Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) (EX280) EX280 Questions 376–450 | Page 6/7

376

Multi-Selecthard

Which THREE factors influence whether a pod requesting a storage volume can be successfully scheduled to a specific worker node when using topology-aware storage?

Select 3 answers

A.The cluster OAuth token expiration time

B.Volume accessibility constraints reported by the CSI driver

C.The number of container image layers in the pod spec

D.The volumeBindingMode set to WaitForFirstConsumer on the StorageClass

E.Node topology labels (such as failure-domain.beta.kubernetes.io/zone)

AnswersB, D, E

CSI drivers report which nodes can access specific volume topologies.

Why this answer

Topology-aware scheduling considers node topology labels, volume accessibility constraints, and availability zones matching the provisioned PV.

Full explanation →

377

MCQmedium

You are troubleshooting a BuildConfig that fails during the source clone phase due to an untrusted custom internal Certificate Authority (CA) used by your corporate Git server. Where must you configure the custom CA certificate so that the OpenShift cluster's build pods trust the Git server during S2I builds?

A.In the global cluster proxy configuration under spec.trustedCA.

B.In a ConfigMap referenced by the build.openshift.io/inject-trusted-cabundle annotation or build defaults in the cluster.

C.In the Node configuration file on each worker node under /etc/origin/node/.

D.In the imagestream spec.trust.ca field.

AnswerB

OpenShift allows injecting trusted CA bundles into build pods via a designated ConfigMap linked in the cluster configuration or build settings.

Why this answer

Configuring a configmap containing the CA certificate in the openshift-config namespace and referencing it in the cluster-wide proxy or BuildConfig config map annotations allows builds to trust internal CAs. Specifically, custom CA certificates for builds are added via a ConfigMap referenced in the build configuration or global cluster configuration.

Full explanation →

378

MCQeasy

A developer wants to inspect the generated Kubernetes manifests from a Helm chart without actually installing the chart into the OpenShift cluster. Which Helm command should be used?

A.helm dry-run my-release my-chart

B.helm template my-release my-chart

C.helm show chart my-chart

D.helm inspect values my-chart

AnswerB

helm template renders the chart locally and prints the resulting manifests.

Why this answer

The helm template command renders the chart locally and outputs the resulting manifest YAML to stdout without installing it.

Full explanation →

379

MCQmedium

An administrator wants to check why a specific MachineConfigPool is taking a long time to complete an update. Which status condition on the MachineConfigPool indicates that nodes are currently being updated?

A.Updating=True

B.RollingOut=Running

C.Reconciling=Pending

D.Progressing=Active

AnswerA

When Updating is True, the MCO is rolling out the new configuration to nodes in the pool.

Why this answer

The MachineConfigPool status includes conditions such as Updating, Updated, and Degraded. The 'Updating' condition indicates that nodes are actively applying the configuration.

Full explanation →

380

Multi-Selecthard

An OpenShift cluster upgrade has failed because a MachineConfigPool is degraded. Which THREE actions or commands can an administrator perform to diagnose the root cause of the MachineConfigPool degradation? (Choose THREE)

Select 3 answers

A.oc logs -n openshift-machine-config-operator daemonset/machine-config-daemon

B.oc scale deployment/cluster-version-operator --replicas=3

C.oc get machineconfig -l machineconfiguration.openshift.io/role=<role>

D.oc adm upgrade cancel

E.oc describe machineconfigpool <pool-name>

AnswersA, C, E

Shows execution errors when applying configs to node filesystems.

Why this answer

Describing the MCP, checking MCD pod logs on nodes, and inspecting rendered machine configs help diagnose node configuration failures.

Full explanation →

381

Multi-Selecthard

Which THREE parameters or fields are valid when configuring a StorageClass object in OpenShift 4.14+?

Select 3 answers

A.containerRuntime

B.provisioner

C.volumeBindingMode

D.nodeSelector

E.reclaimPolicy

AnswersB, C, E

provisioner specifies the CSI driver plugin.

Why this answer

Valid StorageClass fields include provisioner, reclaimPolicy, allowVolumeExpansion, and volumeBindingMode.

Full explanation →

382

Multi-Selecteasy

Which THREE network-related objects are namespaced in OpenShift? (Choose THREE)

Select 3 answers

A.ClusterNetwork

B.IngressController

C.NetworkPolicy

D.Service

E.Route

AnswersC, D, E

NetworkPolicies apply to specific namespaces.

Why this answer

Services, Routes, and NetworkPolicies are namespaced resources, whereas IngressControllers and ClusterNetworks are cluster-scoped.

Full explanation →

383

Multi-Selectmedium

Which TWO of the following are valid deployment strategies supported by OpenShift?

Select 2 answers

A.Parallel

B.Sequential

C.Recreate

D.Rolling

E.Canary

AnswersC, D

Standard strategy that replaces all pods.

Why this answer

Rolling and Recreate are the primary native strategies.

Full explanation →

384

MCQeasy

Which component in OpenShift 4.14 coordinates the creation of certificates for cluster components and worker nodes?

A.Machine API Operator

B.Kubernetes CSR controller / OpenShift PKI operators

C.Cluster Autoscaler

D.Operator Lifecycle Manager (OLM)

AnswerB

OpenShift includes automated CSR approvers and certificate controllers for cluster trust.

Why this answer

The Certificate Signing Request (CSR) controller and the Machine Config Operator / cluster-kube-apiserver-operator handle internal PKI and certificate issuance.

Full explanation →

385

MCQeasy

An application pod is failing its liveness probe and continuously restarting. Where can an administrator quickly check the reason for the liveness probe failure?

