Networking And Network Policies

An administrator notices that Ingress controller logs show frequent health check failures for backend pods. Where can the administrator check or configure the liveness and readiness probes that dictate pod health for service endpoints?

A service of type NodePort has been created in OpenShift. Within what default port range are NodePort services typically allocated on the worker nodes?

An OpenShift administrator needs to restrict external access to a specific application Route by limiting access to a predefined list of allowed client IP addresses. How can this be accomplished?

An administrator must configure a NetworkPolicy in the 'secure-zone' namespace to explicitly deny all ingress traffic except for TCP traffic coming from pods labeled 'tier=frontend' in the 'frontend-zone' namespace. Which NetworkPolicy specification achieves this?

An administrator troubleshoots a failing NetworkPolicy and wants to verify if the OpenShift SDN or OVN-Kubernetes controller has successfully applied the rules. Where are the controller operator logs examined?

A developer wants to expose an application using a secure Route that terminates TLS on the pod itself, avoiding decryption at the router layer. Which TLS termination type should be selected?

An administrator needs to expose an internal application running on port 8080 via an OpenShift Route using edge termination. Which object configuration correctly defines this Route?

An administrator needs to create a service that exposes an application externally via an IP address allocated from an external cloud provider load balancer. Which service type must be used?

An administrator needs to modify the default Ingress controller configuration to change its replica count and adjust the router deployment parameters. Which resource should the administrator edit?

An OVN-Kubernetes clustered OpenShift environment requires troubleshooting packet flows between namespaces. Which tool is installed on the cluster nodes that allows administrators to inspect OVN database contents and flow tables?

Which TWO components are core parts of the OpenShift DNS architecture for cluster resolution? (Choose TWO)

An application pod in OpenShift needs to determine its own IP address and the cluster DNS servers dynamically. Where does CoreDNS look or how are pods configured to resolve cluster DNS?

An administrator needs to test DNS resolution from inside a running pod. Which command run inside a container uses the standard Linux DNS lookup utility?

When troubleshooting network policies or container connectivity in an OVN-Kubernetes environment, which THREE tools or logs are useful for diagnosing packet drops and flow issues? (Choose THREE)

Which TWO options describe characteristics of OVN-Kubernetes compared to the legacy OpenShift SDN? (Choose TWO)

An OVN-Kubernetes clustered environment requires configuring egress IP functionality for a specific namespace so that all outgoing traffic from pods in that namespace appears to originate from a designated external IP address. Which custom resource must be configured?

An administrator creates a Route with a specific hostname, but multiple Ingress controllers exist in the cluster. How does the Route know which Ingress controller should serve it?

An application pod needs to discover other pods behind the same headless service. What characteristic defines a headless service?

Which TWO fields are mandatory when defining a standard Kubernetes NetworkPolicy object? (Choose TWO)

An administrator wants to expose a Deployment via a NodePort service. What is the default port range allocated for NodePort services in OpenShift if not explicitly configured otherwise?

A developer deploys a headless service (ClusterIP set to None) in OpenShift. What is the primary characteristic of a headless service?

Which TWO of the following are valid OpenShift Service types? (Choose TWO)

An administrator needs to list all Services across all namespaces in the OpenShift cluster. Which command should be used?

An administrator needs to test internal cluster DNS resolution from a temporary troubleshooting pod. Which command creates a temporary pod with the 'dig' utility installed for DNS debugging?

Which TWO statements are true regarding OpenShift Services of type LoadBalancer? (Choose TWO)

An OpenShift administrator needs to inspect how OVN-Kubernetes handles network flows and packet drops on a specific node. Which debugging utility installed in the OVN node container is most effective for viewing OpenFlow rules?

An administrator needs to delete a Service named 'old-service' in the 'test' namespace. Which command accomplishes this?

Which TWO options are valid methods to check service endpoints in OpenShift? (Choose TWO)

An administrator configures an EgressFirewall in a namespace to deny all external traffic except for a specific CIDR block. In what order are the rules in an EgressFirewall evaluated?

Which TWO commands are used to check the health and status of the cluster networking operator? (Choose TWO)

An OpenShift cluster is configured with a custom Cluster Network CIDR. An administrator needs to verify the cluster network subnet settings and host subnet assignments. Which operator status or configuration resource contains this cluster-wide network configuration?

An administrator needs to expose an existing deployment using a quick command without writing a YAML manifest. Which command exposes port 8080 of a deployment named 'my-app' as a Service?

When configuring a NetworkPolicy in OpenShift, which THREE options represent valid components or fields within a NetworkPolicy specification? (Choose THREE)

An administrator needs to create a Service of type ClusterIP that exposes an application running on port 8080 inside the container, mapping it to port 80 on the Service. Which command should the administrator use?

An administrator wants to view the public URL assigned to an existing Route named 'webapp'. Which oc command is best suited to extract only the host URL value?

Which THREE commands can an administrator use to inspect existing routes in an OpenShift cluster? (Choose THREE)

An administrator wants to test network connectivity from a pod named 'app-pod-1' to a service port on 'backend-service' using TCP. Which tool is commonly available and ideal for testing TCP port connectivity inside a container?

