Free and Premium RedHat EX432 Dumps Questions Answers

Use a policy-based deployment model that installs RHACS components consistently across clusters (operator + secured cluster).

Bind policy to placement selecting target clusters.

Validate RHACS Sensor/Collector present in expected namespace on managed clusters.

Policy collections exist demonstrating RHACS installation patterns via policy framework.

Create an empty kustomization file:

touch overlays/production/kustomization.yaml

Validate it exists:

ls -l overlays/production

Why this matters:

kustomization.yaml is the entrypoint file Kustomize uses to build overlays.

Create the object storage secret (you’ll be given endpoint/access keys in an exam):

oc -n open-cluster-management-observability create secret generic thanos-object-storage \

--from-file=thanos.yaml=/path/to/thanos.yaml

Create or edit MultiClusterObservability CR to enable observability (storage class, retention, etc.).

Verify observability pods in the observability namespace and check dashboards/metrics. Why this matters: Monitoring health/performance with ACM observability is a common learning objective in ACM training.

In OpenShift Web Console, go to Operators → OperatorHub .

Search for Advanced Cluster Security .

Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .

Click Install and follow the wizard (namespace/channel per lab).

After operator installation, create RHACS components (as the hint indicates):

Install/Deploy Central (the management plane)

Install/Deploy SecuredCluster (sensor/collector on clusters)

Confirm operator and pods are running:

Operators → Installed Operators

oc get pods -n < rhacs-namespace >

Why this matters:

RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.

Create the ManagedClusterSet:

oc create managedclusterset development

Confirm it exists:

oc get managedclusterset

oc describe managedclusterset development

Why these steps matter:

ClusterSets are an ACM grouping primitive used for RBAC scoping , governance targeting, and multi-cluster app placement.

Put the NetworkPolicy manifest under object-templates in a ConfigurationPolicy.

Bind to a Placement for dev clusters.

Verify NetworkPolicy exists on all targeted clusters.

Write a Policy → ConfigurationPolicy enforcing a ConfigMap (name, namespace, data keys).

Bind to placement.

Verify on a managed cluster:

oc get configmap -n < ns >

oc describe configmap -n < ns > < name >

Open the RHACS (Central) console (typically via a route created by Central).

Navigate to: Platform Configuration → System Policies .

Click Create Policy .

Set the policy criteria:

Add a rule/condition such as Image OS = debian:10 (as required by the lab)

Set enforcement to apply at Build & Deploy stages.

Build prevents images from being admitted into pipeline/registries depending on integration.

Deploy prevents or flags deployments that violate policy.

Save the policy.

(Optional validation) Trigger a test deployment/image that matches debian:10 to confirm alerts/enforcement behavior.

Why this matters:

Enforcing at build+deploy catches risky images earlier and prevents policy violations from reaching runtime.

Label clusters for prod:

oc label managedcluster cluster-prod1 environment=prod --overwrite

oc label managedcluster cluster-prod2 environment=prod --overwrite

Create Placement with numberOfClusters: 2:

cat < < 'EOF' | oc apply -f -

apiVersion: cluster.open-cluster-management.io/v1beta1

kind: Placement

metadata:

name: prod-two-clusters

namespace: team-prod

spec:

numberOfClusters: 2

predicates:

- requiredClusterSelector:

labelSelector:

matchLabels:

environment: prod

EOF

Validate placement decisions:

oc get placementdecision -n team-prod

Create a Channel (Git) and Subscription referencing it (example pattern).

In exams, you’re usually given a repo URL and target namespace.

Ensure there is a placement rule/placement selecting clusters.

Apply manifests:

oc apply -f channel.yaml

oc apply -f subscription.yaml

Verify resources:

oc get channels.apps.open-cluster-management.io -A

oc get subscriptions.apps.open-cluster-management.io -A

oc get application.app.k8s.io -A

Why this matters:

Multi-cluster application lifecycle is part of ACM operations, and EX480 explicitly covers managing multi-cluster environments with ACM.

On hub: inspect managed cluster conditions for certificate issues.

Check pending CSRs (if applicable in your lab):

oc get csr

Approve relevant CSRs and verify managed cluster returns Ready. Why this matters: Certificate-driven trust is core to “secure clusters” operations in ACM.

Grant the ClusterSet role (admin on production).

Log in as user-a and attempt:

list clusters in production vs development

create policies in a namespace bound to production

Confirm authorization errors when accessing development resources.

(ClusterSet RBAC is explicitly part of cluster set management and access scope.)

Create overlays/production/kustomization.yaml referencing base resources.

Build overlay:

kustomize build overlays/production | oc apply -f -

(If kustomize isn’t present, use oc kustomize if available.)

Verify resources created and placed only on production clusters via placement rules.