Free EX280 Practice Questions

Question 1

Only the catalogue application is unreachable; other Routes work. Its admitted edge Route forwards to the http port of Service catalogue in project retail. The Service selects the correct, Ready pods. From a diagnostic pod, HTTP to a catalogue pod's IP on port 8081 succeeds, but port 8080 refuses the connection. The pod template declares containerPort: 8081. No NetworkPolicy restricts this traffic.

The Service's port definition is:
name: http
port: 80
targetPort: 8080

The application must continue listening on 8081. Where should the port mapping be repaired?

Accepted Answer

Set targetPort: 8081 for Service catalogue's http port, retaining port: 80.

Answer

Change the Deployment's declared containerPort from 8081 to 8080, leaving the application configuration unchanged.

Answer

Change the Service's port from 80 to 8081, keeping targetPort at 8080.

Answer

Restart the ingress router pods so that they rediscover the application's listening port.

Question 2

A production Kustomize overlay generates ConfigMap checkout-settings from settings.env. Content-hash suffixes are enabled. The Deployment in the same build has an envFrom reference to checkout-settings in its pod template. An engineer changes TAX_REGION in settings.env and successfully runs oc apply -k overlays/production. Nothing else changes, and no other controller modifies the Deployment.

Why can this configuration change initiate a rollout even though the container image is unchanged?

Accepted Answer

The generated ConfigMap name changes, and Kustomize updates its reference in the Deployment's pod template.

Answer

The kubelet reloads the new environment variables and restarts the affected containers in place.

Answer

The Deployment controller watches ConfigMap data and starts a rollout when a referenced value changes.

Answer

The oc apply -k operation forces a new ReplicaSet for each Deployment, regardless of template changes.

Question 3

A vendor-supported image requires runAsUser: 0 and cannot be rebuilt. It needs neither privileged mode nor access to host namespaces or host filesystems. Its Deployment already uses service account vendor-app in project finance, but pod admission rejects UID 0. All other security requirements are satisfied. The approved SCC choices for this exception are anyuid and privileged; SCC definitions must not be modified.

Choose the authorization that admits this workload without extending the exception to other service accounts or granting unnecessary host privileges.

Accepted Answer

Grant use of the anyuid SCC to service account vendor-app in finance.

Answer

Grant use of the privileged SCC to service account vendor-app in finance.

Answer

Grant use of the anyuid SCC to all service accounts in project finance.

Answer

Grant the edit ClusterRole to vendor-app through a RoleBinding in project finance.

Question 4

An HPA controls four Ready replicas of a Deployment. Each pod has one container with a CPU request of 250m and a CPU limit of 1000m. A complete metrics sample shows that each container is using 200m of CPU. CPU is the HPA's only scaling metric. It targets average CPU utilization of 60%, with minReplicas: 2 and maxReplicas: 8. Tolerance, stabilization, and scaling-rate limits do not constrain this decision.

What replica count does the HPA calculate from this sample, before any new pods start?

Accepted Answer

6 replicas.

Answer

4 replicas.

Answer

5 replicas.

Answer

2 replicas.

Question 5

Clients can still validate the public certificate on a re-encrypt Route, but requests return HTTP 503 after the backend's certificate authority is rotated. Router diagnostics identify backend TLS certificate verification failure. A direct test to the backend succeeds when the new, approved CA bundle is supplied. The Route configuration has not changed. The router must continue presenting its existing public certificate, and both network legs must remain encrypted.

Which targeted repair restores the required trust relationship?

Accepted Answer

Update the Route's spec.tls.destinationCACertificate to trust the new backend CA.

Answer

Put the new backend CA bundle in the Route's spec.tls.caCertificate.

Answer

Replace the router's client-facing certificate with the service certificate now presented by the backend application.

Answer

Change the Route's spec.tls.termination from reencrypt to passthrough and let the backend present its certificate directly.

Question 6

You have extracted the htpasswd key from the Secret used by a working HTPasswd identity provider. The local file users.htpasswd contains twelve users, including imani. You must change only imani's password and preserve the other eleven password hashes. After editing the file, you will update the same Secret's htpasswd key in openshift-config.

Which operation belongs in this password-change procedure?