An administrator observes that pods in a specific namespace are unable to resolve external domain names (e.g., www.redhat.com) while internal service resolution works perfectly. What is the most likely cause of this issue in CoreDNS configuration?

An administrator wants to configure a NetworkPolicy that allows incoming traffic only from pods with the label 'role=frontend' residing in any namespace, provided those namespaces have the label 'environment=production'. How should the namespaceSelector and podSelector be combined?

An administrator needs to configure an egress IP for a specific namespace in an OVN-Kubernetes enabled OpenShift cluster so that all egress traffic originating from that namespace appears to come from a specific dedicated external IP. How is this configured?

A cluster uses OVN-Kubernetes as its CNI network provider. An administrator needs to inspect the logical switches and routers created by OVN within a node. Which command-line tool inside the ovn-node pod should be used?

An administrator notices that pods on different worker nodes cannot communicate with each other. Upon checking the cluster network operator, it appears the MTU settings between the underlying physical network and the cluster overlay network mismatch. Which OpenShift command checks the cluster network operator status?

Which THREE actions can be performed using the IngressController custom resource? (Choose THREE)

Which THREE of the following components are part of the standard OpenShift Ingress architecture? (Choose THREE)

Which TWO tools or protocols can an administrator use to verify internal cluster DNS resolution from a pod? (Choose TWO)

An administrator created a Route but external clients receive a 503 Service Unavailable error when attempting to access it. Upon checking the endpoints of the Service referenced by the Route, the administrator discovers there are zero endpoints listed. What is the most likely cause?

An administrator wants to check the status of all cluster operators, specifically verifying that the Network and DNS operators are healthy. Which command should be run?

An administrator needs to configure a Route that handles encrypted communication both from the client to the router AND from the router to the backend pod. Which termination type is required?

An administrator configures an Ingress resource in the 'web-apps' namespace to route traffic using the default OpenShift Ingress controller. The Ingress creation succeeds, but traffic to the hostname returns a 404 error. What is a common reason for this behavior in OpenShift?

Which THREE actions can be performed when managing Route objects in OpenShift? (Choose THREE)

Which TWO methods can an administrator use to troubleshoot why a pod cannot connect to a remote Service? (Choose TWO)

An administrator notices that client source IP addresses are lost when traffic hits a Service of type NodePort, appearing instead as a node IP. Which field in the Service specification should be changed to 'Local' to preserve client source IPs?

An administrator needs to create a passthrough Route that preserves client certificates and forwards encrypted traffic directly to the backend pod. Which spec configuration is required?

An administrator needs to check the internal DNS resolution of a service named 'backend' within the 'production' namespace from a debug pod. Which DNS name is fully qualified and valid within the cluster?

An administrator needs to configure cluster-wide DNS forwarding for a specific custom domain (e.g., 'corp.local') to point to internal corporate DNS servers. Where is this configured in OpenShift 4.14?

Which THREE network-related objects are namespaced in OpenShift? (Choose THREE)

Which THREE conditions must be met for a NetworkPolicy to successfully allow traffic from another pod? (Choose THREE)

An OpenShift administrator needs to restrict access so that pods in namespace 'dev' cannot initiate any outbound connections to pods in namespace 'secure-db'. Which resource should be created in namespace 'secure-db' to achieve this?

An administrator needs to modify the timeout values for the default OpenShift Ingress Controller (Router). Where should this change be applied?

An administrator configures a LoadBalancer service on an OpenShift cluster running on a cloud provider. However, the EXTERNAL-IP remains in a <pending> state indefinitely. What is the most likely reason?

A cluster administrator needs to inspect the current default CNI network provider configured in an OpenShift 4.14 cluster. Which command or resource should the administrator check?

Which THREE troubleshooting steps should an administrator take when a newly created Route fails to resolve or connect? (Choose THREE)

An administrator needs to create a Route that handles multiple subdomains or redirects insecure HTTP traffic to HTTPS automatically. Where is the insecure traffic redirect configured?

An administrator needs to configure a custom default certificate for all routes created in the cluster without specifying a certificate on every individual Route object. Where should this wildcard certificate be configured?

Which THREE statements are true regarding Ingress controllers in OpenShift? (Choose THREE)

An administrator creates a NetworkPolicy that restricts egress traffic from a namespace. However, DNS resolution for external services immediately stops working. What is the cause of this behavior?

A cluster administrator notices that a NetworkPolicy applied to the database namespace is dropping traffic from the frontend namespace. The policy uses namespaceSelector. Which label must be present on the frontend namespace for traffic to be successfully allowed?

An OpenShift administrator needs to expose an internal web application securely using a Route that terminates TLS at the router. Which Route type and configuration requires the administrator to provide the certificate, private key, and CA certificate?

Which TWO of the following are valid Service types supported natively in OpenShift? (Choose TWO)

A developer reports that pods in the namespace 'project-a' cannot resolve services located in the namespace 'project-b' using standard internal DNS names. What is the correct way to query 'project-b' service 'backend' from 'project-a'?

Which THREE parameters can be configured within the cluster DNS operator resource (dns.operator/default)? (Choose THREE)