RedHat Red Hat Certified Specialist in OpenShift Advanced Cluster Management - EX432 FREE EXAM DUMPS QUESTIONS & ANSWERS
Create a namespace for a team and bind a ManagedClusterSet to that namespace
Correct Answer:
See the solution below in Explanation.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.
Configure a maintenance window for deployments (time window concept) and validate drift
Correct Answer:
See the solution below in Explanation.
* Edit the subscription/app definition to include a time window (active or blocked window).
* Attempt a change outside the window and observe behavior (no rollout until window).
* Confirm rollout during window.
* Edit the subscription/app definition to include a time window (active or blocked window).
* Attempt a change outside the window and observe behavior (no rollout until window).
* Confirm rollout during window.
Import Cluster (Web Console)
Correct Answer:
See the solution below in Explanation.
Explanation:
* In the hub cluster Web Console, go to Infrastructure # Clusters (ACM console navigation).
* Click Import cluster .
* Provide a name (the UI may request details like distribution/credentials depending on flow).
* The wizard will provide a command to run on the managed cluster you want to import.
* Copy that import command.
* Log into the managed cluster (spoke) using oc and run the copied command.
* Back on the hub, wait until the cluster status becomes Ready / Managed .
Why these steps matter:
* Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.
Explanation:
* In the hub cluster Web Console, go to Infrastructure # Clusters (ACM console navigation).
* Click Import cluster .
* Provide a name (the UI may request details like distribution/credentials depending on flow).
* The wizard will provide a command to run on the managed cluster you want to import.
* Copy that import command.
* Log into the managed cluster (spoke) using oc and run the copied command.
* Back on the hub, wait until the cluster status becomes Ready / Managed .
Why these steps matter:
* Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.
Create a Placement that selects clusters in a ManagedClusterSet only
Correct Answer:
See the solution below in Explanation.
Explanation:
* Ensure namespace has the correct ManagedClusterSetBinding.
* Create placement in that namespace; only clusters visible via bound ClusterSet can be selected.
* Verify placementdecision includes only clusters from that set.
This ties together ClusterSets (grouping) and Placement (selection).
Explanation:
* Ensure namespace has the correct ManagedClusterSetBinding.
* Create placement in that namespace; only clusters visible via bound ClusterSet can be selected.
* Verify placementdecision includes only clusters from that set.
This ties together ClusterSets (grouping) and Placement (selection).
Create a Governance Policy to ensure a namespace exists on selected clusters
Correct Answer:
See the solution below in Explanation.
Explanation:
Policies in ACM require:
* a Policy resource
* a Placement (which clusters to target)
* a PlacementBinding (bind policy # placement)
* Create the Policy (in team-dev) enforcing a namespace audit-logs:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-ensure-audit-namespace
namespace: team-dev
spec:
remediationAction: enforce
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: ensure-audit-namespace
spec:
remediationAction: enforce
severity: low
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
name: audit-logs
EOF
* Create PlacementBinding to bind it to dev-clusters placement:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
name: bind-policy-ensure-audit-namespace
namespace: team-dev
placementRef:
apiGroup: cluster.open-cluster-management.io
kind: Placement
name: dev-clusters
subjects:
- apiGroup: policy.open-cluster-management.io
kind: Policy
name: policy-ensure-audit-namespace
EOF
* Verify compliance:
oc get policy -n team-dev
oc describe policy policy-ensure-audit-namespace -n team-dev
Why this matters:
This is the core "ACM governance" exam pattern: define desired state and enforce across clusters.
Explanation:
Policies in ACM require:
* a Policy resource
* a Placement (which clusters to target)
* a PlacementBinding (bind policy # placement)
* Create the Policy (in team-dev) enforcing a namespace audit-logs:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-ensure-audit-namespace
namespace: team-dev
spec:
remediationAction: enforce
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: ensure-audit-namespace
spec:
remediationAction: enforce
severity: low
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
name: audit-logs
EOF
* Create PlacementBinding to bind it to dev-clusters placement:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
name: bind-policy-ensure-audit-namespace
namespace: team-dev
placementRef:
apiGroup: cluster.open-cluster-management.io
kind: Placement
name: dev-clusters
subjects:
- apiGroup: policy.open-cluster-management.io
kind: Policy
name: policy-ensure-audit-namespace
EOF
* Verify compliance:
oc get policy -n team-dev
oc describe policy policy-ensure-audit-namespace -n team-dev
Why this matters:
This is the core "ACM governance" exam pattern: define desired state and enforce across clusters.