Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) (EX280) (EX280) — Questions 451–509

Which THREE troubleshooting steps should an administrator take when a newly created Route fails to resolve or connect? (Choose THREE)

Which THREE actions occur when a PersistentVolumeClaim with reclaimPolicy: Delete is deleted by a user?

Which TWO security standards are natively tracked in OpenShift?

Which SCC is assigned by default to authenticated users who are not service accounts?

A developer needs to restore a previously captured VolumeSnapshot into a new PersistentVolumeClaim to revert application state. What key field must be specified in the new PVC definition to initiate the restore operation from the snapshot?

Which tool would you use to package an application including its dependencies and configuration for easy distribution in OpenShift?

A cluster administrator has deleted a PersistentVolumeClaim, but the underlying PersistentVolume still exists in the cluster with a Released status and its data remains intact on the storage backend. What is the most likely cause of this behavior?

An administrator wants to apply kernel arguments to all worker nodes in an OpenShift 4.14 cluster using the Machine Config Operator. After creating a new MachineConfig object, the administrator notices that the worker nodes are not updating and the MachineConfigPool status shows 'Updating=False'. What is the most likely cause?

A user creates a PVC, but the storage backend fails to provision the volume. Where can the administrator look to find detailed error messages emitted by the external provisioner controller?

An administrator is reviewing the default Security Context Constraints in OpenShift 4.14+. Which THREE of the following SCCs are built-in and provided out-of-the-box by OpenShift? (Choose THREE)

An OpenShift cluster experiences intermittent API server timeouts. Which THREE log sources or diagnostic commands should an administrator analyze to identify API server performance bottlenecks? (Choose THREE)

Which OpenShift CLI command is used to display all PersistentVolumeClaims in the current project along with their bound PersistentVolumes and storage classes?

A cluster operator is reviewing the volume snapshot implementation in an OpenShift 4.14 environment. Which THREE components or resources are required to successfully perform and manage volume snapshots? (Choose THREE)

An administrator is configuring Operator subscriptions in OpenShift 4.14 using OLM. Which THREE parameters can be configured within a Subscription custom resource? (Choose THREE)

A stateful application needs its PersistentVolume to be bound only after the pod requesting it is assigned to a specific worker node, to avoid topology mismatch issues. Which StorageClass parameter achieves this?

An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?

An administrator needs to create a Route that handles multiple subdomains or redirects insecure HTTP traffic to HTTPS automatically. Where is the insecure traffic redirect configured?

An administrator needs to set a default StorageClass for the entire OpenShift cluster so that PVCs without a storageClassName specified automatically use it. How is this configured?

An administrator is troubleshooting a certificate signing request (CSR) that is stuck in the Pending state for a newly added worker node. Which command should they use to approve the pending CSR?

An administrator needs to configure a custom default certificate for all routes created in the cluster without specifying a certificate on every individual Route object. Where should this wildcard certificate be configured?

Which TWO actions are required when configuring an external OpenID Connect (OIDC) identity provider in OpenShift Container Platform?

Which TWO of the following methods can an administrator use to inspect existing RoleBindings within a project named 'app-namespace'? (Choose TWO)

The OpenShift SDN (or OVN-Kubernetes) network plugin reports a failure. The administrator needs to inspect the iptables rules on a worker node to verify packet mangling and NAT configurations. How can they view the host's iptables rules?

A developer deploys a custom application pod that requires the hostIPC capability, but the pod creation is rejected by the apiserver. Upon inspecting the cluster SCCs, the administrator determines that the application uses a ServiceAccount named app-sa in the production namespace. How should the administrator grant the restricted SCC privileges safely without compromising cluster security?

Which THREE items are required to successfully deploy a basic application using S2I?

An administrator wants to add a custom CA certificate trust bundle to all worker nodes in an OpenShift 4.14 cluster so that internal container registries can be accessed securely. Which object should the administrator configure?

A cluster administrator notices that a PVC stuck in the Pending state references a StorageClass with volumeBindingMode set to WaitForFirstConsumer. What action will cause the PVC to bind?

An administrator notices that a node is marked as 'SchedulingDisabled' (Cordoned). Which command should be executed to allow pods to be scheduled on this node again?

Which command removes an SCC from a service account?

