Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) (EX280) (EX280) — Questions 226–300

A production Deployment using the Rolling update strategy is failing its readiness probe during a rollout, causing the update to block and eventually time out. You need to inspect the reason for the rollout failure using the OpenShift CLI without deleting the failing pods immediately. Which oc command provides the most direct diagnostic information regarding the rollout status and blockage reason?

Which THREE of the following are valid build strategies supported by OpenShift BuildConfigs? (Choose three.)

You need to create a new project named 'secure-store' with a specified display name and description, and assign 'jane' as the project admin using the OpenShift CLI. Which command should you execute?

Which command-line argument can you use to change the output format of 'oc get' to YAML?

Which command allows you to view the logs of a specific build?

An administrator needs to create a Service of type ClusterIP that exposes an application running on port 8080 inside the container, mapping it to port 80 on the Service. Which command should the administrator use?

Which TWO methods can be used to populate data into a newly created PersistentVolumeClaim during provisioning?

An administrator needs to back up application data stored on an OpenShift PVC. Which object must be created to initiate the snapshot process via the CSI driver?

You need to allow a specific service account to run pods as root. Which command should you use to associate the 'privileged' SCC with the 'default' service account in the 'web-apps' namespace?

An administrator wants to view the public URL assigned to an existing Route named 'webapp'. Which oc command is best suited to extract only the host URL value?

A system administrator needs to revoke the 'admin' role from user 'bob' in the 'finance' project without deleting the project or affecting other users. Which command should be used?

Which THREE items can be inspected using 'oc describe' when troubleshooting a failing storage attachment in OpenShift?

A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?

You are using Kustomize to manage environment-specific configurations. Which file must be present in the base directory to define resources?

Which THREE pieces of data can an ImageStream reference?

A developer requests a PersistentVolumeClaim using ReadWriteMany access mode. Which default storage type in a standard AWS ODF (OpenShift Data Foundation) deployment natively supports RWX?

Which TWO commands can an administrator use to check the overall status or health of core OpenShift 4.14 cluster operators? (Choose TWO)

Which command is used to switch the active project context to a namespace named 'staging' in the OpenShift CLI?

An administrator wants to verify which CSI driver plugins are registered and active in an OpenShift cluster. Which cluster-scoped resource should they query?

An administrator is troubleshooting a failed OpenShift build. Which THREE resources or logs should the administrator check to diagnose the failure? (Choose three.)

Which command displays the current user identity and cluster context information for the logged-in OpenShift CLI session?

Which THREE commands can an administrator use to inspect existing routes in an OpenShift cluster? (Choose THREE)

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

When managing ImageStreams in OpenShift, which TWO tasks can an administrator perform using oc commands? (Choose two.)

An administrator needs to perform a graceful maintenance reboot on a worker node named worker-01 in an OpenShift 4.14 cluster without causing application downtime for stateless deployments. Which combination of actions should the administrator perform first?

You have a Helm chart that requires custom values for different environments. Which flag allows you to pass a custom values file?

An administrator creates a new project request template that includes a custom RoleBinding. However, when users create new projects, the RoleBinding fails to bind because it references a ClusterRole that does not exist in the template namespace. How are ClusterRoles referenced in project templates resolved?

Which THREE of the following commands are valid OpenShift CLI commands for managing user policies and role assignments? (Choose THREE)

A worker node's root filesystem reaches 100% capacity due to accumulated container images and logs, causing the kubelet to enter an eviction state. After freeing up disk space on the node, the administrator notices the node status remains NotReady. What action is required to clear the kubelet's node pressure condition?

An administrator wants to test network connectivity from a pod named 'app-pod-1' to a service port on 'backend-service' using TCP. Which tool is commonly available and ideal for testing TCP port connectivity inside a container?

Which TWO of the following conditions must be met for a ServiceAccount from 'namespace-a' to successfully access API resources in 'namespace-b'? (Choose TWO)

What is the primary function of a MachineSet in an OpenShift 4.14 cluster running on a cloud provider?

During etcd troubleshooting, an administrator suspects quorum loss or follower synchronization issues. Which THREE commands or etcdctl actions performed inside an etcd pod can verify etcd health and cluster state? (Choose THREE)

You need to perform a canary deployment by shifting traffic between two versions of your app. What is the standard way to accomplish this in OpenShift without using a Service Mesh?

An administrator observes that pods in a specific namespace are unable to resolve external domain names (e.g., www.redhat.com) while internal service resolution works perfectly. What is the most likely cause of this issue in CoreDNS configuration?

An administrator needs to check the status of all MachineSets in an OpenShift 4.14 cluster to see how many worker machines are currently provisioned and running. Which command should be used?

An administrator needs to create a new OpenShift build using a BuildConfig. Which TWO build strategies are natively supported out-of-the-box by OpenShift? (Choose two.)

An OpenShift cluster node is reporting High CPU and Memory pressure. Which THREE commands or tools can an administrator use to investigate resource bottlenecks on that node? (Choose THREE)

An application team reports that their application cannot connect to an external database due to a firewall blocking port 3306. The administrator wants to test network connectivity from inside a running application pod to the external database host. Which tool can they run using 'oc exec'?

