EX280 Practice Question: An administrator is troubleshooting a deployment where pods fail to pull container images
An administrator is troubleshooting a deployment where pods fail to pull container images. Which TWO potential issues should be checked? (Choose TWO)
⚠ Common exam trap
EX280 often tests the distinction between scheduling-phase failures (PVC, node selector, taints) and runtime-phase failures (probes, routes) versus image-pull-phase failures — candidates frequently pick PVC or probe answers because they sound like generic pod problems.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The image pull secret is missing or misconfigured in the service account.
Option B is correct because image pulls from private registries require valid credentials, and if the imagePullSecret referenced by the pod's service account is missing or has wrong registry credentials, the kubelet will fail with ImagePullBackOff or ErrImagePull. Option E is correct because a typo in the image repository path or a nonexistent tag (e.g., myapp:v2 when only v1 exists) causes the registry to return a manifest-not-found error, which also surfaces as ImagePullBackOff. Option A does not belong because a Pending PVC affects volume mounting and pod scheduling, not the image pull phase. Option C does not belong because an invalid route hostname is an OpenShift networking issue affecting external access, not kubelet image retrieval. Option D does not belong because a short liveness probe timeout causes container restarts after startup, not image pull failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The PersistentVolumeClaim is stuck in Pending.
Why it's wrong here
A Pending PersistentVolumeClaim concerns storage binding and blocks pod scheduling, not image retrieval. It is tempting because Pending pods often signal storage problems, and this is the right check when pods stall before scheduling due to unavailable or unbound volumes.
- ✓
The image pull secret is missing or misconfigured in the service account.
Why this is correct
Image pulls authenticate against the registry using credentials from the pod's service account. If the referenced imagePullSecret is absent or its dockerconfigjson is malformed, the kubelet receives an authorisation failure, producing ImagePullBackOff regardless of network reachability.
- ✗
The route hostname is invalid.
Why it's wrong here
Route hostnames govern OpenShift ingress routing of external HTTP traffic to services; they play no part in a kubelet pulling an image from a registry. Checking routes is correct when external clients cannot reach a published application, not when image pulls fail.
- ✗
The liveness probe timeout is configured too short.
Why it's wrong here
A short liveness probe timeout causes containers to be restarted after they start running; it cannot prevent the kubelet from pulling an image. Probe tuning is correct when containers repeatedly restart despite successful image pulls, not when pulls themselves fail.
- ✓
The container image tag or repository path specified in the pod spec is incorrect.
Why this is correct
The kubelet resolves the exact registry, repository and tag from the pod spec. A typo in any of these, or a tag that was never pushed, yields manifest-unknown or not-found errors during the pull attempt, independent of credential configuration.
About these practice questions
Courseiva writes every EX280 question from scratch — 414 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
You might also like
Similar EX280 questions
- An administrator needs to collect cluster-wide diagnostic information from an OpenShift 4.14 cluster for a Red Hat suppo…
- An administrator suspects a pod named 'cache-0' in namespace 'data' is being evicted due to node memory pressure. They w…
- An administrator needs to list all persistent volume claims in the cluster that are currently stuck in the 'Pending' sta…
- An administrator wants to check the cluster-wide resource consumption of nodes (CPU and Memory percentages). Which comma…
- A container inside a pod is failing with 'ImagePullBackOff'. The administrator verifies the image tag exists. What is th…
Written and reviewed by Johnson Ajibi, MSc IT Security
Security Systems Architect · founder of Courseiva
Last reviewed September 2026 · checked against the official Red Hat exam blueprint
This EX280 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX280 exam.