Question bank
CDP Administrator - Public Cloud
40 CDP Administrator - Public Cloud questions with the correct answer and a written explanation, organised across 6 exam domains.
- 40 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Automation and Operations
6 questions in this domain
- Question 1Single Choice
Which paradigm does the Terraform provider for Cloudera use to manage CDP resources?
- ADeclarativeCorrect answer
- BImperative
- CProcedural
- DFunctional
Why this is the answer
Terraform follows declarative configuration where you define the desired state, not the steps. Cloudera Manager API is imperative.
- Question 2Multiple Select
Which two authentication methods are supported for the Cloudera Manager REST API?
- AOAuth2 with client credentialsCorrect answer
- BAPI keys generated from Management ConsoleCorrect answer
- CSSH key pairs
- DSAML assertions
Why this is the answer
The CM API supports OAuth2 (client ID/secret) and API keys. SSH and SAML are not used.
- Question 3Interactive
Refer to the Terraform code block. Which resource type is used to create a CDP Data Lake?
- Acloudera_environment
- Bcloudera_datalakeCorrect answer
- Ccloudera_datahub
- Dcloudera_cluster
Why this is the answer
The resource cloudera_datalake is used to manage Data Lakes in the Terraform provider.
- Question 4Single Choice
Which type of upgrade updates nodes one at a time to maintain service availability?
- ARolling upgradeCorrect answer
- BExpress upgrade
- CFull downtime upgrade
- DBlue-green upgrade
Why this is the answer
Rolling upgrades update nodes one at a time, keeping services available. Express stops all services.
- Question 5Multiple Select
Which two components must be backed up before upgrading Cloudera Manager?
- ACloudera Manager configuration databaseCorrect answer
- BCluster configuration (via CM export)Correct answer
- CCloud provider SSH keys
- DTerraform state files
Why this is the answer
The CM database and cluster configuration export are essential for recovery. SSH keys and state files are not part of CM backup.
- Question 6Interactive
Examine the Python code snippet using the Cloudera Manager API. What HTTP method is used to scale a Data Hub?
- AGET
- BPOSTCorrect answer
- CPUT
- DDELETE
Why this is the answer
The API uses POST to initiate scaling operations. GET retrieves status, PUT updates configuration.
CDP Public Cloud Architecture
6 questions in this domain
- Question 7Single Choice
What is the name of the shared layer that provides consistent security, governance, and metadata management across all CDP services?
- AData Hub
- BData Engineering
- CShared Data Experience (SDX)Correct answer
- DData Warehouse
Why this is the answer
The Shared Data Experience (SDX) layer provides consistent security, governance, and metadata across all CDP services.
- Question 8Multiple Select
Which two prerequisites must be met before creating a CDP environment in AWS?
- ATwo private subnets in different Availability ZonesCorrect answer
- BA dedicated internet gateway for each subnet
- CA cross-account IAM role with trust from Cloudera control planeCorrect answer
- DA single public subnet for all nodes
Why this is the answer
CDP requires at least two private subnets across two AZs and a cross-account IAM role that the control plane can assume.
- Question 9Interactive
An administrator runs the command shown below and receives the output. What is the most likely cause of the environment status?
- AControl plane outage
- BData plane lost outbound internet accessCorrect answer
- CIncorrect IAM role configuration
- DMissing private hosted zone
Why this is the answer
The environment became DISCONNECTED because the data plane cannot reach the control plane, likely due to lost outbound internet access.
- Question 10Single Choice
Which CDP service provides a fully managed Spark experience where users cannot access cluster nodes?
- AData Hub
- BData Engineering (CDE)Correct answer
- CData Warehouse (CDW)
- DMachine Learning (CML)
Why this is the answer
Data Engineering (CDE) provides a fully managed Spark environment where users submit jobs without cluster access.
- Question 11Multiple Select
Which of the following are true about DNS configuration for CDP on AWS? (Select two.)
- AA private hosted zone must be associated with the VPCCorrect answer
- BDNS resolution and DNS hostnames must be enabled in the VPCCorrect answer
- CThe private hosted zone can be any domain name including public ones
- DCDP uses public DNS for internal service discovery
Why this is the answer
CDP requires a private hosted zone associated with the VPC and DNS resolution/dns hostnames enabled. A public domain would be incorrect.
