EX280 logo
Focused certification exam prep
Start practice

EX280 Study Guide 2026: How to Pass on Your First Attempt

TL;DR
  • EX280 is a three-hour, hands-on OpenShift 4.22 assessment with product documentation supplied and no outside assistance.
  • Configurations must stay functional across the normal platform lifecycle, so fixes that need manual restoration later do not count.
  • The objective list has 64 flat entries, not 64 official domains, and no weightings are published in it.
  • The standard Red Hat exam list price is USD 500, but your regional booking cart sets the real price.

What You Are Actually Preparing For

EX280 is the Red Hat Certified System Administrator in OpenShift exam, delivered by Red Hat itself. After the May 11, 2026 framework update, the exam code stayed the same while the credential name changed from Red Hat Certified OpenShift Administrator to Red Hat Certified System Administrator in OpenShift. If you see older study material using the previous name, it is describing the same exam code, though the content may predate the current objectives.

The format is the first thing to internalize. This is not a multiple-choice test. You get a live OpenShift environment, a list of tasks, and three hours. The relevant product documentation is available inside the exam, but nobody can help you and you cannot lean on outside resources. If you are new to the exam entirely, the explainer at What Is EX280? covers the basics, and the broader EX280 Certification overview places it within Red Hat's credential family.

The lifecycle rule changes how you work: Red Hat expects your configurations and services to remain functional across the normal platform lifecycle without manual restoration. In practice, that means a change that works right now but disappears after a node restarts or a pod reschedules is a failed task. Build the habit of verifying persistence, not just immediate success.

Reading the Objective List Without Getting Lost

The detailed objective list for the current exam contains 64 entries, and it is easy to misread. Those 64 lines are a flat mix of broad headings and individual tasks, preserved in source order. Red Hat does not define 64 official exam domains, and the list does not carry percentages or weightings. Treat it as a checklist of things you must be able to do, not a blueprint that tells you how many marks each area is worth. For a full walkthrough of each entry, see EX280 Exam Domains 2026: Complete Guide to All 64 Content Areas.

A useful way to cut the list down is to group entries by what you physically do at the keyboard. Doing so reveals roughly a dozen working areas:

Working areaRepresentative objective entries
Cluster inspection and healthExamine resources and cluster status; Monitor cluster events and alerts; View logs; Assess the health of an OpenShift cluster; Troubleshoot common container, pod, and cluster events and alerts
Resource querying and imagesQuery, format, and filter attributes of Kubernetes resources; Locate and examine container images; Identify images using tags and digests
Declarative deploymentWork with resource manifests; Deploy applications from YAML resource manifests; Deploy applications using Kustomize; Work with Kustomize overlays; Deploy applications from templates and Helm charts
Configuration and secretsCreate and use secrets; Create and use configuration maps
Identity and accessConfigure the HTPasswd identity provider; Create and delete users; Create and manage groups; Modify user and group permissions
Networking and trafficCreate and edit external routes; Control cluster network ingress; Secure external and internal traffic using TLS certificates; Configure application network policies; Configure a load balancer service
Multi-tenancy controlsConfigure cluster resource quotas; Configure project quotas; Configure project limit ranges; Configure project templates
OperatorsInstall an operator; Uninstall an operator; Delete an operator
Application securityConfigure and manage service accounts; Run privileged applications; Manage and apply permissions using security context constraints
Batch workloadsDeploy jobs to perform one-time tasks; Configure Kubernetes cron jobs

One entry in the list deserves a careful read: "Be prepared to perform all tasks of a Red Hat Certified Technologist in OpenShift." This tells you the exam can reach back to foundational skills, such as working in the web console and command line, creating and deleting projects, and using the documentation. Do not skip those basics assuming they are beneath you.

Foundations to Have in Place Before You Start

Red Hat recommends RH124-level skills, DO180 and DO280 or equivalent work experience, and familiarity with containers. RHCSA is strongly recommended but not required. The full eligibility picture is in EX280 Requirements 2026: Eligibility, Prerequisites & How to Qualify.

Translate that into a self-check. Before you begin serious EX280 preparation, you should be comfortable with:

  • Linux command-line fluency, including editing files in a terminal editor without a mouse, since YAML editing is constant work.
  • Basic container concepts: images, registries, running containers, and the difference between an image and a running instance.
  • Core Kubernetes objects: pods, deployments, replica sets, services, and namespaces (which OpenShift surfaces as projects).
  • Reading and writing YAML accurately, including indentation-sensitive structures.

