Practice for the Red Hat Certified Specialist in OpenShift AI (EX267) exam with 18 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What token mechanism protects model deployment endpoints when "Require Token Authentication" is enabled in OpenShift AI?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the Red Hat Certified Specialist in OpenShift AI (EX267) practice test →
What you will practice
- What token mechanism protects model deployment endpoints when "Require Token Authentication" is enabled in Op…
- Which Git protocol allows programmatic synchronization of notebooks with automatic authentication in OpenShif…
- Which metrics parameter can be configured to alert administrators when a model server is experiencing high la…
- Which open source utility provides the distributed object tracing and telemetry views across active microserv…
- Which parameter must match between a Data Connection and a Workbench to ensure successful storage integration?
- Which operator must be installed as a prerequisite before deploying the Red Hat OpenShift AI Operator?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What token mechanism protects model deployment endpoints when "Require Token Authentication" is enabled in OpenShift AI?
Answer: B. JSON Web Tokens (JWT) via OpenShift OAuth/ServiceAccount tokens
OpenShift AI secures deployed model endpoints using JSON Web Tokens tied to OpenShift OAuth. This ensures reliable native identity validation, unlike static API keys, which require manual rotation and lack native platform integration.
Q2. Which Git protocol allows programmatic synchronization of notebooks with automatic authentication in OpenShift AI?
Answer: B. HTTPS with OAuth/PAT
HTTPS with OAuth or personal access tokens is required for programmatic Git synchronization in OpenShift AI workbenches. FTP and SVN are not supported, while local host mapping does not provide remote repository authentication.
Q3. Which metrics parameter can be configured to alert administrators when a model server is experiencing high latency?
Answer: D. Prometheus Alertmanager rules targeting model serving metrics
Prometheus Alertmanager rules are configured to trigger alerts based on model serving metrics. JupyterLab timeouts or web console restarts do not provide observability into runtime model serving latency.
Q4. Which open source utility provides the distributed object tracing and telemetry views across active microservices?
Answer: D. Jaeger Tracing Engine
Jaeger provides distributed tracing and telemetry views for microservices. Fluentd handles log collection, Prometheus handles metrics, and Grafana handles dashboards, but only Jaeger maps distributed request traces.
Q5. Which parameter must match between a Data Connection and a Workbench to ensure successful storage integration?
Answer: A. The namespace/project in which both resources reside
Data Connections and Workbenches must reside in the same namespace to mount storage successfully. Kubernetes requires resources to be in the same project to allow mounting secrets and persistent volume claims across pods.
Q6. Which operator must be installed as a prerequisite before deploying the Red Hat OpenShift AI Operator?
Answer: C. Red Hat OpenShift Service Mesh Operator
The OpenShift Service Mesh Operator is a required prerequisite because it handles traffic routing for serving runtimes. Other operators like GitOps or Pipelines are optional for CI/CD but not strictly required for the base deployment.
Q7. How can an administrator inject a dedicated GPU resource allocation policy directly into a user workbench?
Answer: D. NodeSelector and Tolerations
Administrators use NodeSelectors and Tolerations to target specific GPU nodes. Quotas and LimitRanges restrict resource counts but do not guarantee placement on specialized hardware like GPU nodes.
Q8. How can an analytics team share a data science project environment with another user without giving cluster-wide rights?
Answer: A. Assign OpenShift project-level permissions (RBAC) via the project dashboard
Assigning project-level RBAC permissions directly restricts a user's access to a specific OpenShift AI project. Sharing cluster-admin credentials or adding users to global groups violates the principle of least privilege and creates unnecessary security risks.
Q9. When a model is deployed using ModelMesh, what optimization benefit does it provide over standard single-model deployments?
Answer: C. It packs multiple models into intelligent shared serving pods to maximize resource usage
ModelMesh maximizes resource utilization by intelligently packing multiple models into shared serving pods. It does not mandate physical GPUs for every model, nor does it eliminate the requirement for persistent storage when loading models.
Q10. Which pipeline component allows users to visualize training metrics like ROC curves and confusion matrices directly inside the dashboard UI?
Answer: C. Pipeline Artifacts and structural metadata outputs mapped to specific formats
Viewing training metrics like ROC curves in the dashboard requires defining pipeline artifacts and structural metadata. Raw standard output logs or generic cluster logging outputs lack the structured data needed to render visual charts.
Q11. What strategy does ModelMesh use to handle instances when more models are registered than can fit simultaneously in memory?
Answer: D. Intelligent model caching and dynamic loading/unloading
ModelMesh uses intelligent caching to dynamically load and unload models based on demand. This prevents memory exhaustion without rejecting registrations, ensuring efficient resource management across the shared serving environment.
Q12. Which custom resource defines a deployed model instance within the ModelMesh serving architecture?
Answer: B. InferenceService
The InferenceService custom resource defines the actual deployed model endpoint in KServe and ModelMesh. ModelServingRuntime defines the environment, like the runtime container, while InferenceService deploys the specific model payload.
Q13. Which log file or stream should you inspect if a workbench fails to pull its container image?
Answer: C. The workbench pod events and description via oc describe pod
Using oc describe pod on the failing workbench pod reveals Kubernetes events, including image pull failures. If the issue is an incorrect tag or registry auth error, the pod events will explicitly show the ImagePullBackOff status.
Q14. Which API group defines OpenShift AI pipeline resources within the cluster?
Answer: C. kubeflow.org or datasciencepipelines.opendatahub.io
Data Science Pipelines rely on API groups like datasciencepipelines.opendatahub.io or kubeflow.org to define resources. Knowing these API groups is crucial when applying YAML manifests to create runs or schedules via oc apply.
Q15. What terminal command allows you to view the logs of the Red Hat OpenShift AI operator pod?
Answer: B. oc logs -n redhat-ods-operator deployment/rhods-operator
The command uses the oc logs utility targeting the rhods-operator deployment in its specific redhat-ods-operator namespace. While option C uses labels, specifying the deployment directly ensures you get the exact operator pod logs.
Q16. To inject environment variables safely into a workbench, which Kubernetes resource should be mapped to the workbench configuration?
Answer: B. Secret
Kubernetes Secrets are designed to securely store and inject sensitive environment variables into pods like workbenches. CustomResourceDefinitions define new resource types rather than holding runtime variables.
Q17. What type of resource isolation ensures that a noisy data science workload does not starve other business applications on the same cluster?
Answer: B. Resource quotas, requests/limits, and node taints/tolerations
Applying requests, limits, and quotas directly restricts compute consumption, preventing workloads from starving neighboring applications. Network policies alone only isolate traffic, not memory or CPU resources.
Q18. What token mechanism identifies a user session when accessing the OpenShift AI dashboard through a web browser?
Answer: B. OpenShift OAuth proxy access token
The OpenShift AI dashboard integrates with standard OpenShift OAuth to manage browser sessions via access tokens. Static root passwords or anonymous guest access violate cluster security policies.
More Red Hat Certified Specialist in OpenShift AI (EX267) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.