EX280 Practice Questions

Question 1

What is the primary function of a MachineSet in an OpenShift 4.14 cluster running on a cloud provider?

Accepted Answer

To ensure a specified number of identical machine instances are running and healthy.. A MachineSet's primary function is to maintain a declared number of identical Machine objects (and therefore Nodes) in an OpenShift 4 cluster. It is the cloud-provider-aware controller that reconciles desired replica count with actual running instances, replacing failed or deleted machines automatically.

Answer

To load balance ingress traffic across worker nodes.

Answer

To manage persistent volume claims across storage backends.

Answer

To group cluster nodes by operating system kernel version.

Question 2

Which TWO of the following actions occur when a user is deleted from an OpenShift cluster using 'oc delete user <username>'? (Choose TWO)

Accepted Answer

The User resource object is removed from the cluster database.. Option A is correct because 'oc delete user <username>' removes the User resource object itself from etcd, the cluster's backing datastore, so the user no longer exists as an OpenShift API object. Option D is correct because deleting the User triggers revocation of that user's OAuth access tokens and refresh tokens, invalidating existing sessions so the identity can no longer authenticate. Option B is wrong because OpenShift does not write back to external identity providers; LDAP or OIDC records are managed outside the cluster and are untouched. Option C is wrong because namespaces are independent resources and are not garbage-collected when a user is deleted. Option E is wrong because RoleBindings and ClusterRoleBindings are not automatically removed; they may remain and reference a now-nonexistent user until manually cleaned up.

Answer

External identity provider records are automatically deleted from LDAP or OIDC servers.

Answer

All namespaces owned or created by the user are permanently deleted.

Answer

All RoleBindings and ClusterRoleBindings referencing the user are automatically deleted.

Question 3

An administrator observes that pods in a specific namespace are unable to resolve external domain names (e.g., www.redhat.com) while internal service resolution works perfectly. What is the most likely cause of this issue in CoreDNS configuration?

Accepted Answer

The Corefile in the cluster DNS operator configuration has incorrect or missing forward plugins for external resolvers.. CoreDNS handles all DNS resolution in OpenShift, and its behavior is driven by the Corefile managed by the DNS Operator. Internal service names resolve via the kubernetes plugin, but external names like www.redhat.com require the forward plugin pointing to upstream resolvers (e.g., /etc/resolv.conf or explicit IPs). If the forward plugin is missing or misconfigured, internal resolution still works while external lookups fail with SERVFAIL or NXDOMAIN.

Answer

The API server service is missing endpoint IPs.

Answer

NodePort range exhaustion prevents external DNS packets from traversing worker nodes.

Answer

The cluster ingress controller is blocking external UDP port 53.

Question 4

Which command is used to start a new build from an existing BuildConfig named 'frontend'?

Accepted Answer

oc start-build frontend. oc start-build frontend is the correct command to trigger a new build from an existing BuildConfig named 'frontend'. It creates a new Build object, which the build controller then executes according to the BuildConfig's strategy (Source, Docker, or Custom).

Answer

oc trigger-build frontend

Answer

oc run-build frontend

Answer

oc build frontend

Question 5

Which THREE of the following are required when configuring an OIDC identity provider?

Accepted Answer

Client Secret reference. When configuring an OIDC identity provider, the Client ID (C) is required because it uniquely identifies the relying party/application to the OpenID Provider during the authorization code flow. The Client Secret reference (A) is also required so the application can authenticate itself to the token endpoint and securely exchange the authorization code for tokens. The Issuer URL (E) is required because it identifies the OpenID Provider's metadata document (typically at /.well-known/openid-configuration), enabling discovery of endpoints such as authorization_endpoint, token_endpoint, and jwks_uri. The Htpasswd file path (B) is not part of OIDC; it belongs to HTTP Basic authentication using a local password file. The LDAP bind password (D) is also unrelated to OIDC, as it is used for LDAP directory authentication, not for OpenID Connect token exchange.

Answer

Htpasswd file path

Answer

LDAP bind password

Question 6

An administrator needs to provision a new user named 'sarah' using the HTPasswd identity provider. After updating the htpasswd file and secret, Sarah logs in successfully. What command should the administrator run to verify that OpenShift has successfully created the corresponding User object for Sarah?

Accepted Answer

oc get user sarah. When an HTPasswd identity provider authenticates a user for the first time, OpenShift automatically creates a User object whose name matches the username supplied in the htpasswd file. The correct command to confirm this is `oc get user sarah`, which queries the cluster-scoped User resource. This verifies that the identity provider successfully mapped the login to a User object.

Answer

oc get account sarah

Answer

oc get identity htp:sarah

Answer

oc describe htpasswd-user sarah

Question 7

An administrator is configuring a DeploymentConfig in OpenShift and wants to set up automated triggers for new rollouts. Which TWO trigger types are natively supported in a DeploymentConfig spec? (Choose two.)

Accepted Answer

ConfigChange. DeploymentConfigs support ConfigChange (triggering when the DeploymentConfig template changes) and ImageChange (triggering when a referenced ImageStream tag updates).

Answer

PeriodicTrigger

Answer

WebhookTrigger

Answer

GitTrigger

Question 8

You need to provide temporary scratch space for a container that shares the pod's lifetime and is cleared when the pod is deleted. Which volume type should you configure in the Pod specification?

Accepted Answer

emptyDir. An emptyDir volume is created when a pod is assigned to a node and exists for the lifetime of that pod. It is initially empty, provides scratch space for the container, and is deleted permanently when the pod is removed from the node. This exactly matches the requirement for temporary, pod-lifetime scratch space.

Answer

persistentVolumeClaim

Answer

hostPath

Answer

nfs

Question 9

You want to trigger a new build automatically whenever the base image in an ImageStream changes. What must be enabled in the BuildConfig?

Accepted Answer

ImageChange trigger. The ImageChange trigger in a BuildConfig watches a specified ImageStream tag and starts a new build whenever that tag's image digest changes. This is the mechanism used to rebuild an application automatically when its base image (e.g., a builder image or a parent image) is updated. Configuring an ImageChange trigger with the base ImageStream as the source enables this behavior.

Answer

Continuous Deployment trigger

Answer

WebHook trigger

Answer

ConfigChange trigger

Question 10

What is the purpose of the 'postCommit' hook in a BuildConfig?

Accepted Answer

To run tests on the image. The 'postCommit' hook in an OpenShift BuildConfig is designed to execute a command inside a temporary container created from the newly built image, immediately after the build completes and the image is committed. This is specifically intended for running tests, such as unit tests or integration tests, to validate the image's functionality before it is pushed or deployed. It does not notify external systems, push images, or restart deployments; those are handled by other mechanisms like webhooks, push secrets, or deployment triggers.

Answer

To notify an external system

Answer

To push the image to an external registry

Answer

To restart the Deployment

Question 11

An administrator needs to restrict ingress traffic to pods in the 'frontend' namespace so that only pods labeled role=api in the 'backend' namespace can connect on TCP port 8080. All other traffic must be denied. Which NetworkPolicy configuration achieves this?

Accepted Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web, ingress from namespaceSelector matching name=backend and podSelector matching role=api, and ports TCP 8080.. A NetworkPolicy must be created in the namespace of the pods it protects (frontend) and use podSelector to select those pods. The ingress rule must combine namespaceSelector and podSelector to allow only pods in backend with role=api, and specify the port TCP 8080. Once any policy selects the frontend pods, all other ingress is denied by default.

Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web and ingress from ipBlock 10.0.0.0/8 on TCP 8080.

Answer

A NetworkPolicy in the backend namespace with podSelector matching role=api and egress to namespaceSelector matching name=frontend and port TCP 8080.

Answer

A NetworkPolicy in the frontend namespace with podSelector matching app=web and ingress from namespaceSelector matching name=backend without specifying ports.

Question 12

An administrator notices that a worker node is in a 'NotReady' state due to a storage failure. The administrator successfully replaces the underlying physical machine and wants to clear the old node object from the OpenShift 4.14 cluster. Which command should be used?

Accepted Answer

oc delete node worker-old. To remove a node object from an OpenShift cluster, the correct command is `oc delete node <node-name>`. This deletes the Node resource from the cluster, and if the node is managed by a MachineSet, the Machine object may also be deleted or replaced. In this scenario, the administrator has already replaced the physical machine, so deleting the old node object is appropriate.

Answer

oc adm cordon worker-old --purge

Answer

oc patch machine worker-old --type=merge -p '{"spec":{"deleted":true}}'

Answer

oc remove node-status worker-old

Question 13

You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?

Accepted Answer

oc auth can-i list deployments --as=system:serviceaccount:ci-cd:cicd-bot -n ci-cd. `oc auth can-i` performs a SubjectAccessReview against the OpenShift API server, and the `--as=system:serviceaccount::` flag impersonates the service account so the answer reflects that SA's effective RBAC permissions rather than the current user's. Adding `-n ci-cd` scopes the check to the ci-cd namespace, which is required because RoleBindings are namespace-scoped. This is the canonical way to verify whether a specific SA can perform a verb on a resource.

Answer

oc adm policy who-can get deployments -n ci-cd

Answer

oc describe serviceaccount cicd-bot -n ci-cd

Answer

oc get rolebindings --serviceaccount=cicd-bot

Question 14

What is the primary difference between PersistentVolumes (PVs) and PersistentVolumeClaims (PVCs)?

Accepted Answer

PVs represent actual cluster storage resources, while PVCs represent user requests for storage.. PersistentVolumes (PVs) are cluster-level storage objects that represent the actual backing storage (NFS, iSCSI, cloud disk, etc.) provisioned by an admin or dynamically by a StorageClass. PersistentVolumeClaims (PVCs) are namespace-scoped requests from a user/pod for a certain size and access mode, which the control plane binds to a matching PV. This separation of 'supply' (PV) from 'demand' (PVC) is the core abstraction in Kubernetes/OpenShift storage.

Answer

PVs only support block mode, while PVCs only support filesystem mode.

Answer

PVs are created by developers, while PVCs are created by cluster administrators.

Answer

PVs are namespace-scoped, while PVCs are cluster-scoped.

Question 15

An OpenShift administrator needs to allow users to expand the storage capacity of existing PersistentVolumeClaims without restarting their applications. Which action must be taken first to enable this capability?

Accepted Answer

Edit the StorageClass to set allowVolumeExpansion: true.. Online volume expansion in Kubernetes/OpenShift is gated by the StorageClass field allowVolumeExpansion. Until that field is set to true on the StorageClass backing the PVC, the API server will reject any attempt to increase the PVC's requested storage, so it must be enabled first.

Answer

Restart the csi-provisioner controller deployment in the openshift-cluster-storage-operator namespace.

Answer

Add the expansion-enabled annotation directly to each active Pod object.

Answer

Convert all existing static PersistentVolumes into dynamically provisioned volumes.

Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) EX280 practice test

Three ways to study

Study EX280 by domain

Study EX280 by topic

User And RBAC Management practice questions

Troubleshooting And Diagnostics practice questions

Networking And Network Policies practice questions

Cluster Installation And Management practice questions

Security And SCC practice questions

Storage And Persistent Volumes practice questions

Application Deployment And Lifecycle practice questions

EX280 fundamentals practice questions

EX280 scenario practice questions

EX280 troubleshooting practice questions

Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) (EX280) practice questions