A.oc get routes

B.oc get pod <pod-name> -o json

C.oc adm diagnostics

D.oc describe pod <pod-name>

AnswerD

oc describe pod lists events such as 'Liveness probe failed: HTTP probe failed with statuscode: 500'.

Why this answer

oc describe pod displays container events, including recent liveness and readiness probe failures and exit statuses.

Full explanation →

386

MCQmedium

A pod is stuck in the 'ContainerCreating' state for an extended period. The administrator suspects a persistent volume mount timeout. Which resource events should they examine to confirm if the volume plugin is failing to attach the disk?

A.oc adm diagnostics storage

B.oc logs deployment/<deployment-name>

C.oc get pv -o json

D.oc describe pvc <pvc-name>

AnswerD

Describing the PVC shows storage provisioner events and whether attachment succeeded.

Why this answer

Describing the persistent volume claim (PVC) or the pod itself displays storage attachment events from the attach/detach controller.

Full explanation →

387

MCQhard

An OpenShift cluster node has experienced kernel panics due to a faulty third-party kernel module. The administrator needs to review the kernel crash logs (vmcore or kdump logs) stored on the node. Where are these logs typically written on a CoreOS worker node?

A./run/log/journal

B./var/lib/kubelet/pods

C./var/crash

D./var/log/audit/audit.log

AnswerC

When kdump is enabled on RHCOS, kernel core dumps are saved in /var/crash.

Why this answer

Red Hat Enterprise Linux CoreOS (RHCOS) configures kdump to write crash dumps to /var/crash when kernel panics occur.

Full explanation →

388

MCQmedium

When creating a custom SCC, what is the best practice for assigning it to users?

A.Bind the SCC to the 'cluster-admin' user

B.Bind the SCC to a specific service account in a specific namespace

C.Bind the SCC to the 'system:authenticated' group

D.Assign the SCC to the namespace object directly

AnswerB

This follows the principle of least privilege.

Why this answer

Binding the SCC to specific groups or service accounts is safer than broad cluster assignments.

Full explanation →

389

Multi-Selectmedium

An administrator needs to troubleshoot why an OLM (Operator Lifecycle Manager) managed operator installation is failing. Which THREE resources should be inspected? (Choose THREE)

Select 3 answers

A.oc get subscription <operator-name>

B.oc get installplan

C.oc get routes

D.oc get pv

E.oc get csv

AnswersA, B, E

Shows the requested operator channel and source status.

Why this answer

Checking Subscriptions, CSVs (ClusterServiceVersions), and InstallPlans diagnoses OLM operator installation issues.

Full explanation →

390

MCQhard

An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?

A.Create a dedicated ServiceAccount, a Role granting get and list on pods, and a RoleBinding linking them in the namespace

B.Bind the cluster-admin ClusterRole to the default ServiceAccount in the namespace using a ClusterRoleBinding

C.Annotate the default ServiceAccount with rbac.authorization.k8s.io/authtype: reader

D.Grant the system:openshift:scc:restricted ClusterRole to the ServiceAccount using a RoleBinding

AnswerA

This restricts the ServiceAccount permissions strictly to the namespace and specific verbs required.

Why this answer

To grant least privilege API access, create a dedicated ServiceAccount, bind a custom Role or ClusterRole with limited verbs (get, list, watch) on pods via a RoleBinding in that namespace.

Full explanation →

391

MCQhard

An administrator needs to perform an offline (disconnected) upgrade of an OpenShift 4.14 cluster where nodes have no direct internet access. Which resource must be configured in the cluster to supply the release payload images from a local mirror registry?

A.ClusterVersion mirror override parameter

B.MachineConfig registry redirection file

C.ImageContentSourcePolicy (or ImageTagMirrorSet)

D.OperatorGroup mirror setting

AnswerC

ImageContentSourcePolicy / ImageTagMirrorSet maps registry domains to local mirror registries for disconnected environments.

Why this answer

In a disconnected environment, an ImageContentSourcePolicy (or ImageTagMirrorSet in newer versions) is configured to redirect image pull requests from official repositories to a local mirror registry.

Full explanation →

392

MCQhard

An administrator is configuring topology-aware storage provisioning. A StorageClass uses volumeBindingMode: WaitForFirstConsumer. When is the PersistentVolume actually created?

A.When the scheduler places the pod referencing the PVC onto a specific worker node.

B.When the PVC object is successfully created in the namespace.

C.When the user executes 'oc adm pv create'.

D.When the CSI driver operator starts up during cluster bootstrap.

AnswerA

PV provisioning is triggered immediately following successful pod scheduling.

Why this answer

When using WaitForFirstConsumer, the PV is created only after the pod requesting the PVC has been scheduled to a specific node, ensuring topology alignment.

Full explanation →

393

MCQhard

An administrator notices that the Ingress Operator is failing to deploy routers because of a persistent validation error in the Default IngressController resource. How can the administrator inspect the exact validation schema failure reported by the operator?

A.oc logs -n openshift-ingress deployment/router-default

B.oc adm inspect router

C.oc get validatingwebhookconfigurations

D.oc describe ingresscontroller default -n openshift-ingress-operator

AnswerD

Describing the IngressController custom resource displays detailed operator status conditions and error reasons.

Why this answer

Describing the ingresscontroller custom resource in the openshift-ingress-operator namespace reveals reconciliation status errors and validation messages.

Full explanation →

394

MCQmedium

You have a private image registry that requires credentials. Where should you place the 'imagePullSecret' so that it is automatically injected into all pods created by a specific service account?

A.oc annotate sa default imagePullSecret=<secret-name>

B.oc edit namespace <ns> --add-secret=<secret-name>

C.oc set image-pull-secret <secret-name>

D.oc secrets link default <secret-name>

AnswerD

The 'oc secrets link' command attaches the pull secret to the service account.