Accepted Answer

Run htpasswd -B users.htpasswd imani and enter the replacement password when prompted.

Answer

Run htpasswd -cB users.htpasswd imani to recreate the credential file.

Answer

Delete the imani User object and recreate its identity mapping.

Answer

Replace the provider's Secret with a basic-auth Secret containing imani's username and replacement password.

Question 7

A project has one ResourceQuota with this current accounting:

Resource       Used    Hard
pods           6       12
requests.cpu   2100m   4

Each proposed pod has two ordinary containers: an application requesting 400m of CPU with a limit of 1 CPU, and a log collector requesting 200m with a limit of 500m. There are no init containers, pod overhead, or additional quotas. Node capacity is sufficient, and existing quota usage will not change while these pods are admitted.

How many additional pods can be admitted, and what accounts for that result?

Accepted Answer

Three pods; both containers' CPU requests count against the remaining CPU allowance.

Answer

One pod; both containers' CPU limits are charged against the remaining requests.cpu allowance.

Answer

Four pods; only the application container's CPU request is charged for each new pod.

Answer

Six pods; available pod slots control admission until the containers actually consume CPU.

Question 8

Two Deployments in project retail consume the same ConfigMap. The api application reads TAX_REGION from an environment variable populated through configMapKeyRef when its container starts. The renderer application opens its ConfigMap-mounted settings file on every request; the volume does not use subPath.

After the ConfigMap changes, the new value is already visible in renderer's mounted file, while api's environment still contains the old value. Neither Deployment's pod template has changed. Select the minimum workload restart needed for both applications to use the new setting.

Accepted Answer

Roll out api; renderer can use the changed file without a restart.

Answer

Restart neither; wait for both configuration sources to refresh.

Answer

Roll out renderer; leave api's existing pods in place.

Answer

Roll out api and renderer to reload both sources at container startup.

Question 9

An external appliance sends a proprietary TCP protocol on port 9100. It uses neither HTTP nor TLS and cannot be modified. Inside OpenShift, Service ingest already selects Ready backend pods and maps TCP 9100 to their TCP 9100 listener. The appliance requires one externally reachable virtual IP on port 9100, not a worker-node address or node port. A functioning LoadBalancer implementation has an available address, and the external firewall permits TCP 9100.

Choose the exposure that fits this protocol and connection contract.

Accepted Answer

Change ingest to type LoadBalancer, preserving its selector, port, and targetPort.

Answer

Use NodePort for ingest and connect the appliance to a node's assigned port.

Answer

Use a passthrough Route to forward the appliance's unchanged TCP session.

Answer

Use an edge Route and point the appliance at its public hostname.

Question 10

The /live endpoint of a report engine returns HTTP 503 during initialization, which normally takes 70-110 seconds, then returns HTTP 200. Its current liveness probe checks /live every 5 seconds and restarts the container after three consecutive failures. The container therefore keeps restarting before initialization finishes. Once initialization has succeeded, operators need to retain the current sensitivity to a later process hang. No startup probe is configured.

Which probe design accommodates initialization without weakening subsequent liveness detection?

Accepted Answer

Add a startupProbe on /live with periodSeconds: 5 and failureThreshold: 30, retaining the current liveness probe.

Answer

Raise the liveness probe's failureThreshold to 30 and keep its periodSeconds at 5 for the container's entire lifetime.

Answer

Replace the liveness probe with a readiness probe using the same endpoint, period, and failure threshold.

Answer

Remove the liveness probe and rely on restartPolicy: Always to restart the container whenever its process hangs.

Free EX280 Practice Questions

Domain 1: Manage OpenShift Container Platform

Question 1

Question 2

Domain 2: Use the web console to manage and configure an OpenShift cluster

Question 3

Question 4

Domain 3: Use the command-line interface to manage and configure an OpenShift cluster

Question 5

Domain 4: Create and delete projects

Question 6

Domain 5: Locate and examine container images

Question 7

Domain 6: Identify images using tags and digests

Question 8

Domain 7: Query, format, and filter attributes of Kubernetes resources

Question 9

Domain 9: Examine resources and cluster status

Question 10

The rest of the EX280 blueprint

That's 10 of 1,030