Free PORTWORX-ENTERPRISE-PROFESSIONAL Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The Portworx OCI monitor (px-oci-mon) is a critical component that runs as a container within the Portworx DaemonSet on each node. Its primary function is to act as a watchdog for the node's health from a storage perspective. It continuously monitors the state of the underlying OCI-compliant container runtime (like containerd or Docker) and the main Portworx service. If it detects that either of these essential services has become unresponsive, it will take corrective action, such as restarting the Portworx container, to restore the node's functionality and ensure the stability of the Portworx storage cluster.

A. To facilitate the installation of Portworx: Installation is handled by the Portworx Operator or by applying Kubernetes spec files, not by the OCI monitor, which operates post-installation.

C. To manage Kubernetes network policies: Network policy enforcement is the responsibility of a Container Network Interface (CNI) plugin (e.g., Calico, Weave), not the Portworx storage layer.

1. Portworx Enterprise Documentation: In the section describing the components

the OCI monitor is explicitly defined. "The Portworx DaemonSet... includes the following containers: ... px-oci-mon: Monitors the OCI container runtime and restarts Portworx if it becomes unresponsive."

Source: Portworx Docs

Reference > Components > Portworx components on Kubernetes.

2. Portworx Enterprise Documentation: The troubleshooting guide for unresponsive nodes implicitly details the role of health monitoring components like the OCI monitor. It explains that if the Portworx daemon on a node becomes unhealthy

the monitor attempts to recover it.

Source: Portworx Docs

Operate and Maintain > Troubleshoot Portworx > Troubleshoot nodes > Node is down.

Portworx classifies every alert into one of three severities to indicate urgency and recommended operator action. The official Portworx alert documentation states that each alert is tagged as either INFO (informational, no action), WARNING (requires attention soon), or CRITICAL (requires immediate action). These are the only three severities defined in the product, so option B is the exclusive correct choice.

A. Uses “ERROR”; Portworx never assigns “ERROR” as an alert severity.

C. Uses “ALARM”; “ALARM” is not a recognised severity label in Portworx alerts.

1. Pure Storage Portworx Documentation – “Monitor Portworx › Alerts” section

paragraph “Alert format”

URL: https://docs.portworx.com/portworx-install-with-kubernetes/operate-and-maintain-on-kubernetes/alerts/

(States: “severity: INFO | WARNING | CRITICAL”)

2. Pure Storage Portworx Enterprise 2.6 Admin Guide

Chapter 7 “Alert Reference”

p. 125–126

(Lists each alert with a ‘severity’ field whose possible values are only INFO

WARNING

CRITICAL.)

Portworx defragmentation is an I/O-intensive operation designed to reclaim space and improve the performance of volumes. Because of its resource-intensive nature, it can impact the performance of active applications. By setting a defragmentation schedule, administrators can automate this task to run during periods of low cluster workload, such as nights or weekends. This ensures that the performance benefits of defragmentation are achieved without negatively affecting production services during peak hours.

B. To back up data to the cloud.

This is incorrect. Portworx uses separate features like CloudSnaps or PX-Backup for backing up data to cloud object stores, which is a distinct process from defragmentation.

C. To monitor the health of the storage cluster.

This is incorrect. Cluster health is monitored using tools like pxctl status, the Portworx monitoring stack (Prometheus/Grafana), or other observability platforms, not by scheduling defragmentation.

1. Portworx Enterprise Documentation

"Defragmentation": "Defragmentation is an I/O intensive operation

so you should run it during a maintenance window or when your cluster is not under a heavy I/O load. You can schedule defragmentation to run at a specific time on a recurring basis to avoid impacting your applications." (This section explicitly states the purpose is to improve performance and the reason for scheduling is to run during low workload periods).

2. Portworx Enterprise Documentation

"pxctl volume commands"

pxctl volume defrag schedule create: The documentation for this command details how to "Create a recurring defragmentation schedule for a volume

" providing options for daily

weekly

and monthly schedules at specific times

reinforcing the concept of running the operation during planned

low-impact windows.

In a modern Portworx deployment on Kubernetes managed by an Operator, the standard and recommended method for verification is through Kubernetes-native tooling. The kubectl get storagenodes command queries the StorageNode Custom Resource Definition (CRD), which is the authoritative representation of the Portworx nodes within the Kubernetes API. The output directly displays the status, and most importantly, the VERSION of the Portworx software on each node. This aligns with the declarative, Operator-driven management paradigm, which is the current best practice for running complex stateful services on Kubernetes.

A. pxctl get storagenodes: While this command provides similar information by querying the Portworx daemon directly, the Kubernetes-native approach (kubectl) is the recommended practice for verification in modern, Operator-managed environments.

