Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
SIMULATION
Task 1
Manage Identity Provider
Task information Details:
Create the following HTPasswd users: bob, qwerty, john, armstrong, natasha, harry, susan.
Create a secret from the HTPasswd file in openshift-config.
Configure cluster OAuth to use the HTPasswd identity provider.
Restart the OAuth pods so the new authentication configuration takes effect.
Solution:
Create the initial HTPasswd file with the first user:
htpasswd -c -B -b /tmp/htpass.txt bob indionce
Add the remaining users:
htpasswd -b /tmp/htpass.txt qwerty catalog
htpasswd -b /tmp/htpass.txt john john123
htpasswd -b /tmp/htpass.txt armstrong natasha123
htpasswd -b /tmp/htpass.txt natasha arthstrong
htpasswd -b /tmp/htpass.txt harry harry123
htpasswd -b /tmp/htpass.txt susan susuan123
Create the secret in openshift-config:
oc create secret generic ex280-secure --from-file=htpasswd=/tmp/htpass.txt -n openshift-config
Edit OAuth and add the HTPasswd identity provider:
oc edit oauth cluster
Use a valid structure like this:
spec:
identityProviders:
- name: ex280-idp-secure
mappingMethod: claim
type: HTPasswd
htpasswd:
fileData:
name: ex280-secure
Save and exit.
Restart OAuth pods:
oc delete pod -n openshift-authentication -l app=oauth-openshift
Verify:
oc get pods -n openshift-authentication
oc get oauth cluster -o yaml
This task validates OpenShift local authentication configuration through HTPasswd and cluster OAuth integration.
SIMULATION
Configure a secret
Configure a secret in the math project with the following requirements: The name of the secret is: magic
The secret defines a key with name: decoder_ring The secret defines the key with value:
XpWy9KdcP3Tr9FFHGQgZgVRCKukQdrQsbcl0c2ZYhDk=
Solution:
$ oc project math
$ oc create secret generic magic --from-literal key=decoder_ring --from- literal value=XpWy9KdcP3Tr9FFHGQgZgVRCKukQdrQsbcl0c2ZYhDk=
$ oc get secret -n math
SIMULATION
Configure project permissions
Configure your OpenShift cluster to meet the following requirements: The following projects exist:
apollo manhattan gemini bluebook titan
The user account armstrong is an administrator for project apollo and project gemini
The user account wozniak can view project titan but not administer or delete it
Solution:
$ oc new-project apollo
$ oc new-project manhattan
$ oc new-project gemini
$ oc new-project bluebook
$ oc new-project titan
$ oc adm policy add-role-to-user admin armstrong -n apollo
$ oc adm policy add-role-to-user admin armstrong -n gemini
$ oc adm policy add-role-to-user view wozniak -n titan
SIMULATION
Configure a secure route
Configure the oxcart application in the area51 project with the following requirements:
The application uses a route called oxcart
The application uses a CA signed certificate with the following subject fields:
/C=US/ST=NV/L=Hiko/O=CIA/OU=USAF/CN=classified.apps.domainxx.example.com The application is reachable only at the following address: https://classified.apps.domainxx.example.com
The application produces output
A utility script called newcert has been provided to create the CA signed certificate. You may enter the certificate parameters manually or pass the subject as a parameter.
Your certificate signing request will be uploaded to the CA where it will immediately be signed and then downloaded to your current directory.
Solution:
$ oc project area51
$ oc get pods
$ oc get all | grep deployment
$ oc get route
$ oc delete route oxcart
$ openssl genrsa -out ex280.key 2048
$ openssl req -new -key ex280.key -out ex280.csr -subj '/C=US/ST=NV/L=Hiko/O=CIA/OU=USAF/CN=classified.apps.domainxx.example.com'
$ openssl x509 -req -in ex280.csr -signkey ex280.key -out ex280.crt
$ oc create route edge oxcart --service oxcart --key ex280.key --cert ex280.crt --hostname classified.apps.domainxx.example.com
$ oc get route
$ oc get svc
SIMULATION
Configure a service account
Configure a service account in the apples project to meet the following requirements:
The name of the account is ex280sa
The account allows pods to be run as any available user
Solution:
$ oc project apples
$ oc create sa ex280sa
$ oc adm policy add-scc-to-user anyuid -z ex280sa
33 questions covering all exam domains, starting from $20
Exam domains verified against: Official RedHat EX280 exam guide, last checked August 2026.
Administer OpenShift clusters through the web console and command-line interface. Create and delete projects, examine container images, and query Kubernetes resources. Monitor events and logs to maintain cluster health and troubleshoot common issues.
Deploy applications from YAML manifests and templates. Use Kustomize for application configuration management. Create and configure secrets and ConfigMaps for application data and sensitive information.
Sample question from this domain above: Q2
Deploy and manage applications using templates and Helm charts. Work with replica sets, labels, and selectors. Configure services and expose applications to external access through routes.
Configure the HTPasswd identity provider for authentication. Create, delete, and manage users and groups. Modify permissions and manage user access to cluster resources.
Configure networking components and troubleshoot software-defined networking. Create and edit external routes. Secure traffic with TLS certificates and configure network policies for application isolation.
Sample question from this domain above: Q4
Configure load balancer services for non-HTTP protocols. Manage external application access for services that do not use standard HTTP or SNI routing.
Configure cluster and project resource quotas to control resource consumption. Set resource requirements and limit ranges for projects. Create project templates to standardize deployments.
Install, uninstall, and delete operators to extend cluster functionality. Manage operator lifecycle and coordinate operator-managed resources.
Configure service accounts and security context constraints to control application permissions. Manage access to Kubernetes APIs. Deploy jobs and cron jobs for scheduled tasks.
Sample question from this domain above: Q5
Common questions about the exam itself
