最新的RedHat Red Hat Certified Specialist in OpenShift Advanced Cluster Management - EX432免費考試真題
問題1
Create a "deny" baseline policy: ensure a prohibited Namespace does NOT exist
正確答案:
See the solution below in Explanation.
* Create a ConfigurationPolicy using mustnothave complianceType (common policy pattern).
* Bind to placement.
* Confirm noncompliance if the namespace exists; enforce removes it if remediation is enforce.
* Create a ConfigurationPolicy using mustnothave complianceType (common policy pattern).
* Bind to placement.
* Confirm noncompliance if the namespace exists; enforce removes it if remediation is enforce.
問題2
Install RHACS Operator (Web Console)
正確答案:
See the solution below in Explanation.
Explanation:
* In OpenShift Web Console, go to Operators # OperatorHub .
* Search for Advanced Cluster Security .
* Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .
* Click Install and follow the wizard (namespace/channel per lab).
* After operator installation, create RHACS components (as the hint indicates):
* Install/Deploy Central (the management plane)
* Install/Deploy SecuredCluster (sensor/collector on clusters)
* Confirm operator and pods are running:
* Operators # Installed Operators
* oc get pods -n < rhacs-namespace >
Why this matters:
* RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.
Explanation:
* In OpenShift Web Console, go to Operators # OperatorHub .
* Search for Advanced Cluster Security .
* Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .
* Click Install and follow the wizard (namespace/channel per lab).
* After operator installation, create RHACS components (as the hint indicates):
* Install/Deploy Central (the management plane)
* Install/Deploy SecuredCluster (sensor/collector on clusters)
* Confirm operator and pods are running:
* Operators # Installed Operators
* oc get pods -n < rhacs-namespace >
Why this matters:
* RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.
問題3
Import Cluster (Web Console)
正確答案:
See the solution below in Explanation.
Explanation:
* In the hub cluster Web Console, go to Infrastructure # Clusters (ACM console navigation).
* Click Import cluster .
* Provide a name (the UI may request details like distribution/credentials depending on flow).
* The wizard will provide a command to run on the managed cluster you want to import.
* Copy that import command.
* Log into the managed cluster (spoke) using oc and run the copied command.
* Back on the hub, wait until the cluster status becomes Ready / Managed .
Why these steps matter:
* Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.
Explanation:
* In the hub cluster Web Console, go to Infrastructure # Clusters (ACM console navigation).
* Click Import cluster .
* Provide a name (the UI may request details like distribution/credentials depending on flow).
* The wizard will provide a command to run on the managed cluster you want to import.
* Copy that import command.
* Log into the managed cluster (spoke) using oc and run the copied command.
* Back on the hub, wait until the cluster status becomes Ready / Managed .
Why these steps matter:
* Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.
問題4
Create a namespace for a team and bind a ManagedClusterSet to that namespace
正確答案:
See the solution below in Explanation.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.
問題5
Troubleshoot a managed cluster stuck "NotReady" by checking klusterlet/agent components
正確答案:
See the solution below in Explanation.
Explanation:
* Check cluster conditions:
oc describe managedcluster cluster-dev
* Check agent namespaces and pods on the managed cluster (common namespace names depend on deployment, but you're looking for ACM/klusterlet agents).
* On hub, check managedclusteraddons and addon health:
oc get managedclusteraddon -n cluster-dev
oc describe managedclusteraddon -n cluster-dev < addon-name >
* Typical fixes: missing pull secret, network/DNS issues, CSR approval issues, etc. (Exam expects you to identify from events/conditions).
Explanation:
* Check cluster conditions:
oc describe managedcluster cluster-dev
* Check agent namespaces and pods on the managed cluster (common namespace names depend on deployment, but you're looking for ACM/klusterlet agents).
* On hub, check managedclusteraddons and addon health:
oc get managedclusteraddon -n cluster-dev
oc describe managedclusteraddon -n cluster-dev < addon-name >
* Typical fixes: missing pull secret, network/DNS issues, CSR approval issues, etc. (Exam expects you to identify from events/conditions).