An administrator wants to configure a NetworkPolicy that allows incoming traffic only from pods with the label 'role=frontend' residing in any namespace, provided those namespaces have the label 'environment=production'. How should the namespaceSelector and podSelector be combined?

A cluster administrator needs to ensure that a specific PVC can only bind to a pre-allocated PersistentVolume. How can this binding relationship be strictly enforced?

An administrator wants to use raw block storage (Block Volume Mode) rather than a mounted filesystem for a high-performance database running on OpenShift. How should the volume mode be specified in the PersistentVolumeClaim?

Which THREE restrictions or behaviors are enforced by the default restricted-v2 Security Context Constraint in OpenShift Container Platform?

An application pod is failing to write data because its mounted PersistentVolume is mounted as ReadOnly. The administrator checks the PVC definition and sees accessMode is set correctly to ReadWriteOnce. What is the most likely cause of the read-only mount?

An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?

An administrator needs to temporarily prevent the Machine Config Operator from applying pending MachineConfig changes to the worker nodes while performing troubleshooting. How should the administrator accomplish this?

Which TWO conditions will prevent a pod from successfully mounting a PersistentVolumeClaim?

A cluster administrator needs to prevent users from accidentally deleting a VolumeSnapshot while associated PVC restores or clones depend on it. What protection mechanism is active by default in OpenShift?

Which TWO actions are necessary when migrating from Htpasswd to OIDC?

Which command displays the SCCs currently assigned to a specific service account?

The cluster monitoring stack is failing because Prometheus pods in the openshift-monitoring namespace are crashing due to disk space exhaustion on the Prometheus PersistentVolume. How can the administrator inspect the current disk usage inside the Prometheus container?

An administrator wants to verify if the OpenShift cluster upgrade to version 4.14 has successfully completed for all core components. Which status field in the ClusterVersion resource should show 'True' for the progressing and available conditions?

An OpenShift cluster integrates with an LDAP server where user attribute names differ from default settings (e.g., mail instead of preferredUsername). Where are these LDAP attribute mappings configured?

An administrator needs to configure an egress IP for a specific namespace in an OVN-Kubernetes enabled OpenShift cluster so that all egress traffic originating from that namespace appears to come from a specific dedicated external IP. How is this configured?

Which TWO of the following statements regarding OpenShift Projects and Namespaces are correct? (Choose TWO)

Which TWO methods can an administrator use to view the nodes currently present in an OpenShift 4.14 cluster along with their roles and versions? (Choose TWO)

Which THREE things can you configure in a BuildConfig?

An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?

A cluster uses OVN-Kubernetes as its CNI network provider. An administrator needs to inspect the logical switches and routers created by OVN within a node. Which command-line tool inside the ovn-node pod should be used?

A container needs to run as a specific non-root UID. Which SCC field configuration is needed?

An administrator notices that pods on different worker nodes cannot communicate with each other. Upon checking the cluster network operator, it appears the MTU settings between the underlying physical network and the cluster overlay network mismatch. Which OpenShift command checks the cluster network operator status?

You are configuring an OAuth identity provider using 'htpasswd'. Which secret must contain the file?

An administrator needs to configure a BuildConfig so that whenever a new image is pushed to a dependent ImageStream tag, a new build is automatically triggered. Which trigger type must be added to the BuildConfig?

An administrator wants to modify the default kubelet parameters (such as maximum pods per core or eviction hard thresholds) across worker nodes. Which TWO steps or resources are involved in this process? (Choose TWO)

Which THREE actions can be performed using the IngressController custom resource? (Choose THREE)

An administrator wants to view the last 50 lines of logs for a pod named 'api-server-xyz' and keep the stream open for new log entries. Which command should they use?

A security engineer needs to configure the cluster-wide OAuth identity provider to use an existing LDAP server. The administrator creates an LDAP identity provider object in the cluster OAuth configuration resource (cluster). Which configuration property specifies the attribute mapping to map the LDAP entry's unique identifier to the OpenShift user name?

You are hardening a cluster. Which Pod Security Standard level is the default in OpenShift 4.14 for new projects?

Which THREE of the following components are part of the standard OpenShift Ingress architecture? (Choose THREE)

An administrator wants to configure automated remediation for worker nodes that become unresponsive or experience hardware failure. Which TWO configurations or resources are required for a MachineHealthCheck to function properly? (Choose TWO)

Which TWO tools or protocols can an administrator use to verify internal cluster DNS resolution from a pod? (Choose TWO)

An administrator notices that a worker node is in a 'NotReady' state due to a storage failure. The administrator successfully replaces the underlying physical machine and wants to clear the old node object from the OpenShift 4.14 cluster. Which command should be used?

You want to trigger a new build automatically whenever the base image in an ImageStream changes. What must be enabled in the BuildConfig?

An administrator needs to ensure that no pod in the 'secure-zone' namespace can run with root privileges or use host networking. Which mechanism natively enforces this across all pods in the namespace?

An administrator is planning an OpenShift 4.14 cluster upgrade and wants to ensure that specific safety checks and conditions are met before proceeding. Which THREE conditions must be true for an upgrade to proceed smoothly? (Choose THREE)