RedHat EX432 問題練習

Question No : 1
SIMULATION
Task 15
Create System Policy (Web Console) in RHACS
Task information: Criteria: Image OS = debian:10, Enforcement: Build & Deploy

答えを確認する

正解: Open the RHACS (Central) console (typically via a route created by Central).
Navigate to: Platform Configuration → System Policies.
Click Create Policy.
Set the policy criteria:
Add a rule/condition such as Image OS = debian:10 (as required by the lab)
Set enforcement to apply at Build & Deploy stages.
Build prevents images from being admitted into pipeline/registries depending on integration.
Deploy prevents or flags deployments that violate policy.
Save the policy.
(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.
Why this matters:
Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

Question No : 2
SIMULATION
Task 14
Install RHACS Operator (Web Console)

答えを確認する

正解: In OpenShift Web Console, go to Operators → OperatorHub.
Search for Advanced Cluster Security.
Select Red Hat Advanced Cluster Security for Kubernetes (RHACS).
Click Install and follow the wizard (namespace/channel per lab).
After operator installation, create RHACS components (as the hint indicates):
Install/Deploy Central (the management plane)
Install/Deploy SecuredCluster (sensor/collector on clusters)
Confirm operator and pods are running:
Operators → Installed Operators
oc get pods -n <rhacs-namespace>
Why this matters:
RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.

Question No : 3
SIMULATION
Task 13
Create Kustomization File

答えを確認する

正解: Create an empty kustomization file:
touch overlays/production/kustomization.yaml
Validate it exists:
ls -l overlays/production
Why this matters:
kustomization.yaml is the entrypoint file Kustomize uses to build overlays.

Question No : 4
SIMULATION
Task 12
Create Overlay Directory (Kustomize)

答えを確認する

正解: Create overlay structure:
mkdir -p overlays/production
Confirm:
ls -R overlays
Why this matters:
Kustomize overlays let you maintain base manifests and environment-specific patches (production vs dev, etc.).

Question No : 5
SIMULATION
Task 11
Set TimeWindow for App (Web Console)
Task information: Add timeWindow to Subscription spec (active window Friday 09:00C17:00)

答えを確認する

正解: In ACM console go to Applications.
Select the application you deployed.
Open the Editor view (YAML editor) for the Subscription object.
Under spec, add a timeWindow section similar to what the lab requests:
windowtype: active
day: Friday
hours: 09:00-17:00
Save/apply the changes.
Verify the Subscription YAML now contains the time window and observe that deployment actions respect the scheduling window.
Why this matters:
Time windows let you control when changes roll out (useful for change-management, business hours, and maintenance windows).

Question No : 6
SIMULATION
Task 10
Deploy GitOps Application (Subscription YAML)

答えを確認する

正解: Apply the subscription/application manifest:
oc apply -f application-subscription.yaml
Confirm resources were created:
oc get applications.app.k8s.io -A
oc get subscriptions.apps.open-cluster-management.io -A oc describe application.app.k8s.io my-app -n <namespace>
Watch placement/propagation (varies by model used in the lab):
oc get placement -A
oc get placementrule -A
Why this matters:
ACM “application” deployment commonly uses Subscription/Placement (legacy model) or newer Placement resources, enabling multi-cluster rollout from Git sources.

Question No : 7
SIMULATION
Task 9
Create ETCD Encryption Policy (Web Console)

答えを確認する

正解: Open the ACM console on the hub.
Navigate to Governance → Policies.
Click Create policy.
Set Name: policy-etcd.
Choose the policy template/type ETCD Encryption.
Set Remediation action to enforce.
inform = report only
enforce = attempt to automatically remediate to desired state Select clusters/ClusterSets to apply (depends on the wizard). Click Submit.
Verify compliance once applied:
In console, check policy status: Compliant/NonCompliant
Or via CLI:
oc get policy -A
oc describe policy policy-etcd -n <policy-namespace>
Why this matters:
Governance policies are a core ACM feature for enforcing security baselines across multiple clusters.