C. kubectl get nodes -o wide: This command displays information about the Kubernetes cluster nodes (like OS and kernel version), not the version of the Portworx application running on them.

1. Portworx Enterprise Documentation

"Upgrade Portworx on Kubernetes using the Operator": In the section "Verify the Portworx upgrade

" the documentation explicitly instructs the administrator to use kubectl: "Verify that all Portworx pods are running the upgraded version... You can verify this by running the kubectl get storagenodes -n kube-system command and looking at the VERSION column."

2. Portworx Enterprise Documentation

"Monitor Portworx on Kubernetes": In the section "Monitor Portworx components

" the documentation states: "The Portworx Operator creates StorageNode and StorageCluster objects... You can view the status of your storage nodes by running the kubectl get storagenodes command." This reinforces that querying the StorageNode CRD is the standard monitoring and verification procedure.

3. Kubernetes Documentation

"Custom Resources": This documentation explains the concept of Custom Resource Definitions (CRDs) and how kubectl is the standard tool for interacting with these resources. The StorageNode object is a CRD installed by Portworx

making kubectl get storagenodes the correct

Kubernetes-native interaction pattern.

To expose Portworx metrics to an externally managed Prometheus instance, the administrator must modify the StorageCluster custom resource. The correct method is to set the exportMetrics flag to true under the spec.monitoring.prometheus path. This declarative approach instructs the Portworx Operator to create the necessary ServiceMonitor or PodMonitor resources that the external Prometheus Operator can discover, allowing it to scrape metrics from Portworx pods without deploying the Portworx-internal Prometheus stack.

B. The exportMetrics field is incorrectly placed. According to the StorageCluster CRD schema, it must be nested within the prometheus object, not directly under monitoring.

C. Using pxctl is an imperative command. The standard, declarative, and idempotent method for managing cluster-wide configuration in an operator-managed Portworx installation is by modifying the StorageCluster object.

1. Portworx Enterprise Documentation

"Monitor Portworx with Prometheus": This official document details the configuration for monitoring. In the section "Using an existing Prometheus Operator

" it explicitly states: "If you want to use an existing Prometheus Operator to monitor Portworx

you must enable the exportMetrics flag in the StorageCluster spec." It then provides the exact YAML structure shown in option A.

Source: Portworx by Pure Storage Official Documentation. Navigate to the Monitor and Troubleshoot -> Monitor Portworx with Prometheus -> Using an existing Prometheus Operator section.

2. Portworx Enterprise Documentation

"Portworx Operator Spec / CRD Reference": The reference for the StorageCluster Custom Resource Definition confirms the object hierarchy. The monitoring spec contains a prometheus object

which in turn contains the exportMetrics boolean field. This schema validates that spec.monitoring.prometheus.exportMetrics is the correct path.

Source: Portworx by Pure Storage Official Documentation. Navigate to the Reference -> Portworx Operator on Kubernetes -> Operator Spec / CRD Reference section and inspect the StorageCluster spec.

To enable security and disable guest access using the Portworx Operator, the StorageCluster custom resource must be modified. The spec.security.enabled field must be set to the boolean value true. To control guest access, the spec.security.auth.guestAccess field must be set to the boolean value false. This configuration explicitly activates Portworx security features and ensures that only authenticated users can access the storage cluster, aligning with security best practices.

A: The guestAccess field requires a boolean value (true or false), not a string like 'Disabled'. This would result in a configuration error.

B: The security field is an object that contains multiple configuration keys. Assigning it a single string value like 'Enabled' is an invalid structure for the StorageCluster spec.

1. Portworx Enterprise Documentation: Enable Portworx Security with the Operator. This document details the StorageCluster spec for enabling security. It explicitly shows the required structure:

yaml

spec:

security:

enabled: true

This confirms the first part of the correct answer.

2. Portworx Enterprise Documentation: Secure -> Authentication -> Configure guest access. This section specifies how to manage guest access for authenticated clusters. It states

"To disable guest access

set the guestAccess field to false in the auth section of your StorageCluster spec":

yaml

spec:

security:

enabled: true

auth:

guestAccess: false

This directly validates that option C is the correct and complete configuration.

The recommended practice for managing the lifecycle of snapshots in Portworx is to configure retention policies. Portworx provides native tools, such as the pxctl command-line interface, to create automated snapshot schedules. These schedules can include a retention policy using the --retain flag, which specifies the number of snapshots to keep. When a new snapshot is created beyond this limit, the oldest one is automatically deleted. This policy-driven approach ensures efficient storage utilization, prevents uncontrolled data growth, and eliminates the need for manual, error-prone cleanup tasks, making it the most scalable and reliable method.