Why this answer

Adding the imagePullSecret to the service account ensures it is used for all pods using that service account.

Full explanation →

395

Multi-Selecthard

An administrator is configuring a disconnected (air-gapped) OpenShift 4.14 cluster installation. Which THREE components or resources are critical for successfully managing container image mirroring and catalog sources in this environment? (Choose THREE)

Select 3 answers

A.OperatorGroup namespace restriction rules

B.ImageContentSourcePolicy (or ImageTagMirrorSet)

C.MachineHealthCheck remediation timeout settings

D.Local container registry mirror containing mirrored release and operator payloads

E.CatalogSource pointing to the local index image

AnswersB, D, E

Redirects image pull requests to the local mirror registry.

Why this answer

ImageContentSourcePolicy/ImageTagMirrorSet, mirror registry, and CatalogSource are essential for disconnected installations.

Full explanation →

396

Multi-Selectmedium

Which THREE conditions must be met for a NetworkPolicy to successfully allow traffic from another pod? (Choose THREE)

Select 3 answers

A.The cluster must have exactly three worker nodes.

B.The physical switch port on the top-of-rack switch must be configured in trunk mode.

C.If an ingress policy is present, the connection must be explicitly permitted by at least one rule.

D.The target port and protocol specified in the NetworkPolicy must match the traffic.

E.The source pod must match the podSelector or namespaceSelector specified in the ingress rule.

AnswersC, D, E

If a namespace has a restrictive network policy, all traffic is denied unless matched by an ingress rule.

Why this answer

Traffic must not be blocked by default namespace isolation, the source must match the ingress rule selector, and the port/protocol must match.

Full explanation →

397

MCQmedium

An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?

A.spec.endpoint.tls with base64 encoded string data

B.metadata.annotations containing openshift.io/tls-cert and openshift.io/tls-key

C.spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate

D.status.ingress.tls for automatic cert-manager synchronization

AnswerC

An edge-terminated route defines certificate, key, and optional CA certificate directly within the spec.tls object.

Why this answer

Edge termination routes configure TLS settings directly inside the spec.tls block of the Route resource.

Full explanation →

398

MCQhard

An OpenShift administrator needs to restrict access so that pods in namespace 'dev' cannot initiate any outbound connections to pods in namespace 'secure-db'. Which resource should be created in namespace 'secure-db' to achieve this?

A.A NetworkPolicy with an empty ingress rule set in namespace 'secure-db'

B.A NetworkPolicy blocking egress in namespace 'dev'

C.A ClusterNetwork policy blocking all cross-namespace traffic cluster-wide

D.An EgressFirewall object in namespace 'dev'

AnswerA

A NetworkPolicy in 'secure-db' selecting pods with an empty ingress array denies all incoming traffic from other namespaces unless explicitly allowed.

Why this answer

A NetworkPolicy with ingress rules applied in the destination namespace ('secure-db') controls which sources are allowed to connect to it.

Full explanation →

399

MCQmedium

You need to inspect the resource quota consumption and current usage status for a project named 'analytics'. Which command should you run?

A.oc describe project analytics --quotas

B.oc adm top quota -n analytics

C.oc status quota -n analytics

D.oc get quota -n analytics

AnswerD

'oc get quota' lists the resource quotas and their hard limits and current usage in the specified namespace.

Why this answer

The 'oc describe quota' or 'oc get quota' command displays current resource consumption against defined limits.

Full explanation →

400

MCQeasy

Which resource represents the physical or cloud storage provisioned in the cluster by an administrator, independent of any user namespace claims?

A.StorageClass

B.PersistentVolumeClaim

C.PodVolume

D.PersistentVolume

AnswerD

PVs are cluster-scoped storage resources.

Why this answer

A PersistentVolume (PV) represents the cluster-scoped storage resource.

Full explanation →

401

MCQhard

How do you define a health check that verifies if your application is ready to start receiving traffic?

A.ReadinessProbe

B.StartupProbe

C.LivenessProbe

D.HealthProbe

AnswerA

Readiness probes determine if the pod can accept traffic.

Why this answer

A ReadinessProbe checks if the container is ready to accept requests. If it fails, the pod is removed from service endpoints.

Full explanation →

402

MCQmedium

An administrator needs to modify the timeout values for the default OpenShift Ingress Controller (Router). Where should this change be applied?

A.Edit the proxy resource named 'cluster'.

B.Edit the ingresscontroller instance named 'default' in the 'openshift-ingress-operator' namespace.

C.Edit the endpoints resource in the 'openshift-ingress' namespace.

D.Modify the kube-apiserver configmap.

AnswerB

Timeout properties like clientTimeout and serverTimeout are fields under the IngressController CR.

Why this answer

Ingress controller parameters such as timeouts are configured by editing the IngressController custom resource in the 'openshift-ingress-controller' namespace.

Full explanation →

403

Multi-Selectmedium

Which THREE of the following are valid parameters that can be specified in a LimitRange object specification? (Choose THREE)

Select 3 answers

A.max

B.replicas

C.defaultRequest

D.min

E.clusterWideAccess

AnswersA, C, D

Defines the maximum allowed resource limit for a container or PVC.

Why this answer

LimitRanges support 'max', 'min', 'default', 'defaultRequest', and 'maxLimitRequestRatio' for resource types like Pod, Container, and PersistentVolumeClaim.

Full explanation →

404

Multi-Selectmedium

Which TWO pieces of information are needed when defining a new Helm repository?

Select 2 answers

A.Chart version

B.Username

C.Namespace

D.Repository Name

E.Repository URL

AnswersD, E

Required for naming the local repo.

