EX280 Troubleshooting And Diagnostics Practice Test 4 — 15 Questions

Question 1

An application pod is failing to write data because its mounted PersistentVolume is mounted as ReadOnly. The administrator checks the PVC definition and sees accessMode is set correctly to ReadWriteOnce. What is the most likely cause of the read-only mount?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The storage backend experienced an I/O error and remounted the block device as read-only.. Underlying storage infrastructure or CSI drivers can remount volumes as read-only when I/O errors occur or when filesystem corruption is detected on the block device.

Answer

The ServiceAccount lacks storage-admin permissions.

Answer

The namespace quota restricts write operations.

Answer

The pod security standard blocked write permissions.

Question 2

The OpenShift SDN (or OVN-Kubernetes) network plugin reports a failure. The administrator needs to inspect the iptables rules on a worker node to verify packet mangling and NAT configurations. How can they view the host's iptables rules?

Accepted Answer

oc debug node/ -- chroot /host iptables-save. Using oc debug node/ with chroot /host allows running iptables-save to inspect host network filtering rules.

Answer

oc logs daemonset/iptables-analyzer

Answer

oc adm diagnostics iptables

Answer

oc exec deployment/router-default -- iptables -L

Question 3

An administrator needs to verify which user account or service account they are currently logged into the OpenShift cluster with. Which command provides this information?

Accepted Answer

oc whoami. oc whoami returns the username of the currently authenticated user session.

Answer

oc user-info

Answer

oc auth current-user

Answer

oc get user --current

Question 4

An application pod is experiencing intermittent network drops. The administrator wants to capture network packets passing through the pod's interface for analysis. Which tool can be used inside a debugging session attached to the pod namespace?

Accepted Answer

oc debug pod/<pod-name> -- tcpdump -i any -w /tmp/packet.pcap. Using oc debug to attach to the target pod allows running tcpdump if diagnostic utilities are included in the debug container image.

Answer

oc network capture <pod-name>

Answer

oc exec pod/<pod-name> -- wireshark

Answer

oc adm tcpdump pod/<pod-name>

Question 5

An OpenShift cluster administrator notices that API requests are taking an excessively long time to complete. They suspect etcd database bloat due to excessive ConfigMap creations. Which etcd maintenance command can be run inside an etcd pod to reclaim storage space after compaction?

Accepted Answer

etcdctl defrag. Etcd requires defragmentation (etcdctl defrag) after compaction to release free space back to the file system.

Answer

etcdctl prune-storage

Answer

oc adm etcd-clean

Answer

etcdctl compact --vacuum

Question 6

An administrator receives an alert that the Cluster Monitoring Operator is degraded because Prometheus cannot scrape metrics from a custom application namespace. Where should the administrator check to verify the ServiceMonitor configuration targeting the application?

Accepted Answer

oc get servicemonitor -n <app-namespace>. ServiceMonitor custom resources define how Prometheus scrapes application endpoints, and checking their status or YAML spec is essential.

Answer

oc describe clusteroperator monitoring

Answer

oc logs deployment/prometheus-k8s

Answer

oc get prometheus-rules

Question 7

An administrator is troubleshooting a certificate signing request (CSR) that is stuck in the Pending state for a newly added worker node. Which command should they use to approve the pending CSR?

Accepted Answer

oc adm certificate approve . oc adm certificate approve is the standard command to approve kubelet client or server TLS bootstrap CSRs.

Answer

oc cluster-version approve-csr <csr-name>

Answer

oc patch csr <csr-name> --type=json -p='[{"op": "replace", "path": "/status/conditions", "value": "Approved"}]'

Answer

oc approve csr <csr-name>

Question 8

An administrator wants to check the cluster-wide resource consumption of nodes (CPU and Memory percentages). Which command provides this tabular overview?

Accepted Answer

oc adm top nodes. oc adm top nodes displays real-time CPU and memory utilization across all cluster nodes.

Answer

oc get nodes --metrics

Answer

oc cluster-capacity

Answer

oc describe nodes --usage

Question 9

An administrator is investigating pod crash loops in a namespace. Which TWO commands are most useful for gathering initial diagnostic data about the crashing pods? (Choose TWO)

Accepted Answer

oc describe pod <pod-name>. oc logs --previous and oc describe pod are the standard foundational commands for inspecting exit codes, termination reasons, and prior log output of crashing pods.

Answer

oc adm must-gather

Answer

oc rsh <pod-name>

Answer

oc debug node/<node-name>

Question 10

An administrator notices that the 'storage' ClusterOperator is degraded. Which TWO resources or logs should be inspected to diagnose the underlying CSI driver or provisioner failure? (Choose TWO)

Accepted Answer

oc describe clusteroperator storage. Inspecting the cluster operator status YAML and the logs of the cluster storage operator or CSI provisioner pods provides targeted diagnostic data.

Answer

oc logs -n openshift-apiserver deployment/openshift-apiserver

Answer

oc get routes --all-namespaces

Answer

oc describe clusterversion

Question 11

An OpenShift cluster node is reporting High CPU and Memory pressure. Which THREE commands or tools can an administrator use to investigate resource bottlenecks on that node? (Choose THREE)

Accepted Answer

oc describe node <node-name>. oc adm top nodes, oc describe node, and running top within an oc debug session on the node provide comprehensive insight into node resource consumption.

Answer

oc get events --namespace=default

Answer

oc logs deployment/cluster-version-operator

Question 12

An administrator is troubleshooting a deployment where pods fail to pull container images. Which TWO potential issues should be checked? (Choose TWO)

Accepted Answer

The image pull secret is missing or misconfigured in the service account.. Incorrect image pull secrets and invalid image tags/registry paths are the two most common causes of image pull failures.

Answer

The PersistentVolumeClaim is stuck in Pending.

Answer

The route hostname is invalid.

Answer

The liveness probe timeout is configured too short.

Question 13

An administrator needs to troubleshoot DNS resolution failures inside an application namespace. Which THREE resources or commands should they check? (Choose THREE)

Accepted Answer

oc logs -n openshift-dns -l dns.operator.openshift.io/daemonset-dns=default. Checking CoreDNS operator status, testing DNS resolution inside a debug pod, and inspecting the DNS cluster operator configuration are essential steps.

Answer

oc get machineset

Answer

oc describe ingresscontroller default

Question 14

An administrator wants to check cluster networking and SDN communication. Which TWO commands can be used to gather network-related diagnostic information? (Choose TWO)

Accepted Answer

oc get clusteroperator network. oc get clusteroperator network and inspecting OVN/SDN daemonset pod logs are key network troubleshooting steps.

Answer

oc get routes

Answer

oc adm top volume

Answer

oc describe pvc

Question 15

An administrator is diagnosing why an authentication token exchange is failing for cluster users. Which THREE sources provide relevant error logs and status information? (Choose THREE)

Accepted Answer

oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>. Checking the authentication operator status, OAuth server logs, and API server request logs helps trace authentication failures.

Answer

oc logs -n openshift-ingress-operator deployment/ingress-operator

Answer

oc get namespaces