EX380 RedHat Red Hat Certified Specialist in OpenShift Automation and Integration Free Practice Exam Questions (2026 Updated)

Create the schedule

velero schedule create orders-daily \

--schedule "0 1 * * *" \

--include-namespaces orders \

--snapshot-volumes

Cron format: minute hour day month weekday.

Verify schedule exists

velero schedule get

Confirm backups are created by the schedule

velero backup get | grep orders-daily

Scheduled backups usually have names derived from the schedule.

==========

Annotate the namespace with default tolerations

oc annotate ns payments \

scheduler.alpha.kubernetes.io/defaultTolerations='[{"key":"dedicated","operator":"Equal","value":"payments","effect":"NoSchedule"}]' \

--overwrite

Some clusters honor this pattern; if not, the fallback is mutating admission or editing workloads.

Create a new pod/deployment in the namespace

Then verify its spec includes tolerations:

oc -n payments get pod < pod > -o yaml | grep -n tolerations -A5

==========

Step 1: Ensure the certificate file rhds_ca.crt is available in your current working directory or use the correct path.

The Task requires creating a configmap from this CA certificate file.

Step 2: Run the command:

oc create configmap rhds-ca-config-map --from-file ca.crt=rhds_ca.crt -n openshift-config

Step 3: Confirm the configmap is created.

The lab output shows:

configmap/rhds-ca-config-map created

Detailed explanation:

This creates a configmap named rhds-ca-config-map in the openshift-config namespace and maps the local file rhds_ca.crt to the key name ca.crt inside the configmap. This is important in external identity integration because OpenShift may need to trust a custom certificate authority when communicating with LDAP or another secured external service. By placing the certificate in a configmap, the authentication operator or related cluster configuration can reference it cleanly. The key name matters because many OpenShift resources expect a CA bundle key with a specific filename-like convention. If the file path is wrong, the command fails immediately. If the configmap name or key mapping is wrong, the authentication provider referencing it may not trust the external endpoint.

============

Create a namespace for the sync job

oc new-project id-sync

Keeps the automation components organized.

Create a service account for the sync job

oc -n id-sync create sa group-sync

CronJob runs under this SA identity.

Grant cluster permissions to manage groups

oc adm policy add-cluster-role-to-user cluster-admin system:serviceaccount:id-sync:group-sync

In real environments you should scope down, but lab Task SIMULATIONs often accept cluster-admin for speed.

Create a ConfigMap for groupsync.yaml and Secret(s) for bind password/CA

Mount them into the job container.

Create CronJob to run group sync

Command inside job:

oc adm groups sync --sync-config=/config/groupsync.yaml --confirm

The CronJob ensures periodic reconciliation with LDAP.

Verify job runs

oc -n id-sync get cronjob

oc -n id-sync get jobs

oc -n id-sync logs job/ < job-name >

==========

Step 1: Open a terminal with oc access to the cluster.

This Task is CLI-driven and targets the openshift-config namespace.

Step 2: Run the command:

oc create secret generic rhds-ldap-secret --from-literal bindPassword=redhatocp -n openshift-config

Step 3: Verify that the secret is created successfully.

The lab output shows:

secret/rhds-ldap-secret created

Detailed explanation:

This step creates a generic secret named rhds-ldap-secret in the openshift-config namespace. The secret stores a key called bindPassword with the value redhatocp. In an identity-provider or LDAP integration workflow, the bind password is used by OpenShift when connecting to the external directory service. Storing this value in a secret is the correct operational pattern because authentication material should not be embedded directly into configuration objects. The openshift-config namespace is specifically important because cluster authentication configuration commonly references secrets and configmaps from that namespace. If the secret name or key is wrong, the authentication configuration that depends on it may fail to validate or connect properly.

============

Log in to OpenShift internal registry

oc registry login

Allows podman to push to the internal registry.

Pull external image

podman pull docker.io/library/nginx:1.25

Gets the image locally.

Tag for internal registry destination

podman tag nginx:1.25 image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Uses the cluster service DNS name (works inside cluster network).

Push to internal registry

podman push image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Update deployment to use internal image

oc -n orders set image deploy/web web=image-registry.openshift-image-registry.svc:5000/orders/nginx:1.25

Verify rollout

oc -n orders rollout status deploy/web

oc -n orders get pods -o wide

==========

Create (or switch to) the project

oc new-project payments

Namespace must exist before applying rolebindings.

Grant edit to the group

oc -n payments policy add-role-to-group edit dev-team

Members of dev-team can modify most resources in payments.

Grant view to a user

oc -n payments policy add-role-to-user view auditor1

auditor1 can read resources but not change them.

Verify rolebindings

oc -n payments get rolebinding

==========

Create a group sync config file (example groupsync.yaml)

This file defines how OpenShift queries LDAP for groups and members.

Run a one-time group sync

oc adm groups sync --sync-config=groupsync.yaml --confirm

--confirm actually applies changes (without it, it’s a dry-run preview).

Verify groups created/updated

oc get groups

oc describe group < groupname >

Confirms group objects exist and membership is present.

==========

Create PDB

cat < < EOF | oc -n payments apply -f -

apiVersion: policy/v1

kind: PodDisruptionBudget

metadata:

name: api-pdb

spec:

minAvailable: 2

selector:

matchLabels:

app: api

EOF

minAvailable: 2 blocks evictions that would reduce availability below 2.

Verify PDB

oc -n payments get pdb

oc -n payments describe pdb api-pdb

==========

Step 1: Identify the pending certificate signing request.

The lab names it audit-csr.

Step 2: Run the approval command:

oc adm certificate approve audit-csr

Step 3: Confirm approval.

The lab output shows:

certificatesigningrequest.certificates.k8s.io/audit-csr approved

Detailed explanation:

In Kubernetes and OpenShift, a CSR must be approved before the requester can use the signed certificate for authentication. This Task approves the CSR named audit-csr, which is likely associated with the audit user or service account access flow in the lab. Certificate-based authentication is commonly used for kubeconfig access because it enables secure client identity without relying solely on tokens. Until the CSR is approved, the certificate cannot be trusted by the cluster API for authenticated operations. Administrative approval is therefore a gatekeeping step that ensures only intended certificate requests become valid credentials. This Task is part of a broader kubeconfig workflow that continues with setting credentials and defining context.

============

Step 1: Log in to the OpenShift web console with an account that has sufficient cluster administrative privileges.

This Task is performed from the GUI, not the CLI. The lab hint explicitly places this under the worker node details page in the console.

Step 2: Navigate to Compute .

This area contains node-level resources, including control plane and worker nodes.

Step 3: Open Nodes .

Here you can view all nodes currently registered in the cluster.

Step 4: Select the required worker node .

Choose the exact worker node referenced by the lab Task SIMULATION .

Step 5: Open the Details tab.

The taint configuration is managed from the selected node’s details view.

Step 6: Locate the Taints section and click Edit .

A taint is used to control pod scheduling. If a worker has a taint, pods without matching tolerations may not schedule there.

Step 7: Remove the unwanted taint entry.

Removing the taint makes the worker eligible again for normal scheduling behavior, depending on the rest of the cluster policy.

Step 8: Click Save .

This commits the change so the node is updated and the scheduler can evaluate it without that taint.

============