EX432認定で究極のガイド [2026年更新]
EX432練習試験と学習ガイドは厳密検証された
RedHat EX432 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 17
Configure a maintenance window for deployments (time window concept) and validate drift
正解：
解説：
See the solution below in Explanation.
* Edit the subscription/app definition to include a time window (active or blocked window).
* Attempt a change outside the window and observe behavior (no rollout until window).
* Confirm rollout during window.
質問 # 18
Troubleshoot a policy that shows "Pending" (no placement decisions)
正解：
解説：
See the solution below in Explanation.
Explanation:
* Confirm the policy exists in the namespace:
oc get policy -n team-dev
* Confirm Placement exists and selects clusters:
oc get placement -n team-dev
oc get placementdecision -n team-dev
* Confirm PlacementBinding points to correct placement + policy:
oc get placementbinding -n team-dev -o yaml
* Fix common mistakes:
* wrong namespace
* placement name mismatch
* missing ClusterSetBinding in the namespace Why this matters: Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.
質問 # 19
Create Overlay Directory (Kustomize)
正解：
解説：
See the solution below in Explanation.
Explanation:
* Create overlay structure:
* mkdir -p overlays/production
* Confirm:
* ls -R overlays
Why this matters:
* Kustomize overlays let you maintain base manifests and environment-specific patches (production vs dev, etc.).
質問 # 20
Create a policy that ensures a ConfigMap exists with specific data
正解：
解説：
See the solution below in Explanation.
Explanation:
* Write a Policy # ConfigurationPolicy enforcing a ConfigMap (name, namespace, data keys).
* Bind to placement.
* Verify on a managed cluster:
oc get configmap -n < ns >
oc describe configmap -n < ns > < name >
質問 # 21
Apply a kustomize overlay for production and deploy resources to production clusters
正解：
解説：
See the solution below in Explanation.
Explanation:
* Create overlays/production/kustomization.yaml referencing base resources.
* Build overlay:
kustomize build overlays/production | oc apply -f -
(If kustomize isn't present, use oc kustomize if available.)
* Verify resources created and placed only on production clusters via placement rules.
質問 # 22
Create Production ClusterSet
正解：
解説：
See the solution below in Explanation.
Explanation:
* Create the ManagedClusterSet:
* oc create managedclusterset production
* Validate:
* oc get managedclusterset
* oc describe managedclusterset production
Why this matters:
* Separating development and production clusters is common for governance/RBAC isolation.
質問 # 23
Rotate/renew managed cluster access (agent cert / CSR workflow) and restore connectivity
正解：
解説：
See the solution below in Explanation.
Explanation:
* On hub: inspect managed cluster conditions for certificate issues.
* Check pending CSRs (if applicable in your lab):
oc get csr
* Approve relevant CSRs and verify managed cluster returns Ready. Why this matters: Certificate- driven trust is core to "secure clusters" operations in ACM.
質問 # 24
Install RHACS Operator (Web Console)
正解：
解説：
See the solution below in Explanation.
Explanation:
* In OpenShift Web Console, go to Operators # OperatorHub .
* Search for Advanced Cluster Security .
* Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .
* Click Install and follow the wizard (namespace/channel per lab).
* After operator installation, create RHACS components (as the hint indicates):
* Install/Deploy Central (the management plane)
* Install/Deploy SecuredCluster (sensor/collector on clusters)
* Confirm operator and pods are running:
* Operators # Installed Operators
* oc get pods -n < rhacs-namespace >
Why this matters:
* RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.
質問 # 25
Grant Admin Access to User A (ClusterSet admin for production)
正解：
解説：
See the solution below in Explanation.
Explanation:
* Grant the role:
* oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a
* Confirm the binding:
* oc get clusterrolebinding | grep -i production | grep -i user-a
Why this matters:
* ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).
質問 # 26
Create a compliance dashboard view: group policies by PolicySet and export results
正解：
解説：
See the solution below in Explanation.
* Create PolicySet to group related policies.
* Use Governance UI to filter by PolicySet and view compliance per cluster.
* Export/report (or capture output via CLI oc get policy -o wide) depending on lab capability.
質問 # 27
Troubleshoot a managed cluster stuck "NotReady" by checking klusterlet/agent components
正解：
解説：
See the solution below in Explanation.
Explanation:
* Check cluster conditions:
oc describe managedcluster cluster-dev
* Check agent namespaces and pods on the managed cluster (common namespace names depend on deployment, but you're looking for ACM/klusterlet agents).
* On hub, check managedclusteraddons and addon health:
oc get managedclusteraddon -n cluster-dev
oc describe managedclusteraddon -n cluster-dev < addon-name >
* Typical fixes: missing pull secret, network/DNS issues, CSR approval issues, etc. (Exam expects you to identify from events/conditions).