A. Manually deleting old snapshots is not a recommended practice because it is inefficient, not scalable, and susceptible to human error, especially in large-scale environments.

C. Retaining all snapshots indefinitely is impractical and unsustainable. It leads to excessive storage consumption, increased costs, and complex management overhead.

1. Portworx Enterprise Documentation

"Create and use local snapshots

" section "Schedule snapshots." This section details the pxctl volume snapshot schedule create command

which includes the --retain flag. The documentation states

"--retain specifies how many snapshots to retain. Once the schedule creates the specified number of snapshots

it deletes the oldest snapshot before creating a new one." This directly supports the use of retention policies for lifecycle management.

2. Portworx Enterprise Documentation

"pxctl reference

" section "pxctl volume snapshot schedule create." The command reference explicitly defines the --retain option as the mechanism to "Specify number of snapshots to retain." This confirms that retention is a built-in

configurable feature intended for managing the number of snapshots.

Portworx Autopilot is a rule-based automation engine designed to manage storage operations within a Portworx cluster without manual intervention. Its primary function is to monitor the state of storage resources, such as Persistent Volume Claims (PVCs), and automatically trigger predefined actions when specific conditions are met. A common use case is to define a rule that monitors a volume's usage percentage and automatically expands the volume's size once it crosses a specified threshold, ensuring applications do not run out of space.

A. Migration of containers and applications across clusters is a disaster recovery or application mobility function, which is primarily handled by Portworx DR (PX-DR) and Stork.

B. Enhanced security features, such as role-based access control (RBAC) and volume encryption, are managed by the Portworx Security component, not Autopilot.

1. Portworx Enterprise Documentation

"Autopilot Overview": "Portworx Autopilot is a rule-based engine that allows you to programmatically and automatically manage your Portworx cluster. Autopilot allows you to specify conditions and actions to automate common maintenance operations

such as volume expansion or pool rebalancing."

Source: Portworx Official Documentation

Operate and Maintain -> Autopilot -> Overview.

2. Portworx Enterprise Documentation

"Automatically resize a PVC": This section provides a specific example of an AutopilotRule object. The rule's conditions are set to pvc.usagepercentage > 60

and the actions are configured to perform a px.volume.resize to increase the volume size by 50%. This directly demonstrates the automated expansion of volumes based on rules.

Source: Portworx Official Documentation

Operate and Maintain -> Autopilot -> Use-cases -> Automatically resize a PVC.

3. Portworx Enterprise Documentation

"Portworx DR": "Portworx DR allows you to migrate applications and their data between clusters over a wide-area network (WAN)." This clearly distinguishes the function of disaster recovery from Autopilot's role.

Source: Portworx Official Documentation

Backup and Recovery -> Portworx DR.

Stork is Portworx's storage-aware scheduler for Kubernetes. Its architecture consists of two primary components that integrate with the native Kubernetes scheduler. The first is the Stork scheduler plugin, which runs as a separate pod and can be configured as the scheduler for specific applications. The second is a scheduler extender, which is a webhook that the default Kubernetes scheduler calls. This extender allows Stork to filter and prioritize nodes for pods using Portworx volumes, ensuring pods are co-located with their data to optimize performance and availability.

B. Stork snapshots and restores are features or operations that Stork orchestrates for data protection, not its fundamental architectural components.

C. An object store, such as an S3 bucket, is an external location used by Portworx to store backups, not an internal component of Stork.

1. Portworx Documentation

"Stork on Kubernetes": "Stork is a scheduler extender. It allows a user to co-locate pods with their data

enabling hyperconvergence. Stork also provides the ability to seamlessly migrate your applications and data from one Kubernetes cluster to another." This section explicitly identifies Stork as a scheduler extender.

2. Portworx Documentation

"Install Stork": The installation instructions detail the deployment of both the stork (controller/operator) and stork-scheduler components

confirming the two-part nature of its scheduler functionality.

3. Portworx Documentation

"Scheduler Extender": "Stork is a scheduler extender plugin for Kubernetes. When a pod is scheduled

the default Kubernetes scheduler makes an API call to the Stork extender. The Stork extender inspects the pod and if it uses Portworx volumes

it finds the best nodes for the pod to run on." This page details the function of the extender component.

The Kubernetes secret named px-kvdb-auth is used to store authentication credentials required for Portworx to connect to a secure, external key-value database (KVDB) like etcd or Consul. When the external KVDB is secured using TLS, this secret must contain the necessary client certificate, client private key, and the CA certificate. The Portworx Operator or DaemonSet references this secret to establish a secure, authenticated connection to the KVDB for storing cluster metadata.

A. px-kvdb: This is an incorrect name. While related to the KVDB, it is not the standard name for the secret containing TLS authentication certificates.