If any of those feel shaky, fix them first. Every later topic assumes them.

The Skill Clusters That Deserve Most of Your Lab Time

Declarative resource management

The objective list explicitly includes Declarative Resource Management, working with resource manifests, deploying from YAML, Kustomize overlays, and Helm. This is a notable emphasis: you are expected to define desired state in files rather than clicking through the console for everything.

Kustomize and Helm

Be able to deploy an application from a base manifest set, then adjust it for a different environment without copying and editing the original files.

  • Understand how a base and an overlay relate, and what an overlay can patch.
  • Practice rendering and applying a kustomization directory, then confirming the resulting objects.
  • Practice deploying from a Helm chart and from an OpenShift template, and know how each exposes parameters.
  • Practice updating a running deployment, not only creating a new one.

Authentication and authorization

The identity entries are unusually concrete: configure the HTPasswd identity provider, create and delete users, modify passwords, create and manage groups, and modify user and group permissions. Rehearse the entire chain end to end: generate the credentials file, load it into the cluster as a secret, wire up the identity provider configuration, then confirm a login works and that permissions behave as intended. Remember that deleting a user is not always the complete story, since related identity objects can linger. Know what to check.

Networking and TLS

This is the widest cluster. It spans services, routes, ingress control, TLS certificates for external and internal traffic, network policies, load balancer services, and exposing non-HTTP/SNI applications. It also includes troubleshooting software defined networking. Work through the difference between route types, practice attaching certificates, and write network policies that deny by default and then permit specific traffic. When a connection fails, practice isolating whether the problem is the service selector, the route, the policy, or the pod itself.

Quotas, limits and project templates

Developer self-service shows up as cluster resource quotas, project quotas, project resource requirements, limit ranges, and project templates. These are the tools an administrator uses to let teams create their own projects safely. Practice scenarios where a deployment fails to schedule because it violates a quota or a limit range, and learn to read the resulting events to diagnose it quickly.

Operators and security context constraints are easy to under-practice: Installing, uninstalling, and deleting an operator are separate objective entries, and security context constraints govern whether privileged applications can run at all. Both involve OpenShift-specific behavior you will not get from vanilla Kubernetes experience. Build dedicated labs for each rather than assuming general Kubernetes knowledge transfers.

Service accounts and API access

Configure and manage service accounts, run privileged applications, apply permissions through security context constraints, and give applications access to Kubernetes APIs. The logic to master: a workload runs as a service account, that account is granted a role, and the workload's security context is checked against constraints. When a pod will not start with a security-related error, you should know where to look.

Jobs and cron jobs

One-time jobs and scheduled cron jobs are listed explicitly. They are quick to practice and easy to get wrong under time pressure, particularly schedule syntax and completion behavior, so drill them until they are automatic.

Sequencing the Domains Across Your Preparation

Rather than a generic weekly plan, order your study by dependency: later topics rely on earlier ones. The following eight-week arrangement fits someone already comfortable with Linux and containers. Compress or stretch it to match your background.

Week 1

Console, CLI and inspection

  • Create and delete projects; query, format, and filter resource attributes.
  • Examine cluster status, events, alerts, and logs.
  • Locate images and distinguish tags from digests.
Week 2

Declarative deployment

  • Write and apply YAML manifests; update deployments.
  • Build a Kustomize base with overlays.
  • Deploy from a template and from a Helm chart.
Week 3

Configuration, labels and services

  • Secrets and configuration maps consumed by workloads.
  • Replica sets, labels, selectors, and services.
Week 4

Identity and access

  • HTPasswd provider end to end, users, groups, and permissions.
Week 5

Networking and TLS

  • Routes, ingress control, TLS, network policies, load balancer services, non-HTTP exposure.
Week 6

Multi-tenancy and operators

  • Quotas, limit ranges, project templates.
  • Operator install, uninstall, and deletion.
Week 7

Application security and batch work

  • Service accounts, security context constraints, privileged workloads, API access, jobs, cron jobs.
Week 8

Integrated, timed practice

  • Full three-hour sessions mixing every area, followed by a review of what slowed you down.

Troubleshooting is deliberately not given its own week. It belongs in every week: after each lab, break something on purpose and practice finding it through events, logs, and status output.