- Question 12Interactive
The following error occurs when trying to create a new Data Hub cluster. Which two actions can still be performed during this control plane outage?
- ARun existing Spark jobsCorrect answer
- BCreate a new Data Hub cluster
- CModify Ranger policies
- DSubmit a query to an existing Virtual WarehouseCorrect answer
Why this is the answer
During a control plane outage, existing workloads and queries continue, but management operations like creating clusters or modifying policies are blocked.
High Availability and Disaster Recovery
6 questions in this domain
- Question 13Single Choice
What is an Availability Zone in the context of cloud infrastructure?
- AA physically separate location with independent power, networking, and cooling.Correct answer
- BA logical partition of a VPC with identical resources.
- CA single data center with redundant power and cooling.
- DA cloud region's primary data center with high availability.
Why this is the answer
An Availability Zone is a physically isolated data center with independent power, networking, and cooling, used to distribute workloads for fault tolerance.
- Question 14Multiple Select
Which of the following are required for a fault-tolerant CDP control plane deployment across AZs? (Select two.)
- ACloudera Manager and SDX services must be deployed across at least two AZs.Correct answer
- BExplicit AZ mappings must be configured for Data Hub clusters using templates.Correct answer
- CAll services must be deployed in three AZs with equal node distribution.
- DThe control plane can be deployed in a single AZ if managed services are used.
Why this is the answer
The document states that control plane services must span at least two AZs and explicit AZ mappings for Data Hub clusters are required for enterprise deployments.
- Question 15Interactive
In the provided DistCp command, what does the `-bandwidth` parameter control?
- AIt throttles the network bandwidth used during the copy to avoid saturating the network.Correct answer
- BIt specifies the size of files to be copied.
- CIt sets the number of parallel threads for copying.
- DIt compresses the data during transfer.
Why this is the answer
The `-bandwidth` parameter limits the average bandwidth (in MB/s) used by DistCp to prevent network saturation.
- Question 16Single Choice
Where are HBase snapshots initially stored before being exported to a backup location?
- AIn the HDFS directory of the HBase installation.Correct answer
- BIn the cloud object store associated with the cluster.
- CIn the HBase Write-Ahead Logs directory.
- DIn a temporary location that is cleared after export.
Why this is the answer
HBase snapshots are stored in HDFS under the HBase installation directory; they must be explicitly exported to a backup location for DR.
- Question 17Multiple Select
Which components of the Shared Data Experience (SDX) require separate replication across regions for DR? (Select two.)
- ARanger policiesCorrect answer
- BApache Atlas metadataCorrect answer
- CHive table data stored in S3
- DKafka topic configurations
Why this is the answer
Ranger policies and Atlas metadata require manual export/import; cloud storage replication covers data but not these SDX components.
- Question 18Interactive
In the cross-region failover process shown, why is updating DNS records necessary?
- ATo route application traffic to the new Data Hub endpoints in the secondary region.Correct answer
- BTo enable cross-region replication for the data catalog.
- CTo authenticate users with the secondary cluster.
- DTo update security group rules for the new region.
Why this is the answer
Updating DNS records directs client connections to the active Data Hub endpoints in the secondary region after failover.
Installation and Configuration
8 questions in this domain
- Question 19Single Choice
Which component is the core deployment engine for CDP Public Cloud environments?
- ACloudbreakCorrect answer
- BCloudera Manager
- CTerraform
- DApache Atlas
Why this is the answer
Cloudbreak is the core deployment engine that automates provisioning of CDP Public Cloud environments, including Data Lakes and Data Hubs.
- Question 20Multiple Select
Which tools are used for provisioning CDP Public Cloud environments? (Select two.)
- ACloudbreakCorrect answer
- BCloudera Manager
- CTerraformCorrect answer
- DApache Ranger
Why this is the answer
Cloudbreak is the native provisioning engine, while Terraform can be used via Cloudera-provided modules for infrastructure-as-code.
- Question 21Interactive
Review the CDP CLI command below. Which action does it perform?
- ACreates a new CDP environment on AWSCorrect answer
- BCreates a new Data Hub cluster
- CDescribes a Data Lake
- DUpdates Ranger policies
Why this is the answer
The command 'cdp environments create-aws-environment' is used to create a new CDP environment in AWS.
