Free practice · No sign-up required
15 questions with answer explanations. Choose an answer below to begin.
Which resource definition is required to deploy a containerized application on OpenShift?
Define and manage application deployments
0/15 answered · Bookmark questions to review later. Focus the practice area to use keys 1–9 and Enter.
Learn by doing
Use official documentation and hands-on labs to work through topics you missed.
Prefer to read at your own pace? Work through each question below, then open its answer to check your reasoning. You can link directly to a question or print this reference.
Which resource definition is required to deploy a containerized application on OpenShift?
DeploymentConfig
Service
Route
ConfigMap
Correct answer
DeploymentConfig
A DeploymentConfig specifies how to run the application and manages the lifecycle of pods. Services, Routes, and ConfigMaps support networking and configuration but do not define how to run the application.
What is the purpose of a BuildConfig in OpenShift?
To define how source code is built into an image
To expose services externally
To store application secrets
To manage persistent storage
Correct answer
To define how source code is built into an image
A BuildConfig describes the build process, including source, strategy, and output image. It automates building container images from source code. Other options relate to networking, secrets, and storage resources.
Which command updates a running container image to a new version in OpenShift?
oc set image
oc rollout
oc apply
oc patch
Correct answer
oc set image
The oc set image command updates the container image for a deployment configuration or deployment. Rollout manages the deployment process, while apply and patch modify resources.
What does a Route resource primarily provide in OpenShift?
External access to services within the cluster
Configuration for build pipelines
Definition of pod replicas
Storage for application data
Correct answer
Configuration for build pipelines
A Route exposes a service externally by providing a hostname and load balancing. It is used for HTTP/HTTPS access. Builds, replicas, and storage are handled by other resource types.
Which OpenShift object is used to inject environment variables into a container?
ConfigMap
Secret
PersistentVolumeClaim
Both A and B
Correct answer
Both A and B
Both ConfigMap and Secret can define key-value pairs that are injected as environment variables into containers. PersistentVolumeClaim provides storage, not environment variables.
What is the main difference between a DeploymentConfig and a Deployment?
DeploymentConfig is OpenShift-specific and supports triggers
Deployment is faster to create
DeploymentConfig cannot be rolled back
Deployment is used only for non-container workloads
Correct answer
DeploymentConfig is OpenShift-specific and supports triggers
DeploymentConfig is an OpenShift resource that supports build and image change triggers. Deployment is a Kubernetes resource. Both support rollbacks, and both manage container workloads.
Which action can trigger a new deployment when using a DeploymentConfig?
ConfigMap update
Image change in the BuildConfig
Service deletion
Route modification
Correct answer
Image change in the BuildConfig
An image change in the associated BuildConfig can automatically trigger a new deployment. ConfigMap updates may require a manual restart trigger. Service and route changes do not initiate deployments.
What is the role of a ServiceAccount in OpenShift?
To provide identity for processes in pods
To manage user logins
To define network policies
To store application binaries
Correct answer
To provide identity for processes in pods
A ServiceAccount provides an identity for processes running in pods, allowing them to interact with the API and other resources. User logins, network policies, and binaries are handled by other mechanisms.
Which OpenShift feature allows you to manage external DNS records automatically?
Route admission control
External DNS provider integration
Image stream tagging
Build hook scripts
Correct answer
External DNS provider integration
External DNS provider integration can automatically update DNS records when Routes are created or modified. The other options relate to routing admission, image streams, and build customization.
What is the purpose of an ImageStream in OpenShift?
To track image tags and trigger builds on image updates
To store application source code
To define firewall rules
To manage user permissions
Correct answer
To track image tags and trigger builds on image updates
An ImageStream tracks image tags and can trigger builds or deployments when the image changes. It does not store source code or define network or security policies.
Which resource is used to define access policies for pods in OpenShift?
SecurityContextConstraints
NetworkPolicy
RoleBinding
PodPreset
Correct answer
SecurityContextConstraints
SecurityContextConstraints control security policies for pods, such as allowed capabilities and user IDs. NetworkPolicy defines network rules, RoleBinding assigns roles, and PodPreset injects configuration.
What does the 'oc new-app' command do?
Creates resources to build and deploy an application from source or an image
Deletes all resources in the current project
Updates the cluster certificate authority
Monitors pod logs in real time
Correct answer
Creates resources to build and deploy an application from source or an image
The 'oc new-app' command streamlines creating builds, deployment configs, and services from source code or an image. It automates common application setup tasks. Other commands serve different purposes.
Which OpenShift object is best for defining how to run a single instance of a stateful application?
StatefulSet
DeploymentConfig
DaemonSet
Job
Correct answer
StatefulSet
StatefulSet manages stateful applications with stable network IDs and persistent storage. While OpenShift uses DeploymentConfig for many workloads, StatefulSet is the Kubernetes resource designed for stateful instances.
What is the primary use of a ConfigMap in OpenShift?
To provide non-confidential configuration data to pods
To store database passwords securely
To define persistent storage volumes
To manage cluster-wide logging
Correct answer
To provide non-confidential configuration data to pods
ConfigMaps store non-sensitive configuration data such as environment variables, command-line arguments, or configuration files. Secrets should be used for sensitive data like passwords.
Which practice helps ensure that only approved container images are deployed in OpenShift?
ImagePolicy webhook
Manual image tagging
Using latest image tags
Disabling project quotas
Correct answer
ImagePolicy webhook
An ImagePolicy webhook validates image streams and tags against defined policies, enforcing image approval workflows. Relying on latest tags or manual processes reduces control and security.
Recall the answer before opening each card.
DeploymentConfig. It specifies containers, replicas, and lifecycle management. Services and Routes handle networking; ConfigMaps handle configuration.
