Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) (EX280) (EX280) — Questions 76–150

An application pod requires concurrent read and write access to the same storage volume from multiple worker nodes simultaneously. Which access mode must be specified in the PersistentVolumeClaim to satisfy this requirement?

An administrator needs to view the rollout history of a DeploymentConfig named web-frontend. Which command accomplishes this?

Which TWO of the following are valid built-in default project roles in OpenShift that can be assigned to users within a namespace? (Choose TWO)

Which namespace houses the core Cluster Version Operator (CVO) in an OpenShift 4.14 cluster?

An administrator needs to deploy a containerized web application using a Git repository as the source without writing a Dockerfile. Which OpenShift build strategy should be used?

An administrator is troubleshooting a failed cluster upgrade in OpenShift 4.14. The upgrade channel is set to 'stable-4.14', but the cluster refuses to update to the latest target version. The administrator runs 'oc get clusterversion' and notes that a specific ClusterOperator reports 'Degraded=True'. What is the recommended next step?

A cluster administrator suspects that an API rate-limiting issue is causing intermittent client timeouts. Which component logs should be inspected to confirm that clients are exceeding their API request limits?

An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?

An OVN-Kubernetes clustered OpenShift environment requires troubleshooting packet flows between namespaces. Which tool is installed on the cluster nodes that allows administrators to inspect OVN database contents and flow tables?

Which THREE actions are required when manually setting up a pre-provisioned PersistentVolume backed by an existing storage asset?

Which TWO components are core parts of the OpenShift DNS architecture for cluster resolution? (Choose TWO)

An administrator needs to collect cluster-wide diagnostic information from an OpenShift 4.14 cluster for a Red Hat support case. Which command should be executed?

When managing application lifecycles and rollouts using standard Kubernetes Deployments in OpenShift 4.14, which TWO parameters are explicitly configurable under the rollingUpdate strategy settings? (Choose two.)

An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?

An administrator needs to test DNS resolution from inside a running pod. Which command run inside a container uses the standard Linux DNS lookup utility?

When troubleshooting network policies or container connectivity in an OVN-Kubernetes environment, which THREE tools or logs are useful for diagnosing packet drops and flow issues? (Choose THREE)

What is the primary function of the Machine Config Operator (MCO) in OpenShift 4.14?

An administrator wants to inspect the ignition configuration generated for worker nodes by the Machine Config Operator. Which command or resource should the administrator examine?

Which TWO options describe characteristics of OVN-Kubernetes compared to the legacy OpenShift SDN? (Choose TWO)

An OpenShift cluster experiences severe etcd latency spikes, causing leader elections to fail. Which metric or diagnostic tool should be used to inspect etcd peer round-trip times directly from the command line within the cluster?

An administrator is configuring an OAuth identity provider and needs to map claims from an external provider to OpenShift usernames. Which field in the OAuth configuration specifies the claim to use as the username?

Which component in OpenShift is responsible for watching PersistentVolumeClaims and dynamically provisioning PersistentVolumes when supported by a StorageClass?

An administrator wants to prevent developers from creating pods that run as the root user across the entire cluster. Which OpenShift resource or admission mechanism is best suited to enforce this restriction globally?

An administrator has modified a KubeletConfig resource to adjust the pod eviction thresholds on worker nodes. After applying the change, the administrator observes that some worker nodes are updating while others belonging to a custom worker pool are not. What is the most likely reason?

An administrator is troubleshooting an Operator installed via OperatorHub whose pods are failing to pull images because the Operator's subscription namespace lacks access to the global pull secret. How can the administrator configure OLM to use a custom pull secret for an Operator in a specific namespace?

An administrator wants to verify node configuration application status. Which TWO indicators show that a MachineConfigPool has successfully finished applying a new MachineConfig? (Choose TWO)

Which TWO commands or tools can an administrator use to inspect cluster logs or events when troubleshooting node or pod issues? (Choose TWO)

An OVN-Kubernetes clustered environment requires configuring egress IP functionality for a specific namespace so that all outgoing traffic from pods in that namespace appears to originate from a designated external IP address. Which custom resource must be configured?

A DeploymentConfig in OpenShift has a Rolling strategy defined. Which parameter in the strategy configuration controls the maximum number of pods that can be created above the desired replica count during the update?

You need to ensure that a specific ServiceAccount named 'builder-sa' in the 'cicd' project can use the 'privileged' SecurityContextConstraints. Which command accomplishes this?

Which TWO namespaces are standard system namespaces in OpenShift 4.14 that contain core cluster operators and platform components? (Choose TWO)

An administrator wants to view the available recommended upgrade paths for an OpenShift 4.14 cluster from the command line. Which command should the administrator run?

An administrator needs to prune or reclaim dangling VolumeSnapshotContent objects whose parent VolumeSnapshots have already been deleted, but the reclaim policy was set incorrectly. How can this be resolved?

Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?

An administrator creates a Route with a specific hostname, but multiple Ingress controllers exist in the cluster. How does the Route know which Ingress controller should serve it?

An OpenShift cluster administrator needs to ensure that custom S2I builder images stored in an insecure internal registry can be successfully pulled by build pods without failing TLS verification. Where must the insecure registry be defined?

You need to verify whether a particular ServiceAccount in your project has permissions to read Secrets. Which command tests this authorization?

