EX280 Application Deployment And Lifecycle Practice Question
You are troubleshooting a BuildConfig that fails during the source clone phase due to an untrusted custom internal Certificate Authority (CA) used by your corporate Git server. Where must you configure the custom CA certificate so that the OpenShift cluster's build pods trust the Git server during S2I builds?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In a ConfigMap referenced by the build.openshift.io/inject-trusted-cabundle annotation or build defaults in the cluster.
Configuring a configmap containing the CA certificate in the openshift-config namespace and referencing it in the cluster-wide proxy or BuildConfig config map annotations allows builds to trust internal CAs. Specifically, custom CA certificates for builds are added via a ConfigMap referenced in the build configuration or global cluster configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
In the global cluster proxy configuration under spec.trustedCA.
Why it's wrong here
The global cluster proxy handles cluster-egress traffic routing, but S2I builds use specific build config CA configuration.
- ✓
In a ConfigMap referenced by the build.openshift.io/inject-trusted-cabundle annotation or build defaults in the cluster.
Why this is correct
OpenShift allows injecting trusted CA bundles into build pods via a designated ConfigMap linked in the cluster configuration or build settings.
- ✗
In the Node configuration file on each worker node under /etc/origin/node/.
Why it's wrong here
Node configuration files do not control container build-time trust stores directly in OpenShift 4.
- ✗
In the imagestream spec.trust.ca field.
Why it's wrong here
ImageStreams do not contain a trust.ca field.
About these practice questions
This EX280 question is part of Courseiva's 509-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Red Hat exam blueprint
This EX280 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX280 exam.