To define the build process from source code to a container image, including strategy (e.g., Docker or S2I) and output image.
'oc set image' updates the container image for a deployment config or deployment. 'oc rollout' manages the deployment process.
External HTTP/HTTPS access to a service via a hostname and load balancing. It does not define build pipelines or storage.
Both ConfigMap and Secret can inject key-value pairs as environment variables or mounted files. PersistentVolumeClaim provides storage only.
DeploymentConfig is OpenShift-specific and supports triggers (image change, build change). Deployment is a Kubernetes resource without those triggers.
An image change in the associated BuildConfig or ImageStream. ConfigMap or Service changes do not automatically trigger a rollout.
To provide identity for processes in pods, enabling API interaction. It is not for user logins or network policies.
External DNS provider integration. It automatically updates DNS records when Routes are created or modified.
To track image tags and trigger builds or deployments when the image changes. It does not store source code.
SecurityContextConstraints (SCC). It controls capabilities, user IDs, and other security settings. NetworkPolicy controls network rules.
Creates resources (BuildConfig, DeploymentConfig, Service) to build and deploy an application from source code or a container image.
StatefulSet. It provides stable network IDs and persistent storage. DeploymentConfig is for stateless apps.
Store non-confidential configuration data (e.g., env vars, config files) for pods. Use Secrets for sensitive data.
Use an ImagePolicy webhook to validate images against defined policies, enforcing approval workflows. Avoid relying on manual checks.
Create a Route resource using 'oc expose service '. It assigns a hostname and load balances traffic.
Image change triggers from a BuildConfig or ImageStream. ConfigMap or Secret changes do not trigger automatic rollouts.
A container image pushed to a registry, often tracked via an ImageStream. The BuildConfig defines the source-to-image process.
'oc set env' or by referencing the ConfigMap in the DeploymentConfig YAML under 'spec.template.spec.containers.env'.
ServiceAccount is for pod processes, not human users. It authenticates to the API server with a token mounted in the pod.
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Connect the concepts
Open a branch to connect a topic with its practice questions and explanations. Use the map to choose your next review topic.
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
This section focuses on defining and managing application deployments. The practice bank emphasizes DeploymentConfig (OpenShift-specific, supports triggers) and StatefulSet (for stateful apps). 'oc new-app' streamlines initial resource creation, while 'oc set image' updates container images. Understanding the difference between DeploymentConfig and Deployment (Kubernetes native) is key. Rollouts are triggered by image changes in BuildConfig.
BuildConfig defines how source code is built into a container image. ImageStream tracks image tags and can trigger deployments when images update. The practice bank highlights that an image change in BuildConfig triggers a new deployment for a DeploymentConfig. External DNS provider integration automatically manages Route hostnames—a facet of release automation.
Route resources expose services externally via hostnames and load balancing. The practice bank reinforces that Routes provide external HTTP/HTTPS access, not build pipelines or storage. External DNS integration is a feature that automates DNS management. Understanding Route's role is crucial for making applications accessible outside the cluster.
SecurityContextConstraints define pod-level security policies. ServiceAccounts provide identity for pod processes. ConfigMaps store non-confidential configuration (env vars, files); Secrets for sensitive data. ImagePolicy webhook enforces that only approved images are deployed. The practice bank tests the difference between ConfigMap and Secret and the role of ServiceAccounts.
Study workflow
Use 'oc new-app' with source or image to create a BuildConfig and DeploymentConfig automatically. Alternatively, manually define a DeploymentConfig YAML specifying containers, replicas, and triggers. Apply with 'oc apply -f'. This automates build and deployment lifecycle.
Set up a BuildConfig that outputs to an ImageStream. In the DeploymentConfig, add an image change trigger referencing that ImageStream. When a new image tag is pushed (e.g., via 'oc start-build'), the trigger automatically initiates a rollout. Verify with 'oc rollout status'.
After creating a Service, run 'oc expose service <service-name>' to generate a Route. This creates a hostname for external access. Edit the Route YAML to secure it with TLS or customize the hostname. Use 'oc get route' to see the URL.
Create a ConfigMap from literal values or files using 'oc create configmap'. Then in your DeploymentConfig or Deployment, reference the ConfigMap under 'env' (key-value) or 'volumes' (config file). Apply the update. For secrets, use 'oc create secret generic' and reference similarly.
Define an ImagePolicy webhook configuration that specifies allowed image registries or tags. Apply as an admission webhook. Then test by deploying an image not matching policy; the deployment should be rejected. This ensures only approved container images run in the cluster.
FAQ
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
Use DeploymentConfig when you need OpenShift-specific features like image change triggers from ImageStreams, or when migrating from earlier OpenShift versions. Deployment is the Kubernetes-native resource, better for portability. Both support rollbacks.
DeploymentConfig does not automatically redeploy on ConfigMap changes. You need to manually trigger a rollout (e.g., 'oc rollout latest') or use a deployment strategy that restarts pods. Alternatively, use tools like Reloader or a sidecar watcher.
A BuildConfig defines how to build a container image from source code (e.g., Dockerfile or S2I). A DeploymentConfig defines how to run that image (replicas, environment, probes). They are often used together: BuildConfig produces an image, and DeploymentConfig runs it.
Use an ImagePolicy webhook that validates image references against policies (e.g., allow only images from trusted registries). You can also use ImageStreamTags with import policies. This prevents running unapproved or vulnerable images.
A ServiceAccount provides an identity for processes running inside a pod. It allows pods to authenticate to the Kubernetes API server and perform authorized operations. For example, a pod can use its ServiceAccount token to list pods or update resources.
Browse another free bank or use the study strategy guide to turn your misses into spaced review.