Why this answer

You need the name and the URL of the repository.

Full explanation →

405

MCQhard

An administrator wants to temporarily disable a MachineHealthCheck so that node maintenance can be performed without triggering automated node deletion. How should this be done?

A.Set the MachineHealthCheck replica count to zero.

B.Delete the MachineHealthCheck custom resource during the maintenance window and recreate it afterward.

C.Stop the machine-api-operator deployment.

D.Annotate every node with 'machinehealthcheck.openshift.io/enabled=false'.

AnswerB

Deleting the MachineHealthCheck resource prevents automated remediation while performing disruptive node maintenance.

Why this answer

To disable a MachineHealthCheck, the administrator can scale its target remediation or delete the MachineHealthCheck resource, or annotate/pause it depending on implementation, but deleting or scaling spec (if supported) or deleting the MHC resource is standard practice during extended maintenance.

Full explanation →

406

Multi-Selectmedium

An administrator is diagnosing why an authentication token exchange is failing for cluster users. Which THREE sources provide relevant error logs and status information? (Choose THREE)

Select 3 answers

A.oc logs -n openshift-ingress-operator deployment/ingress-operator

B.oc logs -n openshift-kube-apiserver pod/kube-apiserver-<node-name>

C.oc get namespaces

D.oc describe clusteroperator authentication

E.oc logs -n openshift-authentication deployment/oauth-openshift

AnswersB, D, E

Shows token validation and API client request authorization errors.

Why this answer

Checking the authentication operator status, OAuth server logs, and API server request logs helps trace authentication failures.

Full explanation →

407

MCQhard

An administrator configures a LimitRange with a max CPU limit of 2 cores and max memory limit of 4Gi. A developer submits a pod specification where a container requests 3 cores of CPU. How does the OpenShift API server handle this request during admission?

A.The API server throttles the container CPU usage at runtime to 2 cores automatically.

B.The pod enters a CrashLoopBackOff state while waiting for resource allocation.

C.The API server rejects the pod creation because the container's CPU request violates the LimitRange maximum constraint.

D.The API server accepts the pod and caps the container spec value to 2 cores.

AnswerC

LimitRanges enforce maximum boundaries during admission control, causing rejection if exceeded.

Why this answer

The API server rejects the pod creation request immediately because the container resource limit exceeds the maximum allowed by the LimitRange.

Full explanation →

408

MCQmedium

You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?

A.oc auth can-i list deployments --as=system:serviceaccount:ci-cd:cicd-bot -n ci-cd

B.oc adm policy who-can get deployments -n ci-cd

C.oc describe serviceaccount cicd-bot -n ci-cd

D.oc get rolebindings --serviceaccount=cicd-bot

AnswerA

This command correctly evaluates whether the specified service account possesses permission to list deployments in the given namespace.

Why this answer

The 'oc auth can-i' command with the '--as' flag allows testing permissions as another user or service account.

Full explanation →

409

Multi-Selectmedium

Which TWO of the following can be used to troubleshoot a failing deployment?

Select 2 answers

A.oc rollout undo

B.oc describe deployment

C.oc logs

D.oc delete project

E.oc start-build

AnswersB, C

Shows status and events.

Why this answer

Describing the deployment and checking the pod logs are standard troubleshooting steps.

Full explanation →

410

Multi-Selectmedium

Which TWO of the following are valid volume modes supported by PersistentVolumes and PersistentVolumeClaims in OpenShift?

Select 2 answers

A.Object

B.Block

C.Database

D.Filesystem

E.Stream

AnswersB, D

Block mode presents the volume as a raw block device.

Why this answer

Kubernetes supports Filesystem and Block volume modes.

Full explanation →

411

MCQmedium

An OpenShift 4.14 cluster administrator has installed an Operator from OperatorHub into a custom namespace using a Subscription. The administrator notices that the Operator pod is not being created. Upon checking the Subscription, the installation mode is set to AllNamespaces, but the Operator target namespace is restricted. Which Operator Lifecycle Manager (OLM) object should the administrator inspect to troubleshoot why the CSV (ClusterServiceVersion) is not installing?

A.Check the MachineConfigPool for paused reconciliation flags.

B.Review the ClusterVersion resource status for pending updates.

C.Inspect the OperatorGroup in the target namespace to ensure its targetNamespaces match or support the Subscription scope.

D.Inspect the KubeletConfig custom resource for validation errors.

AnswerC

An OperatorGroup defines the namespace scope for OLM Operators. A mismatch prevents CSV creation.

Why this answer

When using OLM, the OperatorGroup defines the namespace scope where Operators can be installed. If the OperatorGroup does not match the Subscription's install mode, the CSV will not install.

Full explanation →

412

MCQhard

An application running in OpenShift requires scratch space that lives and dies strictly with the Pod lifecycle, but needs to be mounted from a high-performance cluster-managed storage backend rather than local ephemeral node storage. Which feature should an administrator configure?

A.HostPath volumes mapped to a local directory on the worker node

B.A standard dynamically provisioned PVC with reclaimPolicy set to Delete

C.emptyDir with medium: Memory

D.Generic ephemeral inline volumes via a volume template in the Pod specification

AnswerD

Correct. Generic ephemeral inline volumes allow you to define storage inline in the Pod spec, managing dynamic provisioning and deletion automatically alongside the Pod.

Why this answer

Generic ephemeral inline volumes allow users to specify a volume template inline within the Pod spec. This creates a dedicated PVC and PV lifecycle directly tied to the Pod lifecycle.