An administrator is configuring automated node remediation and scaling in OpenShift 4.14. Which THREE objects or custom resources are involved in machine management, autoscaling, and health checking? (Choose THREE)

A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?

You need to update the CA certificate used for the web console. Where is this configured?

An administrator is configuring authentication in OpenShift. Which TWO of the following identity provider types are natively supported by the OpenShift OAuth server? (Choose TWO)

An administrator needs to deploy a Helm chart into an OpenShift cluster while overriding specific chart values using a local YAML file. Which Helm CLI command should be executed?

An OpenShift administrator needs to trigger a rollback of a Deployment to its previous working revision after a failed update. Which oc command should be used?

Which access mode specifies that a volume can be mounted as read-write by a single node?

You are integrating an external LDAP identity provider. Which secret must be created to store the bind password for the LDAP server?

Which THREE fields are critical for controlling pod volume access in an SCC?

An administrator needs to inspect all StorageClasses available in an OpenShift cluster using the OpenShift CLI. Which command should be executed?

An administrator is managing service accounts and wants to understand how tokens work in OpenShift 4.14+. Which TWO statements are correct regarding ServiceAccount tokens in this version? (Choose TWO)

An administrator needs to troubleshoot an application that fails to resolve internal cluster service names. They decide to run an interactive shell inside a temporary debugging pod with DNS tools installed. Which command creates this diagnostic pod?

An administrator needs to list all persistent volume claims in the cluster that are currently stuck in the 'Pending' state. Which command can be combined with grep or custom formatting to identify them?

An administrator is analyzing a severe networking issue where pod-to-pod communication across different worker nodes fails. Which THREE diagnostic utilities or commands should they execute inside an oc debug session on the nodes? (Choose THREE)

An administrator is auditing Security Context Constraints and wants to identify which settings can be controlled within a custom SCC definition. Which THREE fields are valid configuration options inside an SCC resource? (Choose THREE)

An administrator has added a new custom worker MachineConfigPool and wants existing worker nodes to be migrated into this new pool based on specific labels. How does an administrator move a node from the default worker pool to a custom MachineConfigPool?

Which command is used to list all users who currently have the 'cluster-admin' role assigned via ClusterRoleBindings?

Which TWO authentication methods are supported by the OpenShift OAuth server?

An administrator wants to check the cluster-wide resource consumption of nodes (CPU and Memory percentages). Which command provides this tabular overview?

An application pod needs to discover other pods behind the same headless service. What characteristic defines a headless service?

Which TWO fields are mandatory when defining a standard Kubernetes NetworkPolicy object? (Choose TWO)

An administrator wants to expose a Deployment via a NodePort service. What is the default port range allocated for NodePort services in OpenShift if not explicitly configured otherwise?

A developer reports that their pod is unable to start because it cannot mount a persistent volume claim (PVC). Where should the administrator look to diagnose volume attachment issues related to the CSI driver?

You need to configure a ServiceAccount named 'app-runner' in the 'finance' namespace so that its authentication token does not automatically expire or get automatically generated as a short-lived token (in OCP 4.16+, tokens are bound to service account token volume projection). If you need to create a long-lived API token secret for this ServiceAccount manually, how should you do it?

Which THREE of the following components are involved in authenticating a user via an external OAuth identity provider in OpenShift? (Choose THREE)

You are troubleshooting project requests. A developer runs 'oc new-project test-proj' and receives an error that project requests are disabled or forbidden. Where is the global project request template or configuration managed?

An administrator wants to prevent automatic updates for an Operator installed via OLM while still allowing manual installation of new versions when desired. Which TWO actions or configurations should be performed? (Choose TWO)

A pod requires access to the hostPath volume. Which SCC field must be configured to allow this?

An administrator wants to pause rollouts on a DeploymentConfig named backend-api to make multiple configuration changes without triggering intermediate builds or rollouts. Which command pauses the rollout?

Which TWO commands are typically used to check the status of an application rollout?

A developer deploys a headless service (ClusterIP set to None) in OpenShift. What is the primary characteristic of a headless service?

An administrator needs to modify the SSH key used for debugging worker nodes across an OpenShift 4.14 cluster. Which resource type should the administrator edit or create to apply this change cluster-wide to all worker nodes?

A container inside a pod is failing with 'ImagePullBackOff'. The administrator verifies the image tag exists. What is the next most logical troubleshooting step to check authentication or registry access?

A user creates a VolumeSnapshot and notices that the resulting VolumeSnapshotContent status is marked as readyToUse: false. What is the most likely cause?

An administrator needs to configure a Deployment strategy in OpenShift. Which THREE deployment strategy types are natively supported by standard Kubernetes/OpenShift Deployments? (Choose three.)

An administrator is managing cluster machine configurations and needs to understand how Ignition configuration files are processed. Which THREE statements are correct regarding Ignition and the Machine Config Operator in OpenShift 4.14? (Choose THREE)

Which TWO of the following are valid OpenShift Service types? (Choose TWO)

You need to deploy a Node.js application from a Git repository using Source-to-Image (S2I) on OpenShift 4.14, and you want to ensure the build triggers automatically whenever a new image is pushed to the dependent base ImageStream. Which BuildConfig strategy and configuration element achieves this?