- Question 22Single Choice
What is the primary role of HDFS in CDP Public Cloud?
- APersistent storage for data lake
- BIntermediate scratch space for YARN and SparkCorrect answer
- CReplication of data for durability
- DResource management and scheduling
Why this is the answer
In CDP Public Cloud, HDFS is primarily used for intermediate data such as YARN logs and Spark shuffle, while persistent data is stored in cloud object stores.
- Question 23Multiple Select
Which configurations are required to enable Hive ACID transactions? (Select two.)
- Ahive.support.concurrency=trueCorrect answer
- Bhive.execution.engine=mr
- Chive.txn.manager=org.apache.hadoop.hive.ql.lockmgr.DbTxnManagerCorrect answer
- Ddfs.replication=3
Why this is the answer
Hive ACID requires concurrency support and the DbTxnManager. MapReduce engine is not recommended and dfs.replication is irrelevant for cloud storage.
- Question 24Interactive
Examine the YARN configuration snippet. What auxiliary service is being enabled?
- ASpark shuffle serviceCorrect answer
- BMapReduce shuffle service
- CHive LLAP service
- DKafka service
Why this is the answer
The property 'yarn.nodemanager.aux-services' with value 'spark_shuffle' enables the Spark external shuffle service on YARN NodeManagers.
- Question 25Single Choice
Which component serves as the central metadata repository in CDP SDX?
- AData CatalogCorrect answer
- BApache Atlas
- CApache Ranger
- DKnox Gateway
Why this is the answer
The Data Catalog is the central metadata repository in SDX, storing information about databases, tables, and schemas.
- Question 26Multiple Select
Which services are integrated into the CDP Shared Data Experience (SDX)? (Select two.)
- AApache RangerCorrect answer
- BApache AtlasCorrect answer
- CHDFS
- DYARN
Why this is the answer
SDX includes Apache Ranger for authorization and Apache Atlas for lineage and classification. HDFS and YARN are compute/storage services, not governance components.
Security and Governance
8 questions in this domain
- Question 27Single Choice
Which component in CDP Public Cloud is responsible for fine-grained authorization and auditing of data access?
- AApache RangerCorrect answer
- BApache Knox
- CApache Atlas
- DKerberos
Why this is the answer
Apache Ranger is the component that provides fine-grained authorization policies and audit logging across CDP services. Knox is an authentication gateway, Atlas handles metadata, and Kerberos handles service-to-service authentication.
- Question 28Multiple Select
Which two components are primarily responsible for user and service authentication in CDP Public Cloud? (Choose two.)
- AKerberosCorrect answer
- BApache Ranger
- CApache KnoxCorrect answer
- DApache Atlas
Why this is the answer
Kerberos authenticates services internally, while Knox authenticates external users via LDAP or SSO. Ranger authorizes; Atlas classifies metadata.
- Question 29Interactive
Review the Knox topology configuration snippet below. Which authentication provider is being used?
- ALDAP authenticationCorrect answer
- BKerberos authentication
- CSAML authentication
- DShiro static authentication
Why this is the answer
The presence of <param name='ldapRealm'/> and <provider>LdapProvider</provider> indicates LDAP authentication is configured.
- Question 30Single Choice
What is the purpose of Apache Knox in CDP Public Cloud?
- AA reverse proxy gateway that provides a single entry point for REST API calls and handles authenticationCorrect answer
- BA fine-grained authorization engine for Hive and HBase
- CA metadata repository for data lineage and classification
- DA Kerberos Key Distribution Center (KDC) for the cluster
Why this is the answer
Knox is a reverse proxy that terminates external connections, authenticates users, and forwards requests to internal services. It does not perform fine-grained authorization or store metadata.
- Question 31Multiple Select
Which two statements about encryption in CDP Public Cloud are correct? (Choose two.)
- AEncryption at rest for cloud object stores uses provider-managed or customer-managed keysCorrect answer
- BHDFS encryption zones are managed by Apache Atlas
- CTLS 1.2 is the minimum version enforced for service-to-service communicationCorrect answer
- DCloud KMS key rotation automatically re-encrypts all existing data in the bucket
Why this is the answer
CDP uses cloud KMS for object store encryption and enforces TLS 1.2+. HDFS zones are managed by Ranger KMS, not Atlas. Key rotation affects only new writes.
