更新されたPDF（2026年最新）実際にあるRedHat EX432試験問題
検証済みのEX432試験問題集PDF[2026年最新] 成功の秘訣はFast2test
RedHat EX432 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
質問 # 20
Install RHACS Operator (Web Console)
正解：
解説：
See the solution below in Explanation.
Explanation:
* In OpenShift Web Console, go to Operators # OperatorHub .
* Search for Advanced Cluster Security .
* Select Red Hat Advanced Cluster Security for Kubernetes (RHACS) .
* Click Install and follow the wizard (namespace/channel per lab).
* After operator installation, create RHACS components (as the hint indicates):
* Install/Deploy Central (the management plane)
* Install/Deploy SecuredCluster (sensor/collector on clusters)
* Confirm operator and pods are running:
* Operators # Installed Operators
* oc get pods -n < rhacs-namespace >
Why this matters:
* RHACS adds container security posture management, vulnerability management, and runtime policy enforcement.
質問 # 21
Configure a maintenance window for deployments (time window concept) and validate drift
正解：
解説：
See the solution below in Explanation.
* Edit the subscription/app definition to include a time window (active or blocked window).
* Attempt a change outside the window and observe behavior (no rollout until window).
* Confirm rollout during window.
質問 # 22
Create a policy that enforces a NetworkPolicy in a given namespace across clusters
正解：
解説：
See the solution below in Explanation.
* Put the NetworkPolicy manifest under object-templates in a ConfigurationPolicy.
* Bind to a Placement for dev clusters.
* Verify NetworkPolicy exists on all targeted clusters.
質問 # 23
Grant View Access to User B (ClusterSet view for development)
正解：
解説：
See the solution below in Explanation.
Explanation:
* Grant view role:
* oc adm policy add-cluster-role-to-user open-cluster-management:managedclusterset:view:development user-b
* Validate:
* oc get clusterrolebinding | grep -i development | grep -i user-b
Why this matters:
* Provides read-only access to development ClusterSet resources, improving separation of duties.
質問 # 24
Create a policy that enforces a specific Operator to be installed on all dev clusters
正解：
解説：
See the solution below in Explanation.
Explanation:
* Use a policy template approach (OperatorGroup + Subscription + desired namespace) in a ConfigurationPolicy.
* Bind it to a Placement targeting dev clusters.
* Verify operator subscription exists on managed clusters and CSV reaches Succeeded.
Why this matters:
Automating consistent operator installation at scale is a realistic governance task; community policy collections exist demonstrating this model.
質問 # 25
Detach (unimport) a managed cluster safely from the hub
正解：
解説：
See the solution below in Explanation.
Explanation:
* Identify the managed cluster:
oc get managedcluster
* If required in your environment, remove dependent placements/policies/apps targeting it (exam often expects you to check "why deletion stuck").
* Delete managed cluster:
oc delete managedcluster cluster-dev
* Watch finalizers and cleanup:
oc get managedcluster cluster-dev -o yaml | grep finalizers -n
Why this matters:
Proper lifecycle operations (import/manage/detach) is core EX432/EX480 scope.
質問 # 26
Enable and verify ACM "Search" and query for a resource across clusters
正解：
解説：
See the solution below in Explanation.
Explanation:
* Ensure ACM hub components are installed and healthy.
* In ACM console, open Search and query for:
* a namespace name
* a specific deployment
* Validate results show cluster origin and resource details.
Why this matters:
Search is a core ACM operational workflow for multi-cluster visibility.
質問 # 27
Switch a policy from enforce # inform (report-only) and validate behavior
正解：
解説：
See the solution below in Explanation.
Explanation:
* Patch remediation to inform:
oc patch policy policy-ensure-audit-namespace -n team-dev --type=merge -p '{"spec":{"remediationAction":" inform"}}'
* Verify:
oc get policy policy-ensure-audit-namespace -n team-dev -o yaml | grep remediationAction -n
* Observe compliance changes (policy will report but not auto-fix).
質問 # 28
Create a namespace-scoped application deployment model using ClusterSetBinding + Placement
正解：
解説：
See the solution below in Explanation.
* Bind the ClusterSet into the application namespace using ManagedClusterSetBinding.
* Create Placement in that namespace selecting the desired clusters.
* Deploy application resources tied to that placement (Subscription or GitOps pattern). Why this matters: This is the standard multi-tenant ACM pattern for teams.
質問 # 29
Label managed clusters for placement (environment=dev, region=us-east)
正解：
解説：
See the solution below in Explanation.