Which TWO of the following characteristics apply to OpenShift SecurityContextConstraints (SCCs)? (Choose TWO)

An application pod is running, but HTTP requests to the service are returning '502 Bad Gateway'. The administrator wants to check if the endpoints controller has populated the Service with active pod IP addresses. Which command verifies this?

An OpenShift cluster operator is stuck in a Progressing state during an update. Which THREE diagnostic steps help determine why the operator reconciliation loop is blocked? (Choose THREE)

Which THREE statements are true regarding Ingress controllers in OpenShift? (Choose THREE)

Which TWO files or directories are commonly configured or injected via MachineConfig objects for node customization? (Choose TWO)

An administrator is troubleshooting a failing MachineConfig update in an OpenShift cluster. The MachineConfigPool 'worker' is degraded and reports that a node is failing to apply the rendered-worker configuration. Which log stream is critical for determining why the Machine Config Daemon failed to update system files on the target node?

An administrator creates a NetworkPolicy that restricts egress traffic from a namespace. However, DNS resolution for external services immediately stops working. What is the cause of this behavior?

An administrator needs to configure resource requests and limits such that any pod created without explicit CPU requests in the 'web-tier' namespace automatically gets assigned a default CPU request of 200m and a default CPU limit of 500m. Which object achieves this?

Which OpenShift 4.14 command allows an administrator to gather cluster-wide diagnostic logs and configuration data for support cases?

A cluster administrator needs to grant a Deployment in the production namespace permission to pull images from a private container registry. The image pull secret is named my-registry-secret. Which step must be performed so that pods created by this Deployment can successfully pull the image?

An administrator notices that a node has been automatically cordoned and drained by the cluster. Which THREE places should the administrator inspect to find the reason for the node eviction or failure? (Choose THREE)

A cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?

Which TWO methods can administrators use to access the OpenShift 4.14 web console or CLI for cluster management? (Choose TWO)

An OpenShift administrator needs to expose an internal web application securely using a Route that terminates TLS at the router. Which Route type and configuration requires the administrator to provide the certificate, private key, and CA certificate?

Which TWO of the following are valid Service types supported natively in OpenShift? (Choose TWO)

A developer reports that pods in the namespace 'project-a' cannot resolve services located in the namespace 'project-b' using standard internal DNS names. What is the correct way to query 'project-b' service 'backend' from 'project-a'?

You need to provide temporary scratch space for a container that shares the pod's lifetime and is cleared when the pod is deleted. Which volume type should you configure in the Pod specification?

You have modified a set of Kubernetes manifests using Kustomize and want to preview the exact output that will be applied to your OpenShift cluster without actually executing the changes. Which command should you run?

An OpenShift administrator needs to investigate a pod that is failing with an 'OOMKilled' exit code. Which command reveals the memory limit configuration and historical usage right before the crash?

You want to automate the application lifecycle so that every time a code change is pushed, the build and deployment occur automatically. Which combination of features should you use?

What is the result of using a 'Recreate' strategy during a deployment?

You need to terminate TLS for a route using a custom certificate. Which object must contain the TLS key and certificate?

An administrator is configuring a ResourceQuota named 'quota-dev' in the 'development' namespace. Which TWO of the following resource types can be directly tracked and limited by this ResourceQuota? (Choose TWO)

A cluster administrator wishes to enforce the restricted Pod Security Standard across an entire namespace named auditing-ns. Which label should the administrator apply to the namespace to enforce this policy while generating audit warnings for non-compliant pods?

Which TWO things must be configured to use a Private Image Registry?

What is the purpose of the 'oc adm drain' command during cluster maintenance?

An OpenShift cluster administrator receives an alert that etcd disk fsync durations are excessively high. Which performance metric is the etcd diagnostic tool measuring when evaluating disk latency?

Which TWO of the following commands can an administrator use to verify the identity and permissions of the currently logged-in user? (Choose TWO)

Which THREE parameters can be configured within the cluster DNS operator resource (dns.operator/default)? (Choose THREE)

An administrator expands a PVC from 10Gi to 50Gi. The underlying cloud storage volume is successfully resized, but inside the running pod, 'df -h' still reports the size as 10Gi. What is the most likely reason?