質問 # 28
Install RHACM Operator (Web Console)
正解：
解説：
See the solution below in Explanation.
Explanation:
* Log in to the OpenShift Web Console as a cluster-admin user.
* Go to Operators # OperatorHub .
* OperatorHub is the catalog of available operators.
* In the search box, type: Advanced Cluster Management .
* Click Advanced Cluster Management for Kubernetes (Red Hat ACM).
* Click Install .
* In the install wizard:
* Update channel : choose the recommended/stable channel for your lab.
* Installation mode : typically "All namespaces on the cluster" (default).
* Installed Namespace : select or create open-cluster-management .
* Click Install and wait for the operator to show Succeeded in:
* Operators # Installed Operators .
Why these steps matter:
* Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.
質問 # 29
Grant a team group "edit" access to the namespace that has a ClusterSetBinding
正解：
解説：
See the solution below in Explanation.
Explanation:
* Create a group (example) and add users:
oc adm groups new dev-team
oc adm groups add-users dev-team user1 user2
* Grant namespace access:
oc adm policy add-role-to-group edit dev-team -n team-dev
* Validate with a user token/login (or check rolebindings):
oc get rolebinding -n team-dev | grep dev-team
Why this matters:
ACM access patterns commonly combine namespace RBAC + ClusterSetBinding to scope what teams can manage.
質問 # 30
Bind Cluster to ClusterSet
Task information: Add cluster-dev to the development ClusterSet.
正解：
解説：
See the solution below in Explanation.
Explanation:
* Confirm the cluster is present on the hub:
* oc get managedcluster
* Bind cluster-dev to development:
* clusteradm clusterset bind --clusterset development --cluster cluster-dev
* Verify membership (common checks):
* oc get managedclustersetbindings -A
* oc get managedclusterset development -o yaml
* oc get managedcluster cluster-dev -o yaml | grep -i clusterset -n
Why this matters:
* ClusterSet binding is what allows RBAC/users/apps/policies scoped to that ClusterSet to target the cluster.
質問 # 31
Create a Governance Policy to ensure a namespace exists on selected clusters
正解：
解説：
See the solution below in Explanation.
Explanation:
Policies in ACM require:
* a Policy resource
* a Placement (which clusters to target)
* a PlacementBinding (bind policy # placement)
* Create the Policy (in team-dev) enforcing a namespace audit-logs:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
name: policy-ensure-audit-namespace
namespace: team-dev
spec:
remediationAction: enforce
disabled: false
policy-templates:
- objectDefinition:
apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
name: ensure-audit-namespace
spec:
remediationAction: enforce
severity: low
object-templates:
- complianceType: musthave
objectDefinition:
apiVersion: v1
kind: Namespace
metadata:
name: audit-logs
EOF
* Create PlacementBinding to bind it to dev-clusters placement:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
name: bind-policy-ensure-audit-namespace
namespace: team-dev
placementRef:
apiGroup: cluster.open-cluster-management.io
kind: Placement
name: dev-clusters
subjects:
- apiGroup: policy.open-cluster-management.io
kind: Policy
name: policy-ensure-audit-namespace
EOF
* Verify compliance:
oc get policy -n team-dev
oc describe policy policy-ensure-audit-namespace -n team-dev
Why this matters:
This is the core "ACM governance" exam pattern: define desired state and enforce across clusters.
質問 # 32
Install RHACS secured cluster services on managed clusters using a governance policy approach
正解：
解説：
See the solution below in Explanation.
Explanation:
* Use a policy-based deployment model that installs RHACS components consistently across clusters (operator + secured cluster).
* Bind policy to placement selecting target clusters.
* Validate RHACS Sensor/Collector present in expected namespace on managed clusters.
Policy collections exist demonstrating RHACS installation patterns via policy framework.
質問 # 33
Create Kustomization File
正解：
解説：
See the solution below in Explanation.
Explanation:
* Create an empty kustomization file:
* touch overlays/production/kustomization.yaml
* Validate it exists:
* ls -l overlays/production
Why this matters:
* kustomization.yaml is the entrypoint file Kustomize uses to build overlays.
質問 # 34
Create a Placement that selects clusters by label (environment=dev)
正解：
解説：
See the solution below in Explanation.
Explanation:
* Create Placement in team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta1
kind: Placement
metadata:
name: dev-clusters
namespace: team-dev
spec:
predicates:
- requiredClusterSelector:
labelSelector:
matchExpressions:
- key: environment
operator: In
values: ["dev"]
EOF
* Verify placement decisions:
oc get placement -n team-dev
oc get placementdecision -n team-dev
Why this matters:
Placement is used broadly for policy targeting and multi-cluster app rollout .
質問 # 35
......
究極のガイドはEX432最新時間限定！今すぐダウンロード！：https://www.passtest.jp/RedHat/EX432-shiken.html