Explanation:
* List clusters:
oc get managedcluster
* Label the target cluster(s):
oc label managedcluster cluster-dev environment=dev region=us-east --overwrite
* Verify labels:
oc get managedcluster cluster-dev --show-labels
Why this matters:
Labels drive Placement decisions used by policies and applications.
質問 # 30
Validate ClusterSet RBAC: confirm User A can only administer production ClusterSet
正解：
解説：
See the solution below in Explanation.
Explanation:
* Grant the ClusterSet role (admin on production).
* Log in as user-a and attempt:
* list clusters in production vs development
* create policies in a namespace bound to production
* Confirm authorization errors when accessing development resources.
(ClusterSet RBAC is explicitly part of cluster set management and access scope.)
質問 # 31
Create a policy to enforce "etcd encryption enabled" and verify compliance status
正解：
解説：
See the solution below in Explanation.
* In ACM console: Governance # Create policy # ETCD Encryption template and set to enforce .
* Target clusters via Placement.
* Confirm policy status: Compliant / NonCompliant per cluster.
質問 # 32
Create a "deny" baseline policy: ensure a prohibited Namespace does NOT exist
正解：
解説：
See the solution below in Explanation.
* Create a ConfigurationPolicy using mustnothave complianceType (common policy pattern).
* Bind to placement.
* Confirm noncompliance if the namespace exists; enforce removes it if remediation is enforce.
質問 # 33
Create ETCD Encryption Policy (Web Console)
正解：
解説：
See the solution below in Explanation.
Explanation:
* Open the ACM console on the hub.
* Navigate to Governance # Policies .
* Click Create policy .
* Set Name : policy-etcd.
* Choose the policy template/type ETCD Encryption .
* Set Remediation action to enforce .
* inform = report only
* enforce = attempt to automatically remediate to desired state
* Select clusters/ClusterSets to apply (depends on the wizard).
* Click Submit .
* Verify compliance once applied:
* In console, check policy status: Compliant/NonCompliant
* Or via CLI:
* oc get policy -A
* oc describe policy policy-etcd -n < policy-namespace >
Why this matters:
* Governance policies are a core ACM feature for enforcing security baselines across multiple clusters.
質問 # 34
Set TimeWindow for App (Web Console)
Task information: Add timeWindow to Subscription spec (active window Friday 09:00-17:00)
正解：
解説：
See the solution below in Explanation.
Explanation:
* In ACM console go to Applications .
* Select the application you deployed.
* Open the Editor view (YAML editor) for the Subscription object.
* Under spec, add a timeWindow section similar to what the lab requests:
* windowtype: active
* day: Friday
* hours: 09:00-17:00
* Save/apply the changes.
* Verify the Subscription YAML now contains the time window and observe that deployment actions respect the scheduling window.
Why this matters:
* Time windows let you control when changes roll out (useful for change-management, business hours, and maintenance windows).
質問 # 35
Create a Placement that selects clusters by OpenShift version label and exclude a region
正解：
解説：
See the solution below in Explanation.
Explanation:
* Ensure clusters have labels like openshiftVersion=4.18 and region=us-west etc.
* Create placement with matchExpressions (include one label, exclude another):
matchExpressions:
- key: openshiftVersion
operator: In
values: ["4.18"]
- key: region
operator: NotIn
values: ["us-west"]
* Validate PlacementDecision.
質問 # 36
Create a namespace for a team and bind a ManagedClusterSet to that namespace
正解：
解説：
See the solution below in Explanation.
Explanation:
* Create a namespace for the team:
oc new-project team-dev
* Create ManagedClusterSetBinding to bind ClusterSet development into team-dev:
cat < < 'EOF' | oc apply -f -
apiVersion: cluster.open-cluster-management.io/v1beta2
kind: ManagedClusterSetBinding
metadata:
name: development
namespace: team-dev
spec:
clusterSet: development
EOF
* Verify:
oc get managedclustersetbinding -n team-dev
Why this matters:
ClusterSet binding is foundational for scoping access and enabling teams to work only with clusters in their set.
質問 # 37
Install RHACS secured cluster services on managed clusters using a governance policy approach
正解：
解説：
See the solution below in Explanation.
Explanation:
* Use a policy-based deployment model that installs RHACS components consistently across clusters (operator + secured cluster).
* Bind policy to placement selecting target clusters.
* Validate RHACS Sensor/Collector present in expected namespace on managed clusters.
Policy collections exist demonstrating RHACS installation patterns via policy framework.
質問 # 38
......
ベストを体験せよ！EX432試験問題トレーニングを提供しています：https://jp.fast2test.com/EX432-premium-file.html