- Question 32Interactive
Examine the audit log entry below. Which component generated this log?
- AApache RangerCorrect answer
- BApache Atlas
- CApache Knox
- DKerberos KDC
Why this is the answer
The log shows user, resource, action, and result (Allow/Deny), which is typical of Ranger audit events. Atlas audits metadata changes, Knox audits gateway access, and Kerberos logs ticket events.
- Question 33Single Choice
In CDP Public Cloud, what is the role of the Ranger User Sync (usersync) process?
- AIt synchronizes users and groups from an external directory (LDAP) into the Ranger databaseCorrect answer
- BIt establishes Kerberos tickets for Ranger admin users
- CIt pushes Ranger policies to Data Hub plugins
- DIt rotates TLS certificates for Ranger services
Why this is the answer
Ranger usersync pulls users and groups from LDAP or UNIX to populate the Ranger admin database, enabling policy assignment. Policy distribution is done by the Ranger plugin sync mechanism.
- Question 34Multiple Select
Which two services are part of the Cloudera Shared Data Experience (SDX) for security and governance? (Choose two.)
- AApache AtlasCorrect answer
- BApache RangerCorrect answer
- CApache Knox
- DApache Oozie
Why this is the answer
Atlas provides metadata classification and lineage; Ranger provides authorization and auditing. Together they form the SDX governance layer. Knox is a gateway, Oozie is a workflow scheduler.
Troubleshooting and Monitoring
6 questions in this domain
- Question 35Single Choice
When a DataLake creation times out, what is the first step to diagnose the issue?
- AVerify VPC/subnet routing and security group inbound/outbound rulesCorrect answer
- BRestart the DataLake services
- CCheck the YARN Resource Manager for queue capacity
- DUpdate the FreeIPA certificate
Why this is the answer
In CDP Public Cloud, the first step is to check network-level configurations such as security groups and routing, as misconfigured firewall rules are a common cause of deployment failures.
- Question 36Multiple Select
Which of the following are common symptoms of resource contention in YARN?
- AJob stays in ACCEPTED stateCorrect answer
- BContainer allocation delaysCorrect answer
- CHigh network latency
- DKerberos authentication failures
Why this is the answer
Resource contention in YARN often causes jobs to remain in ACCEPTED state and containers to be allocated slowly due to insufficient queue capacity or memory.
- Question 37Interactive
Examine the following command: `nc -zv hive-metastore.service.consul 9083`. What is its primary purpose?
- AVerifies network connectivity to the Hive Metastore Thrift portCorrect answer
- BChecks the status of the Hive Metastore service
- CTests Kerberos authentication
- DMonitors YARN container allocation
Why this is the answer
The `nc -zv` command performs a port scan to check if the specified port (9083 for Hive Metastore) is reachable from the client, which is the first step in diagnosing connection failures.
- Question 38Single Choice
Which Cloudera Manager alert severity indicates that immediate action is required?
- ACRITICALCorrect answer
- BIMPORTANT
- CINFORMATIONAL
- DWARNING
Why this is the answer
CRITICAL alerts in Cloudera Manager signify that a service or host is in a state requiring immediate action to prevent outage.
- Question 39Multiple Select
Which of the following are sources of monitoring data in CDP Public Cloud?
- ACloudera Manager alertsCorrect answer
- BCloud provider metricsCorrect answer
- CService logsCorrect answer
- DCDP CLI commands
Why this is the answer
Monitoring in CDP Public Cloud relies on Cloudera Manager alerts for stack health, cloud provider metrics for infrastructure, and logs for forensic analysis.
- Question 40Interactive
Review the command: `kinit -kt /etc/security/keytabs/hive.service.keytab hive/ipaserver.cdp.cloudera.site`. What is it used for?
- AAuthenticate a Hive service principal using a keytabCorrect answer
- BCheck the expiration date of the keytab
- CList all Kerberos tickets
- DRenew a Kerberos ticket
Why this is the answer
The `kinit -kt` command uses a keytab file to obtain a Kerberos ticket for a principal without interactive entry, used to verify authentication configuration.
Frequently asked questions
Everything about the CDP Administrator - Public Cloud question bank and how to use it.