[Aug-2026] Check your preparation for RedHat EX432 On-Demand Exam
Practice Exam EX432 Realistic Dumps Verified Questions
RedHat EX432 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION # 16
Deploy GitOps Application (Subscription YAML)
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Apply the subscription/application manifest:
* oc apply -f application-subscription.yaml
* Confirm resources were created:
* oc get applications.app.k8s.io -A
* oc get subscriptions.apps.open-cluster-management.io -A
* oc describe application.app.k8s.io my-app -n < namespace >
* Watch placement/propagation (varies by model used in the lab):
* oc get placement -A
* oc get placementrule -A
Why this matters:
* ACM "application" deployment commonly uses Subscription/Placement (legacy model) or newer Placement resources, enabling multi-cluster rollout from Git sources.
NEW QUESTION # 17
Create a "deny" baseline policy: ensure a prohibited Namespace does NOT exist
Answer:
Explanation:
See the solution below in Explanation.
* Create a ConfigurationPolicy using mustnothave complianceType (common policy pattern).
* Bind to placement.
* Confirm noncompliance if the namespace exists; enforce removes it if remediation is enforce.
NEW QUESTION # 18
Create a Placement that selects clusters by label (environment=dev)
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Create Placement in team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta1
kind: Placement
metadata:
name: dev-clusters
namespace: team-dev
spec:
predicates:
- requiredClusterSelector:
labelSelector:
matchExpressions:
- key: environment
operator: In
values: ["dev"]
EOF
* Verify placement decisions:
oc get placement -n team-dev
oc get placementdecision -n team-dev
Why this matters:
Placement is used broadly for policy targeting and multi-cluster app rollout .
NEW QUESTION # 19
Troubleshoot a managed cluster stuck "NotReady" by checking klusterlet/agent components
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Check cluster conditions:
oc describe managedcluster cluster-dev
* Check agent namespaces and pods on the managed cluster (common namespace names depend on deployment, but you're looking for ACM/klusterlet agents).
* On hub, check managedclusteraddons and addon health:
oc get managedclusteraddon -n cluster-dev
oc describe managedclusteraddon -n cluster-dev < addon-name >
* Typical fixes: missing pull secret, network/DNS issues, CSR approval issues, etc. (Exam expects you to identify from events/conditions).
NEW QUESTION # 20
Install RHACM Operator (Web Console)
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Log in to the OpenShift Web Console as a cluster-admin user.
* Go to Operators # OperatorHub .
* OperatorHub is the catalog of available operators.
* In the search box, type: Advanced Cluster Management .
* Click Advanced Cluster Management for Kubernetes (Red Hat ACM).
* Click Install .
* In the install wizard:
* Update channel : choose the recommended/stable channel for your lab.
* Installation mode : typically "All namespaces on the cluster" (default).
* Installed Namespace : select or create open-cluster-management .
* Click Install and wait for the operator to show Succeeded in:
* Operators # Installed Operators .
Why these steps matter:
* Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.
NEW QUESTION # 21
Rotate/renew managed cluster access (agent cert / CSR workflow) and restore connectivity
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* On hub: inspect managed cluster conditions for certificate issues.
* Check pending CSRs (if applicable in your lab):
oc get csr
* Approve relevant CSRs and verify managed cluster returns Ready. Why this matters: Certificate- driven trust is core to "secure clusters" operations in ACM.
NEW QUESTION # 22
Set TimeWindow for App (Web Console)
Task information: Add timeWindow to Subscription spec (active window Friday 09:00-17:00)
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* In ACM console go to Applications .
* Select the application you deployed.
* Open the Editor view (YAML editor) for the Subscription object.
* Under spec, add a timeWindow section similar to what the lab requests:
* windowtype: active
* day: Friday
* hours: 09:00-17:00
* Save/apply the changes.
* Verify the Subscription YAML now contains the time window and observe that deployment actions respect the scheduling window.
Why this matters:
* Time windows let you control when changes roll out (useful for change-management, business hours, and maintenance windows).
NEW QUESTION # 23
Create a PolicySet and include multiple policies for a baseline
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Create PolicySet referencing existing policies:
cat < < 'EOF' | oc apply -f -
apiVersion: policy.open-cluster-management.io/v1beta1
kind: PolicySet
metadata:
name: baseline-dev
namespace: team-dev
spec:
policies:
- policy-ensure-audit-namespace
# Add more policies here as you create them
EOF
* Verify:
oc get policyset -n team-dev
Why this matters:
PolicySets group policies to apply/track as a unit-common governance practice.