Full explanation →

413

Multi-Selecthard

An administrator is securing routes in an OpenShift cluster. Which THREE TLS termination types are supported natively by OpenShift Routes? (Choose THREE)

Select 3 answers

A.Passthrough

B.Edge

C.Proxy

D.FullMesh

E.Re-encrypt

AnswersA, B, E

Passthrough passes encrypted TLS traffic directly through the router to the backend pod.

Why this answer

OpenShift Routes support edge, re-encrypt, and passthrough TLS termination types.

Full explanation →

414

MCQmedium

An administrator configures a LoadBalancer service on an OpenShift cluster running on a cloud provider. However, the EXTERNAL-IP remains in a <pending> state indefinitely. What is the most likely reason?

A.The cluster is missing a valid Ingress controller deployment.

B.The cloud controller manager or cloud credentials operator is not configured to provision external load balancers.

C.The NetworkPolicy is blocking cloud provider traffic.

D.The NodePort range is exhausted.

AnswerB

Pending LoadBalancer external IPs indicate that the cloud provider integration is missing or unable to provision the resource.

Why this answer

A LoadBalancer service requires a cloud provider integration (such as an Ingress operator or cloud controller manager) to provision an external load balancer. Without proper configuration or cloud credentials, it remains pending.

Full explanation →

415

MCQmedium

An administrator needs to ensure that a newly created ServiceAccount automatically receives a long-lived API token when created in OpenShift 4.14+. What is the correct procedure?

A.Patch the default cluster authentication profile to revert to automountServiceAccountToken globally

B.Add the annotation serviceaccounts.openshift.io/want-token: "true" to the ServiceAccount metadata

C.Execute the oc create token command and store the output in a ConfigMap

D.Create a Secret of type kubernetes.io/service-account-token and reference the ServiceAccount name in the secret metadata annotations

AnswerD

Manually creating a Secret of type kubernetes.io/service-account-token with the kubernetes.io/service-account.name annotation generates a permanent token.

Why this answer

In OpenShift 4.14+, bound service account tokens are ephemeral by default. To create a legacy long-lived token, a Secret object must be explicitly created and linked to the service account.

Full explanation →

416

MCQeasy

Which field in a PersistentVolumeClaim specifies the minimum amount of storage space required by the workload?

A.spec.storageSize

B.spec.capacity.storage

C.spec.volumeSize

D.spec.resources.requests.storage

AnswerD

This is the standard path to define storage size requests in a PVC.

Why this answer

Storage requests are defined under spec.resources.requests.storage in a PVC.

Full explanation →

417

MCQeasy

Which OpenShift 4.14 command is used to uncordon a worker node and return it to a schedulable state after maintenance?

A.oc node enable

B.oc adm uncordon

C.oc adm schedulable

D.oc scale node

AnswerB

oc adm uncordon restores scheduling capability to a node.

Why this answer

The 'oc adm uncordon <node-name>' command marks a previously cordoned node as schedulable again.

Full explanation →

418

Multi-Selecthard

An administrator needs to configure secure access to a private registry for both node image pulls and OLM operator deployments. Which THREE actions or resources are required across the cluster? (Choose THREE)

Select 3 answers

A.Update the global pull secret in openshift-config/pull-secret with registry credentials.

B.Ensure CA trust certificates are distributed to nodes via ConfigMaps and image config.

C.Modify the ClusterVersion spec to disable TLS verification globally.

D.Scale the Machine API operator to zero during credential updates.

E.Configure ImageContentSourcePolicy or ImageTagMirrorSet resources for image redirection.

AnswersA, B, E

Global pull secret enables nodes to pull images from authenticated registries.

Why this answer

Configuring private registries requires updating the global pull secret, configuring ICSP/ITMS for image mirroring, and attaching pull secrets to service accounts if needed.

Full explanation →

419

MCQeasy

An administrator wants to verify if all required cluster operators are available and not degraded after an installation. Which command provides this summary?

A.oc adm cluster-status

B.oc get nodes

C.oc get pods --all-namespaces

D.oc get clusteroperators

AnswerD

oc get clusteroperators lists all core OpenShift operators and their health conditions.

Why this answer

oc get clusteroperators lists all cluster operators along with their Available, Progressing, and Degraded status conditions.

Full explanation →

420

MCQhard

An administrator needs to increase the size of an existing PVC bound to a gp3 storage class in an OpenShift cluster. What is the mandatory first step before editing the PVC spec?

A.Ensure allowVolumeExpansion: true is set on the corresponding StorageClass.

B.Manually update the underlying cloud provider disk size via the AWS console.

C.Delete the PV and recreate it with the new size.

D.Scale down all pods using the PVC to zero replicas.

AnswerA

Volume expansion will fail unless explicitly enabled on the StorageClass.

Why this answer

Before editing the PVC size, the StorageClass must have 'allowVolumeExpansion: true' configured. Otherwise, the volume expansion request will be rejected.

Full explanation →

421

MCQhard

An organization requires that specific projects created by developers automatically receive a default ResourceQuota and LimitRange. How can an administrator achieve this in OpenShift?

A.Configure the cluster-admin settings in the 'cluster' resource config map.

B.Write an admission controller webhook daemonset to inject them.

C.Use a ClusterRoleBinding with auto-provisioning flags.

D.Define a template in the 'openshift-config' namespace and reference it in the Cluster operator configuration for project requests.

AnswerD

The project request template defines objects like ResourceQuotas and LimitRanges that get automatically created in every new project.

Why this answer

Template-based project requests via the Project CR allow specifying an administrative template that is instantiated whenever a user creates a new project.

Full explanation →

422

MCQhard

When using OIDC for authentication, what does the 'issuer' field in the configuration represent?