Lab Habits That Match a Hands-On Exam

Because the documentation is supplied during the exam, memorizing every flag matters less than knowing where to find the answer quickly. Practice using the documentation as part of every lab, so navigating it is second nature. Use oc explain and built-in help alongside it.

Equally important: build your own scenarios. Any practice material you use should be original rather than reconstructed from the real exam, and the same applies to labs you write for yourself. If you want structured questions to test recall of concepts, the EX280 practice test site offers original practice items, and you can compare your results against the topics in your lab notes.

Key Takeaway

After every lab, restart the affected workload or reschedule it, then confirm the configuration still works. The exam's lifecycle requirement means a task is only done when it survives a restart, not when it first succeeds.

A quick reference for rapid review near exam day is available in the EX280 Cheat Sheet 2026, and if you want a candid view of the challenge, read How Hard Is the EX280 Exam? before you commit to a timeline.

Booking, Cost, Delivery and Results

Cost

Red Hat's program-wide standard exam list price is USD 500. That is a program-level figure, not an EX280 checkout quotation, and the price shown in your regional booking cart is what controls. Check it at purchase time. The detailed breakdown is in EX280 Certification Cost 2026.

Delivery

Remote, testing-center, and classroom delivery exist, subject to availability in your booking. Remote candidates need a LiveUSB, a successful compatibility test, and the required identity and hardware checks. Run the compatibility test well ahead of your exam date, not on the morning of it. For scheduling windows, see EX280 Exam Dates 2026.

Retakes

Eligible unsuccessful first individual attempts receive one free retake under Red Hat's training policies, subject to purchase or subscription eligibility periods and scheduling restrictions. Read the policy for your specific purchase rather than assuming it applies automatically.

Results and scoring

Red Hat's exam page says results usually arrive within three U.S. business days, while the program guide allows up to five business days. Plan around the longer window. The exam page describes total scores, and the handbook also mentions objective-area feedback, but neither gives task-by-task detail, so a failed attempt will not tell you precisely which tasks you missed. For discussion of what is and is not published about scoring, see EX280 Passing Score 2026, and for what the available data does and does not show, EX280 Pass Rate 2026.

Confirm your exam version: Multiple exam versions are in use, and Red Hat's own course pages show a version discrepancy: the DO280 page references OpenShift 4.22 while the DO281 course-with-exam page still specifies 4.18. Course pages describe preparation curriculum, not weighted exam blueprints. Check the version designated in your booking or LMS and practice on a matching cluster release where you can.

After You Pass: Renewal and Next Steps

Certifications are current for three years. You can renew before expiry by retaking the original exam or by earning a qualifying same-level or higher-level credential under the current framework. If you hold a credential from before the May 11, 2026 framework, the FAQ says updated renewal and mapping rules apply to your active transcript once you pass a new exam after that date. Note that Red Hat's older renewal page still uses legacy non-expiring terminology, so rely on the current handbook, the dated framework, and your active transcript rather than that page alone.

EX280 combined with EX380 forms the Red Hat Certified Engineer in OpenShift path. That is a progression, not a reason to study EX380 content for this exam, so keep your preparation scoped to the EX280 objectives.

On the career side, evidence for salary and hiring outcomes should be treated carefully, since no certification guarantees earnings or employment. For market context, see EX280 Salary Guide 2026, EX280 Jobs, and Is the EX280 Certification Worth It?. When you are ready to test yourself against original questions, return to the main practice test site.

Frequently Asked Questions

What format is the EX280 exam?

It is a three-hour, hands-on assessment on OpenShift 4.22. You complete tasks in a live environment with relevant product documentation supplied and no outside assistance.

Does EX280 have 64 official domains?

No. The detailed objective list has 64 flat entries mixing broad headings and individual tasks. Red Hat does not define 64 official domains, and the list carries no percentages or weightings.

Do I need RHCSA before taking EX280?

RHCSA is strongly recommended but not required. Red Hat also recommends RH124-level skills, DO180 and DO280 or equivalent experience, and familiarity with containers.

What happens if I fail my first attempt?

Eligible unsuccessful first individual attempts receive one free retake under Red Hat's training policies, subject to purchase or subscription eligibility periods and scheduling restrictions.

How long is the certification valid?

Certifications are current for three years. Renew before expiry through the original exam or a qualifying same-level or higher-level credential, and check your active transcript for current rules.

Ready to pass your EX280 exam?

Put this into practice with free EX280 questions across every exam domain.