EX280 Troubleshooting And Diagnostics Practice Test 2 — 15 Questions

Question 1

An administrator wants to stream logs from all pods belonging to a specific Deployment named 'web-frontend' in real-time. Which command achieves this?

Accepted Answer

oc logs deployment/web-frontend -f. oc logs supports targeting a Deployment directly via the resource type, streaming logs from all associated pods.

Answer

oc watch deployment/web-frontend

Answer

oc logs pods -l app=web-frontend

Answer

oc rsh deployment/web-frontend

Question 2

A pod fails to start with a 'CreateContainerConfigError' error message. What is the most common cause of this error that an administrator should investigate?

Accepted Answer

A referenced ConfigMap or Secret in the pod specification does not exist.. CreateContainerConfigError typically occurs when a referenced ConfigMap or Secret does not exist or is misspelled in the pod specification.

Answer

The liveness probe timed out before the application started.

Answer

The container image pull policy is set to Always and the registry is down.

Answer

The container exceeded its memory limit upon initialization.

Question 3

An OpenShift cluster's SDN (OVN-Kubernetes) experiences packet loss between nodes. The administrator needs to inspect the Open vSwitch (OVS) flow tables on a specific worker node. How should they access the node to run 'ovs-ofctl dump-flows'?

Accepted Answer

oc debug node/ -- chroot /host ovs-ofctl dump-flows br-int. Using oc debug node/ provides a shell where chroot /host allows executing host-level commands like ovs-ofctl.

Answer

oc adm diagnostics ovs

Answer

oc exec daemonset/ovn-controller -- ovs-ofctl dump-flows

Answer

oc rsh daemonset/ovnkube-node

Question 4

An administrator needs to check the cluster events across all namespaces sorted by timestamp to identify recent infrastructure warnings. Which command should they use?

Accepted Answer

oc get events --sort-by='.metadata.creationTimestamp'. oc get events --sort-by='.metadata.creationTimestamp' lists all events ordered by creation time.

Answer

oc adm events --all

Answer

oc show events --recent

Answer

oc cluster-events

Question 5

A container inside a pod is failing with 'ImagePullBackOff'. The administrator verifies the image tag exists. What is the next most logical troubleshooting step to check authentication or registry access?

Accepted Answer

Check if a pull secret is correctly configured and bound to the service account.. Checking the ImageStream or Secret associated with image pull credentials (such as dockercfg secrets) is necessary when pulling from private registries.

Answer

Inspect the etcd cluster operator status.

Answer

Run 'oc debug' to inspect the container file system.

Answer

Restart the cluster version operator.

Question 6

During a troubleshooting session on a degraded cluster operator, an administrator finds that the operator's operand configuration is controlled by a Custom Resource (CR). Where is the most reliable place to look for error status messages reported by the operator controller loop regarding this CR?

Accepted Answer

The status field of the specific Custom Resource instance (e.g., 'oc get

-o yaml').. Cluster operators store detailed status conditions, error messages, and reasons inside the status block of their specific Custom Resource instance.

Answer

The default Kubernetes events in the default namespace.

Answer

The global clusterversion object status conditions.

Answer

The /var/log/messages file on the master nodes.

Question 7

An administrator wants to verify if all required cluster operators are available and not degraded after an installation. Which command provides this summary?

Accepted Answer

oc get clusteroperators. oc get clusteroperators lists all cluster operators along with their Available, Progressing, and Degraded status conditions.

Answer

oc adm cluster-status

Answer

oc get nodes

Answer

oc get pods --all-namespaces

Question 8

An application pod is running, but HTTP requests to the service are returning '502 Bad Gateway'. The administrator wants to check if the endpoints controller has populated the Service with active pod IP addresses. Which command verifies this?

Accepted Answer

oc get endpoints my-service. oc get endpoints lists the IP addresses and ports corresponding to the Service selector, confirming if pods are registered.

Answer

oc get svc my-service

Answer

oc describe ingress

Answer

oc get routes my-route

Question 9

An OpenShift cluster node has experienced kernel panics due to a faulty third-party kernel module. The administrator needs to review the kernel crash logs (vmcore or kdump logs) stored on the node. Where are these logs typically written on a CoreOS worker node?

Accepted Answer

/var/crash. Red Hat Enterprise Linux CoreOS (RHCOS) configures kdump to write crash dumps to /var/crash when kernel panics occur.

Answer

/run/log/journal

Answer

/var/lib/kubelet/pods

Answer

/var/log/audit/audit.log

Question 10

An administrator needs to tail the logs of all pods with the label 'tier=frontend' across the current namespace. Which command should be used?

Accepted Answer

oc logs -l tier=frontend. oc logs with the label selector flag (-l) streams logs from all matching pods simultaneously.

Answer

oc watch logs tier=frontend

Answer

oc logs pods --selector=tier=frontend -f

Answer

oc tail -l tier=frontend

Question 11

An administrator observes that a specific node has high CPU utilization and wants to identify which processes or containers are consuming the most resources on that host directly. Which command-line tool executed inside an oc debug session on the node is best suited for interactive process monitoring?

Accepted Answer

oc debug node/<node-name> -- chroot /host top. Running 'top' or 'htop' inside an oc debug chroot environment provides real-time CPU and memory consumption of processes on the host.

Answer

oc exec node/<node-name> -- ps aux

Answer

oc adm monitor node

Answer

oc adm top node --use-protocol-buffers

Question 12

The 'dns' ClusterOperator is reporting Degraded=True because CoreDNS pods are failing health checks. The administrator suspects DNS request loops or upstream forwarding failures. Which log source is most effective for diagnosing CoreDNS resolution errors?

Accepted Answer

oc logs -n openshift-dns -l dns.operator.openshift.io/daemonset-dns=default. CoreDNS runs as a deployment in the openshift-dns namespace. Its pod logs show incoming query failures and forwarding timeouts.

Answer

oc logs -n kube-system deployment/kube-dns

Answer

journalctl -u coredns

Answer

oc logs -n openshift-network-operator deployment/network-operator

Question 13

An administrator is troubleshooting a certificate expiration issue that has broken communication between the kubelet and the API server. Where are the kubelet client certificates stored on a worker node that can be inspected via an oc debug session?

Accepted Answer

/var/lib/kubelet/pki/. Kubelet client certificates and configurations on RHCOS worker nodes are stored under /etc/kubernetes/pki or /var/lib/kubelet/pki.

Answer

/var/lib/etcd/cert

Answer

/etc/origin/node/certificates

Answer

/etc/kubernetes/pki

Question 14

An administrator notices that the Ingress Operator is failing to deploy routers because of a persistent validation error in the Default IngressController resource. How can the administrator inspect the exact validation schema failure reported by the operator?

Accepted Answer

oc describe ingresscontroller default -n openshift-ingress-operator. Describing the ingresscontroller custom resource in the openshift-ingress-operator namespace reveals reconciliation status errors and validation messages.

Answer

oc logs -n openshift-ingress deployment/router-default

Answer

oc adm inspect router

Answer

oc get validatingwebhookconfigurations

Question 15

An administrator wants to check the exit code of a container that terminated earlier today in a pod that has since been restarted. Which command displays the previous termination details?

Accepted Answer

oc logs <pod-name> --previous. oc logs --previous retrieves the log output from the previous container instance before it restarted.

Answer

oc describe pod <pod-name> --history

Answer

oc adm pod-logs --last

Answer

oc get pod <pod-name> -o exit-code