A.The secret key for the OIDC provider

B.The client ID of the OpenShift cluster

C.The hostname of the OpenShift API

D.The URL of the OIDC provider

AnswerD

The issuer URL is required by OpenShift to verify the identity tokens.

Why this answer

The 'issuer' is the URL where the OIDC provider publishes its configuration.

Full explanation →

423

MCQeasy

An administrator wants to check the detailed configuration and current status of a specific Route named 'my-app-route'. Which command provides this?

A.oc get route my-app-route --status

B.oc describe route my-app-route

C.oc show route my-app-route

D.oc adm route-status my-app-route

AnswerB

oc describe route provides comprehensive details on route configuration and status.

Why this answer

oc describe route my-app-route displays route hostnames, TLS settings, service weights, and backend service targets.

Full explanation →

424

MCQmedium

A pod fails to start with 'container has runAsNonRoot and image will run as root'. Which SCC field needs to be adjusted in a custom SCC to allow this image to run?

A.runAsUser: MustRunAsRange

B.readOnlyRootFilesystem: false

C.runAsUser: RunAsAny

D.allowPrivilegedEscalation: true

AnswerC

RunAsAny allows the container to run as the user defined in the image, even if that user is root.

Why this answer

The runAsUser strategy in the SCC determines how the UID is handled for containers.

Full explanation →

425

MCQhard

An administrator running OpenShift 4.14 wants to configure automatic approval for an Operator subscription updates using the Operator Lifecycle Manager. Which field and value in the Subscription resource must be set?

A.Set 'spec.installPlanApproval: Automatic'

B.Set 'spec.channel.autoApprove: yes'

C.Set 'spec.autoUpgrade: true'

D.Set 'spec.approvalStrategy: Immediate'

AnswerA

The installPlanApproval field controls whether OLM automatically approves new install plans or requires manual intervention.

Why this answer

Subscriptions have an installPlanApproval field which can be set to 'Automatic' or 'Manual'. Setting it to 'Automatic' allows OLM to automatically install updates.

Full explanation →

426

MCQmedium

An administrator wants to prevent non-admin users from creating any new projects in the OpenShift cluster. How can this be accomplished?

A.Set the project request limit quota to zero globally.

B.Delete the 'cluster-admin' role from all users.

C.Delete the 'self-provisioner' ClusterRoleBinding attached to the 'system:authenticated' group.

D.Modify the OAuth configuration to reject all login requests.

AnswerC

Removing or modifying this binding stops regular authenticated users from executing project requests.

Why this answer

Removing the 'self-provisioner' cluster role binding from the 'system:authenticated' group prevents regular users from self-provisioning new projects.

Full explanation →

427

Multi-Selectmedium

Which TWO statements are true regarding Kustomize usage within OpenShift? (Choose two.)

Select 2 answers

A.Kustomize replaces the Kubernetes API server entirely during resource creation.

B.Kustomize is natively integrated into the oc command line tool using the -k flag.

C.Kustomize requires a centralized chart repository server similar to ChartMuseum.

D.Kustomize allows modifying base manifests using patches and name prefixes/suffixes.

E.Kustomize requires writing complex Go templates with conditional logic statements.

AnswersB, D

oc apply -k and oc kustomize natively support building and applying Kustomize directories.

Why this answer

Kustomize is integrated directly into the oc command-line tool via the -k flag, and it allows managing declarative resource overlays without template engines like Helm.

Full explanation →

428

MCQeasy

Which object defines the parameters used by a storage provider to take snapshots of persistent volumes in OpenShift?

A.SnapshotterConfiguration

B.StorageClass

C.VolumeSnapshotContent

D.VolumeSnapshotClass

AnswerD

VolumeSnapshotClass is the snapshot counterpart to StorageClass.

Why this answer

A VolumeSnapshotClass defines the driver and parameters (such as deletion policy) for creating volume snapshots.

Full explanation →

429

MCQeasy

Which command allows an administrator to view details, including events and current binding status, of a specific PersistentVolume named 'pv-data01'?

A.oc status pv-data01

B.oc get pv pv-data01 -o yaml

C.oc describe pv pv-data01

D.oc logs pv/pv-data01

AnswerC

oc describe provides comprehensive status and events for a PV.

Why this answer

The 'oc describe pv pv-data01' command displays detailed information and recent events for the PersistentVolume.

Full explanation →

430

Multi-Selectmedium

Which TWO volume types are considered ephemeral storage patterns native to Kubernetes and OpenShift?

Select 2 answers

A.Generic ephemeral inline volumes

B.NFS network shares

C.PersistentVolumeClaim

D.emptyDir

E.AWS EBS volumes

AnswersA, D

Inline ephemeral volumes provision storage managed directly by the pod lifecycle.

Why this answer

emptyDir and generic ephemeral inline volumes provide ephemeral storage patterns tied to pod lifecycles.

Full explanation →

431

MCQmedium

What happens to a PersistentVolume configured with reclaimPolicy: Delete when its corresponding PersistentVolumeClaim is deleted?

A.The PV object is deleted, but the underlying storage asset remains intact on the storage backend.

B.The underlying storage asset is automatically deleted from the storage backend.

C.The PV is automatically archived into an object storage bucket.

D.The PV status changes to Released and waits for administrator intervention.

AnswerB

Delete reclaim policy cleans up both the PV object and the physical storage backend asset.

Why this answer

When reclaimPolicy is Delete, deleting the PVC triggers the deletion of the underlying storage asset on the storage backend via the CSI driver.

Full explanation →

432

MCQmedium

An administrator needs to update the global pull secret for an OpenShift 4.14 cluster so that nodes can pull images from a new authenticated private registry. Which resource stores the global pull secret?

