of the following mechanisms can be used to automatically trigger a new build in an OpenShift BuildConfig? (Choose three.)

Accepted Answer

ImageChange trigger. BuildConfigs support webhook triggers (GitHub, Generic), image change triggers (when a base image updates), and configuration change triggers (when the BuildConfig itself changes).

Answer

Route health-check trigger

Answer

CronJob schedule trigger

Question 11

You want to automate the application lifecycle so that every time a code change is pushed, the build and deployment occur automatically. Which combination of features should you use?

Accepted Answer

BuildConfig Webhook and ImageStream triggers. A GitHub webhook combined with ImageStream triggers creates a fully automated pipeline from code commit to deployment.

Answer

Only cron jobs

Answer

Manual build and manual rollout

Answer

DeploymentConfigs only

Question 12

An OpenShift cluster administrator needs to ensure that custom S2I builder images stored in an insecure internal registry can be successfully pulled by build pods without failing TLS verification. Where must the insecure registry be defined?

Accepted Answer

In the cluster Image resource configuration (imageregistry.config.openshift.io/cluster or image.config.openshift.io). Insecure registries must be configured in the cluster-wide Image.config.openshift.io/cluster resource (or registry configuration) so the container runtime and build machinery trust the registry.

Answer

In the OAuth client definition

Answer

In the individual BuildConfig strategy environment variables

Answer

In the Project request template metadata

Question 13

You need to perform a canary deployment by shifting traffic between two versions of your app. What is the standard way to accomplish this in OpenShift without using a Service Mesh?

Accepted Answer

Use Route weights. By adjusting the weights of the 'alternate backends' in a Route, you can control traffic splitting.

Answer

Create two separate Routes

Answer

Modify the Deployment strategy

Answer

Use the 'oc scale' command

Question 14

What is the result of using a 'Recreate' strategy during a deployment?

Accepted Answer

Temporary service outage. The Recreate strategy terminates all existing instances before creating any new ones, resulting in a temporary service outage.

Answer

Zero downtime deployment

Answer

Rolling update

Answer

Instant switch

Question 15

An OpenShift administrator needs to inspect how OVN-Kubernetes handles network flows and packet drops on a specific node. Which debugging utility installed in the OVN node container is most effective for viewing OpenFlow rules?

Accepted Answer

ovs-ofctl. ovs-ofctl is used to inspect and manipulate OpenFlow rules in Open vSwitch bridges, which underpin OVN-Kubernetes data paths.

Answer

nmcli connection show

Answer

ethtool -S

Answer

ovn-trace

Question 16

You have a build that fails because it requires access to a private repository. What is the correct way to provide credentials to the build?

Accepted Answer

Associate a secret with the BuildConfig. You can add a Secret to the BuildConfig that contains the credentials for the private repository.

Answer

Hardcode credentials in the Dockerfile

Answer

Use an environment variable in the deployment

Answer

Mount a ConfigMap

Question 17

Which THREE components are part of a Kustomize configuration?

Accepted Answer

kustomization.yaml. Kustomize uses resources, patches, and a kustomization file to manage deployment overrides.

Answer

BuildConfigs

Answer

Helm Charts

Question 18

An OpenShift administrator needs to restrict access so that pods in namespace 'dev' cannot initiate any outbound connections to pods in namespace 'secure-db'. Which resource should be created in namespace 'secure-db' to achieve this?

Accepted Answer

A NetworkPolicy with an empty ingress rule set in namespace 'secure-db'. A NetworkPolicy with ingress rules applied in the destination namespace ('secure-db') controls which sources are allowed to connect to it.

Answer

A NetworkPolicy blocking egress in namespace 'dev'

Answer

A ClusterNetwork policy blocking all cross-namespace traffic cluster-wide

Answer

An EgressFirewall object in namespace 'dev'

Question 19

An administrator needs to modify the default Ingress controller configuration to change its replica count and adjust the router deployment parameters. Which resource should the administrator edit?

Accepted Answer

ingresscontroller.operator.openshift.io named 'default'. The default Ingress controller is managed by the Ingress operator via the 'default' Ingress resource in the operator.openshift.io API group.

Answer

deployment named router-default in openshift-ingress namespace

Answer

configmap named router-config in openshift-ingress-operator

Answer

service named router-default-http in openshift-ingress

Question 20

An OpenShift cluster is configured with a custom Cluster Network CIDR. An administrator needs to verify the cluster network subnet settings and host subnet assignments. Which operator status or configuration resource contains this cluster-wide network configuration?

Accepted Answer

networks.config.openshift.io named 'cluster'. The networks.config.openshift.io cluster singleton resource holds the cluster network, service network, and CNI provider configuration.

Answer

network.operator.openshift.io named 'default'

Answer

cluster-network.openshift.io

Answer

sdn.openshift.io/config