EX432 RedHat Red Hat Certified Specialist in OpenShift Advanced Cluster Management Free Practice Exam Questions (2026 Updated)

In the hub cluster Web Console, go to Infrastructure → Clusters (ACM console navigation).

Click Import cluster .

Provide a name (the UI may request details like distribution/credentials depending on flow).

The wizard will provide a command to run on the managed cluster you want to import.

Copy that import command.

Log into the managed cluster (spoke) using oc and run the copied command.

Back on the hub, wait until the cluster status becomes Ready / Managed .

Why these steps matter:

Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.

Confirm the cluster is present on the hub:

oc get managedcluster

Bind cluster-dev to development:

clusteradm clusterset bind --clusterset development --cluster cluster-dev

Verify membership (common checks):

oc get managedclustersetbindings -A

oc get managedclusterset development -o yaml

oc get managedcluster cluster-dev -o yaml | grep -i clusterset -n

Why this matters:

ClusterSet binding is what allows RBAC/users/apps/policies scoped to that ClusterSet to target the cluster.

Ensure namespace has the correct ManagedClusterSetBinding.

Create placement in that namespace; only clusters visible via bound ClusterSet can be selected.

Verify placementdecision includes only clusters from that set.

This ties together ClusterSets (grouping) and Placement (selection).

Policies in ACM require:

a Policy resource

a Placement (which clusters to target)

a PlacementBinding (bind policy ↔ placement)

Create the Policy (in team-dev) enforcing a namespace audit-logs:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: Policy

metadata:

name: policy-ensure-audit-namespace

namespace: team-dev

spec:

remediationAction: enforce

disabled: false

policy-templates:

- objectDefinition:

apiVersion: policy.open-cluster-management.io/v1

kind: ConfigurationPolicy

metadata:

name: ensure-audit-namespace

spec:

remediationAction: enforce

severity: low

object-templates:

- complianceType: musthave

objectDefinition:

apiVersion: v1

kind: Namespace

metadata:

name: audit-logs

EOF

Create PlacementBinding to bind it to dev-clusters placement:

cat < < 'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: PlacementBinding

metadata:

name: bind-policy-ensure-audit-namespace

namespace: team-dev

placementRef:

apiGroup: cluster.open-cluster-management.io

kind: Placement

name: dev-clusters

subjects:

- apiGroup: policy.open-cluster-management.io

kind: Policy

name: policy-ensure-audit-namespace

EOF

Verify compliance:

oc get policy -n team-dev

oc describe policy policy-ensure-audit-namespace -n team-dev

Why this matters:

This is the core “ACM governance” exam pattern: define desired state and enforce across clusters.

List clusters:

oc get managedcluster

Label the target cluster(s):

oc label managedcluster cluster-dev environment=dev region=us-east --overwrite

Verify labels:

oc get managedcluster cluster-dev --show-labels

Why this matters:

Labels drive Placement decisions used by policies and applications.

In OpenShift Web Console, go to Operators → OperatorHub .

Search for Advanced Cluster Security .

Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .

Click Install and follow the wizard (namespace/channel per lab).

After operator installation, create RHACS components (as the hint indicates):

Install/Deploy Central (the management plane)

Install/Deploy SecuredCluster (sensor/collector on clusters)

Confirm operator and pods are running:

Operators → Installed Operators

oc get pods -n < rhacs-namespace >

Why this matters:

RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

Put the NetworkPolicy manifest under object-templates in a ConfigurationPolicy.

Bind to a Placement for dev clusters.

Verify NetworkPolicy exists on all targeted clusters.

Confirm the policy exists in the namespace:

oc get policy -n team-dev

Confirm Placement exists and selects clusters:

oc get placement -n team-dev

oc get placementdecision -n team-dev

Confirm PlacementBinding points to correct placement + policy:

oc get placementbinding -n team-dev -o yaml

Fix common mistakes:

wrong namespace

placement name mismatch

missing ClusterSetBinding in the namespace Why this matters: Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.

Create a namespace for the team:

oc new-project team-dev

Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta2

kind: ManagedClusterSetBinding

metadata:

name: development

namespace: team-dev

spec:

clusterSet: development

EOF

Verify:

oc get managedclustersetbinding -n team-dev

Why this matters:

ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.

Create overlays/production/kustomization.yaml referencing base resources.

Build overlay:

kustomize build overlays/production | oc apply -f -

(If kustomize isn’t present, use oc kustomize if available.)

Verify resources created and placed only on production clusters via placement rules.

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.