A.The MachineConfigPool resource named 'worker'.

B.The ClusterVersion custom resource spec field 'pullSecret'.

C.A Secret named 'pull-secret' in the 'openshift-config' namespace.

D.A ConfigMap named 'global-pull-registry' in 'kube-system'.

AnswerC

The cluster global pull secret is located in openshift-config/pull-secret.

Why this answer

The global pull secret is stored in a Secret named 'pull-secret' in the 'openshift-config' namespace.

Full explanation →

433

Multi-Selectmedium

An administrator needs to restrict pod creation based on Pod Security Standards namespaces. Which TWO of the following are valid Pod Security Standard levels defined by Kubernetes and supported in OpenShift? (Choose TWO)

Select 2 answers

A.hardened

B.restricted

C.baseline

D.secured

E.isolated

AnswersB, C

The restricted level provides heavily hardened security best practices.

Why this answer

Kubernetes and OpenShift support three Pod Security Standard levels: privileged, baseline, and restricted.

Full explanation →

434

MCQhard

An application pod needs to run with a specific user ID (UID 10005000) that falls outside the restricted-v2 SCC default allocated range for the namespace. The administrator decides to create a custom SCC. Which SCC security context strategy parameter must be adjusted to allow this specific UID?

A.supplementalGroups with type: RunAsAny and fsGroup set to 10005000.

B.seLinuxContext with type: MustRunAs and level set to s0:c100,c200.

C.runAsUser with type: RunAsAny or specifying the UID range in uidRanges.

D.runAsUser with type: MustRunAs and uidRange or uid settings covering the required value.

AnswerC

Configuring runAsUser to RunAsAny or including the target UID inside the uidRanges of a MustRunAsRange strategy permits the pod to run with that UID.

Why this answer

The runAsUser strategy in an SCC determines how UIDs are assigned. Setting it to MustRunAsRange with an expanded range or RunAsAny (depending on cluster security posture) allows specific UIDs.

Full explanation →

435

MCQmedium

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

A.A Secret named identity-provider in the openshift-authentication namespace

B.The cluster OAuth custom resource named cluster

C.An Authentication custom resource named cluster in the kube-system namespace

D.A ConfigMap named ldap-config in the openshift-config namespace

AnswerB

The cluster-scoped OAuth resource manages identity providers such as LDAP, HTPasswd, and OpenID Connect.

Why this answer

LDAP identity providers are configured inside the cluster-scoped OAuth custom resource under the spec.identityProviders array.

Full explanation →

436

MCQeasy

What is the primary role of Operator Lifecycle Manager (OLM) in OpenShift 4.14?

A.Managing the installation, upgrades, and RBAC lifecycle of Operators in the cluster.

B.Monitoring node CPU and memory utilization thresholds.

C.Provisioning physical bare-metal servers for cluster expansion.

D.Encrypting etcd database contents at rest.

AnswerA

OLM automates the deployment, updates, and permission management of add-on Operators.

Why this answer

OLM helps administrators install, update, and manage the lifecycle of Kubernetes native applications and Operators in their clusters.

Full explanation →

437

MCQmedium

A cluster administrator needs to inspect the current default CNI network provider configured in an OpenShift 4.14 cluster. Which command or resource should the administrator check?

A.oc get dns cluster -o jsonpath='{.spec.baseDomain}'

B.oc get proxy cluster -o jsonpath='{.spec.httpProxy}'

C.oc get clusterversion version -o jsonpath='{.status.capabilities}'

D.oc get networks.config/cluster -o jsonpath='{.spec.networkType}'

AnswerD

The networks.config cluster resource contains the global network configuration including networkType.

Why this answer

The cluster network operator configuration stores the active cluster network plugin type under spec.defaultNetwork.type.

Full explanation →

438

Multi-Selectmedium

An administrator needs to troubleshoot an upgrade failure in OpenShift 4.14. Which TWO actions or diagnostic steps should the administrator take? (Choose TWO)

Select 2 answers

A.Reboot the entire cluster control plane via physical power cycles.

B.Delete all pods in the openshift-cluster-version namespace to force a clean restart.

C.Inspect any cluster operators reporting 'Degraded=True' or 'Progressing=True'.

D.Run 'oc describe clusterversion' to view upgrade history, channels, and failure messages.

E.Scale down all OLM Operator subscriptions to zero.

AnswersC, D

Degraded operators block or fail cluster upgrades and must be investigated.

Why this answer

To troubleshoot upgrades, administrators should check clusterversion status and inspect degraded cluster operators.

Full explanation →

439

MCQeasy

Which OpenShift 4.14 operator provides a catalog of certified third-party and Red Hat operators available for cluster installation?

A.Console Operator

B.Machine API Operator

C.OperatorHub / Cluster Catalog Operator

D.Cluster Version Operator

AnswerC

OperatorHub lists available operators from CatalogSources.

Why this answer

OperatorHub is the mechanism and user interface catalog powered by the Cluster Catalog Operators where administrators discover and install operators.

Full explanation →

440

MCQmedium

An administrator is troubleshooting a certificate expiration issue that has broken communication between the kubelet and the API server. Where are the kubelet client certificates stored on a worker node that can be inspected via an oc debug session?

A./var/lib/etcd/cert

B./etc/origin/node/certificates

C./var/lib/kubelet/pki/

D./etc/kubernetes/pki

AnswerC

Kubelet TLS certificates and keys on worker nodes are managed and stored in /var/lib/kubelet/pki/.

Why this answer

Kubelet client certificates and configurations on RHCOS worker nodes are stored under /etc/kubernetes/pki or /var/lib/kubelet/pki.