NEW QUESTION # 24
Create a policy to enforce "etcd encryption enabled" and verify compliance status
Answer:
Explanation:
See the solution below in Explanation.
* In ACM console: Governance # Create policy # ETCD Encryption template and set to enforce .
* Target clusters via Placement.
* Confirm policy status: Compliant / NonCompliant per cluster.
NEW QUESTION # 25
Create Kustomization File
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Create an empty kustomization file:
* touch overlays/production/kustomization.yaml
* Validate it exists:
* ls -l overlays/production
Why this matters:
* kustomization.yaml is the entrypoint file Kustomize uses to build overlays.
NEW QUESTION # 26
Import Cluster (Web Console)
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* In the hub cluster Web Console, go to Infrastructure # Clusters (ACM console navigation).
* Click Import cluster .
* Provide a name (the UI may request details like distribution/credentials depending on flow).
* The wizard will provide a command to run on the managed cluster you want to import.
* Copy that import command.
* Log into the managed cluster (spoke) using oc and run the copied command.
* Back on the hub, wait until the cluster status becomes Ready / Managed .
Why these steps matter:
* Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.
NEW QUESTION # 27
Create a namespace for a team and bind a ManagedClusterSet to that namespace
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.
NEW QUESTION # 28
Create System Policy (Web Console) in RHACS
Task information: Criteria: Image OS = debian:10, Enforcement: Build & Deploy
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Open the RHACS (Central) console (typically via a route created by Central).
* Navigate to: Platform Configuration # System Policies .
* Click Create Policy .
* Set the policy criteria:
* Add a rule/condition such as Image OS = debian:10 (as required by the lab)
* Set enforcement to apply at Build & Deploy stages.
* Build prevents images from being admitted into pipeline/registries depending on integration.
* Deploy prevents or flags deployments that violate policy.
* Save the policy.
* (Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts
/enforcement behavior.
Why this matters:
* Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.
NEW QUESTION # 29
Grant Admin Access to User A (ClusterSet admin for production)
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Grant the role:
* oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a
* Confirm the binding:
* oc get clusterrolebinding | grep -i production | grep -i user-a
Why this matters:
* ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).
NEW QUESTION # 30
Create a policy that ensures a ConfigMap exists with specific data
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Write a Policy # ConfigurationPolicy enforcing a ConfigMap (name, namespace, data keys).
* Bind to placement.
* Verify on a managed cluster:
oc get configmap -n < ns >
oc describe configmap -n < ns > < name >
NEW QUESTION # 31
Configure a maintenance window for deployments (time window concept) and validate drift
Answer:
Explanation:
See the solution below in Explanation.
* Edit the subscription/app definition to include a time window (active or blocked window).
* Attempt a change outside the window and observe behavior (no rollout until window).
* Confirm rollout during window.
NEW QUESTION # 32
Create a namespace-scoped application deployment model using ClusterSetBinding + Placement
Answer:
Explanation:
See the solution below in Explanation.
* Bind the ClusterSet into the application namespace using ManagedClusterSetBinding.
* Create Placement in that namespace selecting the desired clusters.
* Deploy application resources tied to that placement (Subscription or GitOps pattern). Why this matters: This is the standard multi-tenant ACM pattern for teams.
NEW QUESTION # 33
Deploy an application using Subscription + PlacementRule (legacy model)
Answer:
Explanation:
See the solution below in Explanation.
Explanation:
* Create a Channel (Git) and Subscription referencing it (example pattern).
* In exams, you're usually given a repo URL and target namespace.
* Ensure there is a placement rule/placement selecting clusters.
* Apply manifests:
oc apply -f channel.yaml
oc apply -f subscription.yaml
* Verify resources:
oc get channels.apps.open-cluster-management.io -A
oc get subscriptions.apps.open-cluster-management.io -A
oc get application.app.k8s.io -A
Why this matters:
Multi-cluster application lifecycle is part of ACM operations, and EX480 explicitly covers managing multi- cluster environments with ACM.
NEW QUESTION # 34
......
Valid EX432 Dumps for Helping Passing RedHat Exam: https://www.actualcollection.com/EX432-exam-questions.html
Download Free RedHat EX432 Exam Questions & Answer: https://drive.google.com/open?id=1xszYVc7SGvnhBUMy9dMoC9-cqRw9JSZO