EX432 Practice Questions

Create the ManagedClusterSet:

oc create managedclusterset production

Validate:

oc get managedclusterset

oc describe managedclusterset production

Why this matters:

Separating development and production clusters is common for governance/RBAC isolation.

In the hub cluster Web Console, go to Infrastructure → Clusters (ACM console navigation).

Click Import cluster .

Provide a name (the UI may request details like distribution/credentials depending on flow).

The wizard will provide a command to run on the managed cluster you want to import.

Copy that import command.

Log into the managed cluster (spoke) using oc and run the copied command.

Back on the hub, wait until the cluster status becomes Ready / Managed .

Why these steps matter:

Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.

Create a group (example) and add users:

oc adm groups new dev-team

oc adm groups add-users dev-team user1 user2

Grant namespace access:

oc adm policy add-role-to-group edit dev-team -n team-dev

Validate with a user token/login (or check rolebindings):

oc get rolebinding -n team-dev | grep dev-team

Why this matters:

ACM access patterns commonly combine namespace RBAC + ClusterSetBinding to scope what teams can manage.

Patch remediation to inform:

oc patch policy policy-ensure-audit-namespace -n team-dev --type=merge -p '{"spec":{"remediationAction":"inform"}}'

Verify:

oc get policy policy-ensure-audit-namespace -n team-dev -o yaml | grep remediationAction -n

Observe compliance changes (policy will report but not auto-fix).

Ensure clusters have labels like openshiftVersion=4.18 and region=us-west etc.

Create placement with matchExpressions (include one label, exclude another):

matchExpressions:

- key: openshiftVersion

operator: In

values: ["4.18"]

- key: region

operator: NotIn

values: ["us-west"]

Validate PlacementDecision.

Use a policy-based deployment model that installs RHACS components consistently across clusters (operator + secured cluster).

Bind policy to placement selecting target clusters.

Validate RHACS Sensor/Collector present in expected namespace on managed clusters.

Policy collections exist demonstrating RHACS installation patterns via policy framework.

Confirm the cluster is present on the hub:

oc get managedcluster

Bind cluster-dev to development:

clusteradm clusterset bind --clusterset development --cluster cluster-dev

Verify membership (common checks):

oc get managedclustersetbindings -A

oc get managedclusterset development -o yaml

oc get managedcluster cluster-dev -o yaml | grep -i clusterset -n

Why this matters:

ClusterSet binding is what allows RBAC/users/apps/policies scoped to that ClusterSet to target the cluster.

Create overlays/production/kustomization.yaml referencing base resources.

Build overlay:

kustomize build overlays/production | oc apply -f -

(If kustomize isn’t present, use oc kustomize if available.)

Verify resources created and placed only on production clusters via placement rules.

In ACM console go to Applications .

Select the application you deployed.

Open the Editor view (YAML editor) for the Subscription object.

Under spec, add a timeWindow section similar to what the lab requests:

windowtype: active

day: Friday

hours: 09:00-17:00

Save/apply the changes.

Verify the Subscription YAML now contains the time window and observe that deployment actions respect the scheduling window.

Why this matters:

Time windows let you control when changes roll out (useful for change-management, business hours, and maintenance windows).

Create a ConfigurationPolicy using mustnothave complianceType (common policy pattern).

Bind to placement.

Confirm noncompliance if the namespace exists; enforce removes it if remediation is enforce.