Full explanation →

441

Multi-Selectmedium

Which THREE of the following are valid identity provider types supported natively in OpenShift Container Platform? (Choose THREE)

Select 3 answers

A.ActiveDirectoryDirectIdentityProvider

B.LocalDatabaseIdentityProvider

C.OpenIDConnectIdentityProvider

D.LDAPPasswordIdentityProvider

E.HTPasswdPasswordIdentityProvider

AnswersC, D, E

OpenID Connect (OIDC) is a supported identity provider type.

Why this answer

OpenShift supports multiple identity providers including HTPasswd, LDAP, OpenID Connect (OIDC), GitHub, and Keystone.

Full explanation →

442

MCQeasy

An administrator wants to prevent developers from accidentally deploying containers that request excessive CPU resources in the 'analytics' namespace. Which object should the administrator create in that namespace?

A.ResourceQuota

B.ClusterRoleBinding

C.SecurityContextConstraints

D.LimitRange

AnswerD

Correct. A LimitRange can enforce minimum and maximum constraints on resource requests and limits for individual containers or pods.

Why this answer

A LimitRange object restricts resource consumption (requests and limits) down to a per-pod or per-container basis within a specific namespace.

Full explanation →

443

MCQeasy

A developer wants to track multiple versions and tags of container images within an OpenShift cluster efficiently. Which OpenShift resource provides this capability?

A.Route

B.ImageStream

C.DeploymentConfig

D.BuildConfig

AnswerB

ImageStreams provide a mechanism for abstracting and tracking image versions and tags.

Why this answer

ImageStreams allow developers to combine and track multiple versions of container images through tags without needing to manage the raw registry image references directly.

Full explanation →

444

Multi-Selecthard

Which TWO of the following steps are required when configuring an HTPasswd identity provider in OpenShift? (Choose TWO)

Select 2 answers

A.Create a ClusterRoleBinding for all users in the htpasswd file.

B.Place the htpasswd file directly on every control plane node at '/etc/origin/master/'.

C.Restart the kube-apiserver static pods manually across all masters.

D.Create a Secret containing the htpasswd file in the 'openshift-config' namespace.

E.Update the cluster OAuth configuration resource to reference the HTPasswd identity provider and Secret.

AnswersD, E

The authentication operator requires the password file to be stored as a Secret in 'openshift-config'.

Why this answer

Configuring HTPasswd requires creating a Secret containing the htpasswd file in the 'openshift-config' namespace and referencing that Secret in the cluster OAuth configuration resource.

Full explanation →

445

MCQeasy

Which command is used to delete a PersistentVolumeClaim named 'my-app-pvc' in the current project?

A.oc remove pvc my-app-pvc

B.oc delete pvc my-app-pvc

C.oc destroy pvc my-app-pvc

D.oc prune pvc my-app-pvc

AnswerB

oc delete pvc cleanly removes the claim object.

Why this answer

The 'oc delete pvc my-app-pvc' command deletes the specified PVC.

Full explanation →

446

MCQhard

An OpenShift cluster uses a CSI driver that supports volume cloning. A user wants to clone an existing PVC named 'data-pvc' into a new PVC named 'clone-pvc'. How should the dataSource be specified?

A.dataSource: { apiGroup: "snapshot.storage.k8s.io", kind: "VolumeSnapshot", name: "data-pvc" }

B.spec.cloneSource: "data-pvc"

C.dataSource: { apiGroup: "", kind: "PersistentVolumeClaim", name: "data-pvc" }

D.spec.volumeName: "data-pvc"

AnswerC

Referencing an existing PVC as the dataSource triggers volume cloning via the CSI driver.

Why this answer

To clone a PVC, the dataSource in the new PVC must reference the existing PVC name and kind 'PersistentVolumeClaim'.

Full explanation →

447

MCQmedium

When creating a build using S2I, what does the 'assemble' script do?

A.Sets up the user environment

B.Starts the application

C.Downloads the base image

D.Builds the application artifacts

AnswerD

The assemble script performs the build steps for the application.

Why this answer

The 'assemble' script is responsible for taking the source code, building the artifacts, and installing them into the image.

Full explanation →

448

MCQmedium

When performing a 'rollout undo' on a Deployment, what is the default behavior if no revision is specified?

A.Delete the current deployment

B.Return to the state at initial deployment

C.Roll back to the previous revision

D.Roll back to revision 1

AnswerC

By default, it rolls back to the most recent previous state.

Why this answer

The 'rollout undo' command without a revision defaults to rolling back to the previous revision (revision n-1).

Full explanation →

449

Multi-Selecthard

An administrator wants to customize worker node behavior in an OpenShift 4.14 cluster using the Machine Config Operator. Which THREE custom resources are natively provided and managed by the MCO for node customization? (Choose THREE)

Select 3 answers

A.ClusterVersion

B.MachineConfig

C.KubeletConfig

D.ContainerRuntimeConfig

E.OperatorGroup

AnswersB, C, D

MachineConfig is the core MCO resource for files, ignition, and OS settings.

Why this answer

The MCO manages MachineConfig, KubeletConfig, and ContainerRuntimeConfig custom resources to configure nodes.

Full explanation →

450

MCQeasy

Which custom resource defines a group of nodes (such as all worker nodes or a custom compute pool) that share a common MachineConfig in OpenShift 4.14?

A.NodeGroup

B.MachineSet

C.MachineConfigPool

D.ConfigMap

AnswerC

MachineConfigPool groups nodes (e.g., master and worker) and tracks the application of MachineConfigs.

Why this answer

The MachineConfigPool resource groups nodes by role and coordinates applying MachineConfigs to them.

Full explanation →

Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) (EX280) (EX280) — Questions 376–450