EX280 Troubleshooting And Diagnostics Practice Test 4 — 15 Questions

Question 1

The cluster monitoring stack is failing because Prometheus pods in the openshift-monitoring namespace are crashing due to disk space exhaustion on the Prometheus PersistentVolume. How can the administrator inspect the current disk usage inside the Prometheus container?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

oc exec -n openshift-monitoring prometheus-k8s-0 -c prometheus -- df -h. The Prometheus pods run in the openshift-monitoring namespace, and to inspect disk usage inside a specific container you must exec into that container. Option A uses `oc exec` with the correct pod name (prometheus-k8s-0), namespace, and container (-c prometheus) to run `df -h`, which directly shows filesystem usage on the mounted PersistentVolume. This is the only option that targets the actual container's filesystem rather than the node or unrelated resources.

Answer

oc debug node/<node-name> -- df -h

Answer

oc logs -n openshift-monitoring deployment/prometheus-adapter

Answer

oc adm top volume

Question 2

An OpenShift cluster's Ingress controller is failing to route external traffic because the router pods are crashing with 'Bind: address already in use'. What is the most likely cause that an administrator should investigate?

Accepted Answer

Another service or daemon on the worker node is already binding to host ports 80 or 443.. The 'Bind: address already in use' error means the router pod's haproxy process cannot bind to host ports 80/443 because another process on the node already holds them. OpenShift's Ingress Controller runs as a hostNetwork pod binding directly to the node's ports 80 and 443, so any conflicting daemon (nginx, httpd, another load balancer, or a leftover router) will cause the crash. Administrators should check with 'ss -tlnp | grep -E ":80|:443"' or 'netstat -tulpn' on the worker node to identify the conflicting process.

Answer

The OAuth client secret is invalid.

Answer

The default router deployment replica count is set to zero.

Answer

The wildcard DNS record for the cluster points to the wrong IP address.

Question 3

An application team reports that their application cannot connect to an external database due to a firewall blocking port 3306. The administrator wants to test network connectivity from inside a running application pod to the external database host. Which tool can they run using 'oc exec'?

Accepted Answer

oc exec <pod-name> -- nc -zv db.example.com 3306. `oc exec` allows running arbitrary commands inside a running container, and `nc` (netcat) with the `-zv` flags is a standard tool for testing TCP connectivity to a specific host and port. The `-z` flag performs a scan without sending data, and `-v` provides verbose output, making it ideal for verifying whether port 3306 is reachable from the pod's network namespace. This directly addresses the application team's issue by simulating the connection attempt from the same environment.

Answer

oc network test db.example.com 3306

Answer

oc adm port-forward pod/<pod-name> 3306:3306

Answer

oc debug pod/<pod-name> -- test-connection

Question 4

An administrator needs to list all persistent volume claims in the cluster that are currently stuck in the 'Pending' state. Which command can be combined with grep or custom formatting to identify them?

Accepted Answer

oc get pvc --all-namespaces. PersistentVolumeClaims are namespaced resources, so listing them across the entire cluster requires the '--all-namespaces' flag. The command 'oc get pvc --all-namespaces' returns every PVC in every namespace, and the output can be piped to grep or formatted with -o wide/custom-columns to filter for those in Pending state. This is the correct base command for identifying stuck PVCs cluster-wide.

Answer

oc describe storage-cluster

Answer

oc adm storage pending

Answer

oc get pv --status=Pending

Question 5

An OpenShift cluster administrator receives an alert that etcd disk fsync durations are excessively high. Which performance metric is the etcd diagnostic tool measuring when evaluating disk latency?

Accepted Answer

The time taken for etcd to commit WAL (Write-Ahead Log) entries to persistent storage via fsync.. The etcd diagnostic tool measures disk fsync latency — the time for etcd to commit Write-Ahead Log (WAL) entries to persistent storage via fsync — because etcd's performance is bound by disk I/O on the WAL. High fsync durations directly cause slow etcd writes, leader election instability, and API server timeouts, which is why the alert fires.

Answer

The network round trip time between etcd follower and leader nodes.

Answer

The time taken by the Kubernetes API server to serialize JSON objects.

Answer

The garbage collection duration of expired etcd keys.

Question 6

An administrator wants to check the logs of the Cluster Version Operator to see why an upgrade failed. In which namespace does the CVO run?

Accepted Answer

openshift-cluster-version. The Cluster Version Operator (CVO) runs in the 'openshift-cluster-version' namespace, where it reconciles the ClusterVersion resource and manages cluster upgrades. To diagnose a failed upgrade, an administrator inspects the CVO pod logs in that namespace. This is the canonical location in OpenShift 4 for all cluster version and upgrade activity.

Answer

openshift-operator-lifecycle-manager

Answer

openshift-config-operator

Answer

kube-system

Question 7

An administrator needs to drain a worker node safely for hardware maintenance, but some pods have local emptyDir storage that would be permanently deleted. Which flag must be added to the drain command to allow eviction of these pods?

Accepted Answer

--delete-emptydir-data. The --delete-emptydir-data flag explicitly tells kubectl/oc drain that it is acceptable to evict pods that use emptyDir volumes, which are node-local and will be permanently lost. Without this flag, drain refuses to proceed and reports an error listing pods with local storage. This is the documented way to acknowledge and accept the data loss during maintenance.

Answer

--allow-local-volumes

Answer

--ignore-daemonsets=false

Answer

--force-local-storage

Question 8

An administrator wants to check the detailed configuration and current status of a specific Route named 'my-app-route'. Which command provides this?