Question No : 8
SIMULATION
Task 8
Grant View Access to User B (ClusterSet view for development)

答えを確認する

正解: Grant view role:
oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:view:development user-b
Validate:
oc get clusterrolebinding | grep -i development | grep -i user-b
Why this matters:
Provides read-only access to development ClusterSet resources, improving separation of duties.
Questions and Answers PDF

Question No : 9
SIMULATION
Task 7
Grant Admin Access to User A (ClusterSet admin for production)

答えを確認する

正解: Grant the role:
oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a
Confirm the binding:
oc get clusterrolebinding | grep -i production | grep -i user-a
Why this matters:
ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

Question No : 10
SIMULATION
Task 6
Bind Cluster to ClusterSet
Task information: Add cluster-dev to the development ClusterSet.

答えを確認する

正解: Confirm the cluster is present on the hub:
oc get managedcluster
Bind cluster-dev to development:
clusteradm clusterset bind --clusterset development --cluster cluster-dev
Verify membership (common checks):
oc get managedclustersetbindings -A
oc get managedclusterset development -o yaml
oc get managedcluster cluster-dev -o yaml | grep -i clusterset -n
Why this matters:
ClusterSet binding is what allows RBAC/users/apps/policies scoped to that ClusterSet to target the cluster.

Question No : 11
SIMULATION
Task 5
Import Cluster (Web Console)

答えを確認する

正解: In the hub cluster Web Console, go to Infrastructure → Clusters (ACM console navigation).
Click Import cluster.
Provide a name (the UI may request details like distribution/credentials depending on flow).
The wizard will provide a command to run on the managed cluster you want to import.
Copy that import command.
Log into the managed cluster (spoke) using oc and run the copied command. Back on the hub, wait until the cluster status becomes Ready / Managed.
Why these steps matter:
Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.

Question No : 12
SIMULATION
Task 4
Create Production ClusterSet

答えを確認する

正解: Create the ManagedClusterSet:
oc create managedclusterset production
Validate:
oc get managedclusterset
oc describe managedclusterset production
Why this matters:
Separating development and production clusters is common for governance/RBAC isolation.

Question No : 13
SIMULATION
Task 3
Create Development ClusterSet

答えを確認する

正解: Create the ManagedClusterSet:
oc create managedclusterset development
Confirm it exists:
oc get managedclusterset
oc describe managedclusterset development
Why these steps matter:
ClusterSets are an ACM grouping primitive used for RBAC scoping, governance targeting, and multi-cluster app placement.

Question No : 14
SIMULATION
Task 2
Create MultiClusterHub (CLI Alternative)
Task information: Apply the MultiClusterHub custom resource if not using Web Console.

答えを確認する

正解: Ensure you are logged into the hub cluster:
oc whoami
oc project open-cluster-management
Create/apply the MultiClusterHub CR:
oc apply -f multiclusterhub.yaml
Verify it was created:
oc get multiclusterhub -A
oc describe multiclusterhub -n open-cluster-management
Watch pods come up (typical namespaces include open-cluster-management, open-cluster-management-hub, etc. depending on ACM version/config):
oc get pods -n open-cluster-management -w
Why these steps matter:
The MultiClusterHub CR is the “hub installation” object. The operator reconciles it and installs/maintains hub services.

Question No : 15
SIMULATION
Task 1
Install RHACM Operator (Web Console)

答えを確認する

正解: Log in to the OpenShift Web Console as a cluster-admin user.
Go to Operators → OperatorHub.
OperatorHub is the catalog of available operators.
In the search box, type: Advanced Cluster Management.
Click Advanced Cluster Management for Kubernetes (Red Hat ACM).
Click Install.
In the install wizard:
Update channel: choose the recommended/stable channel for your lab.
Installation mode: typically “All namespaces on the cluster” (default).
Installed Namespace: select or create open-cluster-management. Click Install and wait for the operator to show Succeeded in: Operators → Installed Operators.
Why these steps matter:
Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters