EX432 Exam Dumps and Practice Questions

Web Console Operators OperatorHub

Search for multicluster engine (or Multicluster Engine Operator).

Install the operator into its recommended namespace (commonly multicluster-engine).

Create the MultiClusterEngine custom resource (CLI method shown below):

cat <<'EOF' | oc apply -f -

apiVersion: multicluster.openshift.io/v1

kind: MultiClusterEngine

metadata:

name: multiclusterengine

spec: {}

EOF

Verify the engine reconciles:

oc get multiclusterengine

oc get pods -n multicluster-engine

Why this matters:

ACM can use the multicluster engine operator for cluster lifecycle functions; Red Hat documents cluster lifecycle with multicluster engine as a core capability.

Confirm the policy exists in the namespace:

oc get policy -n team-dev

Confirm Placement exists and selects clusters:

oc get placement -n team-dev

oc get placementdecision -n team-dev

Confirm PlacementBinding points to correct placement + policy:

oc get placementbinding -n team-dev -o yaml

Fix common mistakes:

wrong namespace

placement name mismatch

missing ClusterSetBinding in the namespace

Why this matters:

Policy framework requires placement + binding; missing/incorrect targeting is the #1 real-world issue.

Policies in ACM require:

a Policy resource

a Placement (which clusters to target)

a PlacementBinding (bind policy placement)

Create the Policy (in team-dev) enforcing a namespace audit-logs:

cat <<'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: Policy

metadata:

name: policy-ensure-audit-namespace

namespace: team-dev

spec:

remediationAction: enforce

disabled: false

policy-templates:

- objectDefinition:

apiVersion: policy.open-cluster-management.io/v1

kind: ConfigurationPolicy

metadata:

name: ensure-audit-namespace

spec:

remediationAction: enforce

severity: low

object-templates:

- complianceType: musthave

objectDefinition:

apiVersion: v1

kind: Namespace

metadata:

name: audit-logs

EOF

Create PlacementBinding to bind it to dev-clusters placement:

cat <<'EOF' | oc apply -f -

apiVersion: policy.open-cluster-management.io/v1

kind: PlacementBinding

metadata:

name: bind-policy-ensure-audit-namespace

namespace: team-dev

placementRef:

apiGroup: cluster.open-cluster-management.io

kind: Placement

name: dev-clusters

subjects:

- apiGroup: policy.open-cluster-management.io

kind: Policy

name: policy-ensure-audit-namespace

EOF

Verify compliance:

oc get policy -n team-dev

oc describe policy policy-ensure-audit-namespace -n team-dev

Why this matters:

This is the core ''ACM governance'' exam pattern: define desired state and enforce across clusters.

Patch remediation to inform:

oc patch policy policy-ensure-audit-namespace -n team-dev --type=merge -p '{'spec':{'remediationAction':'inform'}}'

Verify:

oc get policy policy-ensure-audit-namespace -n team-dev -o yaml | grep remediationAction -n

Observe compliance changes (policy will report but not auto-fix).

Open the ACM console on the hub.

Navigate to Governance Policies.

Click Create policy.

Set Name: policy-etcd.

Choose the policy template/type ETCD Encryption.

Set Remediation action to enforce.

inform = report only

enforce = attempt to automatically remediate to desired state

Select clusters/ClusterSets to apply (depends on the wizard).

Click Submit.

Verify compliance once applied:

In console, check policy status: Compliant/NonCompliant

Or via CLI:

oc get policy -A

oc describe policy policy-etcd -n

Why this matters:

Governance policies are a core ACM feature for enforcing security baselines across multiple clusters.