RedHat EX432 Red Hat Certified Specialist in OpenShift Advanced Cluster Management Exam Practice Test

Log in to the OpenShift Web Console as a cluster-admin user.

Go to Operators → OperatorHub .

OperatorHub is the catalog of available operators.

In the search box, type: Advanced Cluster Management .

Click Advanced Cluster Management for Kubernetes (Red Hat ACM).

Click Install .

In the install wizard:

Update channel : choose the recommended/stable channel for your lab.

Installation mode : typically “All namespaces on the cluster” (default).

Installed Namespace : select or create open-cluster-management .

Click Install and wait for the operator to show Succeeded in:

Operators → Installed Operators .

Why these steps matter:

Installing the ACM operator creates the CRDs/controllers required to run the Hub components (MultiClusterHub) that manage/import other clusters.

Create PolicySet to group related policies.

Use Governance UI to filter by PolicySet and view compliance per cluster.

Export/report (or capture output via CLI oc get policy -o wide) depending on lab capability.

Edit the subscription/app definition to include a time window (active or blocked window).

Attempt a change outside the window and observe behavior (no rollout until window).

Confirm rollout during window.

Grant the role:

oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:admin:production user-a

Confirm the binding:

oc get clusterrolebinding | grep -i production | grep -i user-a

Why this matters:

ACM provides ClusterSet-scoped roles. This grants admin permissions limited to the production ClusterSet (instead of full cluster-admin).

In OpenShift Web Console, go to Operators → OperatorHub .

Search for Advanced Cluster Security .

Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .

Click Install and follow the wizard (namespace/channel per lab).

After operator installation, create RHACS components (as the hint indicates):

Install/Deploy Central (the management plane)

Install/Deploy SecuredCluster (sensor/collector on clusters)

Confirm operator and pods are running:

Operators → Installed Operators

oc get pods -n < rhacs-namespace >

Why this matters:

RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.

Grant the ClusterSet role (admin on production).

Log in as user-a and attempt:

list clusters in production vs development

create policies in a namespace bound to production

Confirm authorization errors when accessing development resources.

(ClusterSet RBAC is explicitly part of cluster set management and access scope.)

Create a namespace for the team:

oc new-project team-dev

Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta2

kind: ManagedClusterSetBinding

metadata:

name: development

namespace: team-dev

spec:

clusterSet: development

EOF

Verify:

oc get managedclustersetbinding -n team-dev

Why this matters:

ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.

Patch remediation to inform:

oc patch policy policy-ensure-audit-namespace -n team-dev --type=merge -p '{"spec":{"remediationAction":"inform"}}'

Verify:

oc get policy policy-ensure-audit-namespace -n team-dev -o yaml | grep remediationAction -n

Observe compliance changes (policy will report but not auto-fix).

Use a policy template approach (OperatorGroup + Subscription + desired namespace) in a ConfigurationPolicy.

Bind it to a Placement targeting dev clusters.

Verify operator subscription exists on managed clusters and CSV reaches Succeeded.

Why this matters:

Automating consistent operator installation at scale is a realistic governance task; community policy collections exist demonstrating this model.

Ensure ACM hub components are installed and healthy.

In ACM console, open Search and query for:

a namespace name

a specific deployment

Validate results show cluster origin and resource details.

Why this matters:

Search is a core ACM operational workflow for multi-cluster visibility.

In the hub cluster Web Console, go to Infrastructure → Clusters (ACM console navigation).

Click Import cluster .

Provide a name (the UI may request details like distribution/credentials depending on flow).

The wizard will provide a command to run on the managed cluster you want to import.

Copy that import command.

Log into the managed cluster (spoke) using oc and run the copied command.

Back on the hub, wait until the cluster status becomes Ready / Managed .

Why these steps matter:

Import registers the managed cluster, installs the klusterlet/agent components, and enables policy/app placement management.

Write a Policy → ConfigurationPolicy enforcing a ConfigMap (name, namespace, data keys).

Bind to placement.

Verify on a managed cluster:

oc get configmap -n < ns >

oc describe configmap -n < ns > < name >

Open the ACM console on the hub.

Navigate to Governance → Policies .

Click Create policy .

Set Name : policy-etcd.

Choose the policy template/type ETCD Encryption .

Set Remediation action to enforce .

inform = report only

enforce = attempt to automatically remediate to desired state

Select clusters/ClusterSets to apply (depends on the wizard).

Click Submit .

Verify compliance once applied:

In console, check policy status: Compliant/NonCompliant

Or via CLI:

oc get policy -A

oc describe policy policy-etcd -n < policy-namespace >

Why this matters:

Governance policies are a core ACM feature for enforcing security baselines across multiple clusters.