Accepted Answer

oc describe route my-app-route. The `oc describe route my-app-route` command provides detailed configuration and current status of a specific Route, including host, path, TLS settings, and the router's admission status. It is the standard way to inspect a single OpenShift resource in depth.

Answer

oc get route my-app-route --status

Answer

oc show route my-app-route

Answer

oc adm route-status my-app-route

Question 9

The OpenShift SDN (or OVN-Kubernetes) network plugin reports a failure. The administrator needs to inspect the iptables rules on a worker node to verify packet mangling and NAT configurations. How can they view the host's iptables rules?

Accepted Answer

oc debug node/ -- chroot /host iptables-save. The `oc debug node/` command creates a privileged debug pod that runs on the target node and mounts the host's root filesystem at /host. Using `chroot /host` switches the process root into the host's filesystem, allowing the administrator to run the host's own `iptables-save` binary against the host's netfilter tables. This is the only option that actually inspects the node's kernel-level iptables rules rather than pod-level or non-existent resources.

Answer

oc logs daemonset/iptables-analyzer

Answer

oc adm diagnostics iptables

Answer

oc exec deployment/router-default -- iptables -L

Question 10

An administrator needs to verify which user account or service account they are currently logged into the OpenShift cluster with. Which command provides this information?

Accepted Answer

oc whoami. The `oc whoami` command displays the currently authenticated user, including the username and, if applicable, the service account. It queries the OpenShift API to return the identity of the current session. This is the standard way to verify the active user context in OpenShift.

Answer

oc user-info

Answer

oc auth current-user

Answer

oc get user --current

Question 11

An OpenShift cluster administrator notices that API requests are taking an excessively long time to complete. They suspect etcd database bloat due to excessive ConfigMap creations. Which etcd maintenance command can be run inside an etcd pod to reclaim storage space after compaction?

Accepted Answer

etcdctl defrag. After etcd compaction removes superseded revisions, the on-disk database file still contains the freed space until defragmentation. Running `etcdctl defrag` inside the etcd pod rewrites the data file and reclaims that storage, reducing the database size and improving API latency caused by bloat. This is the correct maintenance command to run after compaction.

Answer

etcdctl prune-storage

Answer

oc adm etcd-clean

Answer

etcdctl compact --vacuum

Question 12

An administrator receives an alert that the Cluster Monitoring Operator is degraded because Prometheus cannot scrape metrics from a custom application namespace. Where should the administrator check to verify the ServiceMonitor configuration targeting the application?

Accepted Answer

oc get servicemonitor -n . A ServiceMonitor is a custom resource that tells the Prometheus Operator which services to scrape. If Prometheus cannot scrape a custom application namespace, the first place to verify the targeting configuration is the ServiceMonitor object in that namespace. Running `oc get servicemonitor -n ` confirms whether the ServiceMonitor exists, its selector labels, and its endpoints — the most likely cause of a missing scrape target.

Answer

oc describe clusteroperator monitoring

Answer

oc logs deployment/prometheus-k8s

Answer

oc get prometheus-rules

Question 13

An administrator is troubleshooting a certificate signing request (CSR) that is stuck in the Pending state for a newly added worker node. Which command should they use to approve the pending CSR?

Accepted Answer

oc adm certificate approve . `oc adm certificate approve ` is the documented OpenShift command to approve a pending CSR, which triggers the signer controller to issue the node client certificate. It is the standard administrative action for unblocking node bootstrap. The command is idempotent and safe to re-run.

Answer

oc cluster-version approve-csr <csr-name>

Answer

oc patch csr <csr-name> --type=json -p='[{"op": "replace", "path": "/status/conditions", "value": "Approved"}]'

Answer

oc approve csr <csr-name>

Question 14

An administrator wants to check the cluster-wide resource consumption of nodes (CPU and Memory percentages). Which command provides this tabular overview?

Accepted Answer

oc adm top nodes. 'oc adm top nodes' is the OpenShift CLI command that queries the metrics subsystem and returns a tabular view of each node's CPU and memory consumption as a percentage of capacity. It is the node-level analog of 'oc adm top pods' and is the standard way to get a cluster-wide resource overview from the command line.

Answer

oc get nodes --metrics

Answer

oc cluster-capacity

Answer

oc describe nodes --usage

Question 15

An administrator is investigating pod crash loops in a namespace. Which TWO commands are most useful for gathering initial diagnostic data about the crashing pods? (Choose TWO)

Accepted Answer

oc describe pod . Option A, `oc describe pod `, is correct because it surfaces the pod's status conditions, container states (including CrashLoopBackOff and last termination reason/exit code), restart counts, and recent events from the namespace, which is exactly the initial diagnostic data needed for a crash-looping pod. Option B, `oc logs --previous`, is correct because the `--previous` flag retrieves the logs from the prior container instance, capturing the output right before the crash that triggered the restart, which is essential when the current container is not running or is repeatedly restarting. Option C, `oc adm must-gather`, is not appropriate here because it collects a broad cluster-wide diagnostic bundle and is far too heavy for initial pod-level triage. Option D, `oc rsh `, does not belong because a crash-looping pod typically has no running container to exec into, so the remote shell would fail. Option E, `oc debug node/`, is not correct because it targets node-level debugging rather than gathering initial data about the crashing pods themselves.

Answer

oc adm must-gather

Answer

oc rsh <pod-name>

Answer

oc debug node/<node-name>