B. px-kvdb-cert: This name is descriptive but not the one specified in the official Portworx documentation for storing KVDB authentication materials.

1. Portworx Enterprise Documentation - Install Portworx on Kubernetes -> Prerequisites -> Key-value store: "If you are using a secure etcd

you need to create a secret called px-kvdb-auth in the kube-system namespace with the following files: ca.crt

etcd-client.crt

etcd-client.key." This section explicitly names the secret.

2. Portworx Enterprise Documentation - Use an external key-value store -> Secure etcd with TLS: "Create a Kubernetes secret called px-kvdb-auth with the client certificate

key

and CA certificate you generated in the previous section." This guide provides a step-by-step process

reinforcing the required secret name.

3. Portworx Enterprise Documentation - Reference -> StorageCluster -> kvdb: The StorageCluster Custom Resource Definition (CRD) includes the field spec.kvdb.authSecret. The documentation notes: "Name of the secret that has the credentials for the KVDB. If the secret is not provided

Portworx will use the default secret name px-kvdb-auth." This confirms the default and expected name.

The Application Backup feature in Stork, which enables the backup of both application data (PVCs) and its corresponding Kubernetes object configurations (such as Deployments, Services, and ConfigMaps), was introduced in Stork version 2.3. Versions prior to 2.3 only supported snapshotting Portworx volumes without the associated application context. Therefore, 2.3 is the minimum required version to perform an Application Backup.

A. Any Stork version works: This is incorrect because the Application Backup feature, which uses the ApplicationBackup CRD, was a specific feature introduced in version 2.3 and is not present in earlier versions.

B. Stork 23.3.0: While this version and later versions support Application Backups, it is not the minimum required version. The functionality has been available since the much earlier 2.3 release.

1. Portworx Official Documentation

"Backup and restore applications using Stork": Under the "Prerequisites" section

the documentation explicitly states the minimum version requirement.

Reference: "Stork version 2.3 or newer."

Source: Portworx Enterprise Documentation

Storage Operations -> Backup and Restore -> Stork -> Backup and restore applications using Stork. (The exact URL may change

but the path within the documentation hierarchy is consistent).

When troubleshooting a down Portworx node, the first and most fundamental step is to verify the health of the underlying Kubernetes infrastructure. Portworx runs as a daemonset on Kubernetes nodes, and its health is directly dependent on the node's status. The command kubectl get node -o wide provides a cluster-wide overview, confirming if all nodes are in a Ready state and can schedule pods. If a Kubernetes node is NotReady, no application-level troubleshooting for Portworx on that node will succeed until the underlying node issue is resolved. This approach follows the standard bottom-up troubleshooting methodology, starting with the foundational layer (Kubernetes) before moving to the application layer (Portworx).

A. pxctl status to check the status of Portworx on the node.

This command checks the Portworx application status. It is a secondary step, as it will likely fail or provide misleading information if the underlying Kubernetes node is not healthy.

C. journalctl -u kubelet to identify the problem on the node.

This is a deep-dive diagnostic command to check kubelet logs. It is typically used after kubectl get node has identified a specific node as NotReady or unhealthy.

1. Portworx Enterprise Documentation

"Troubleshoot Portworx on Kubernetes": The official troubleshooting guide for Portworx on Kubernetes consistently uses kubectl commands as the initial step to assess the state of the environment. For instance

in the section "Portworx pods are not running

" the first action is to use kubectl get pods and kubectl describe pod

which presumes the Kubernetes nodes themselves are functional. Verifying node status with kubectl get nodes is the prerequisite step to ensure the scheduler can even attempt to place pods.

Source: Portworx Enterprise Documentation

Section: Monitor and Troubleshoot -> Troubleshoot Portworx -> Troubleshoot Portworx on Kubernetes.

2. Portworx Enterprise Documentation

"Prerequisites": All installation guides for Portworx on any Kubernetes distribution list a healthy

functional Kubernetes cluster as a primary prerequisite. A core indicator of a healthy cluster is that all nodes are in the Ready state. Therefore

checking this status is the logical first step in any troubleshooting scenario that might involve infrastructure failure.

Source: Portworx Enterprise Documentation

Section: Install and Configure -> Install Portworx -> Install Portworx on Kubernetes -> Prerequisites.

In Portworx, a local snapshot is a point-in-time, read-only image of a volume that resides within the same cluster as the original volume. These snapshots are created using a copy-on-write mechanism, making them instantaneous and space-efficient. They are primarily used for rapid operational recovery, such as restoring data from accidental deletion or application corruption, and for cloning volumes for development, testing, or analytics purposes, all within the local cluster environment.

A. A snapshot stored in a remote data center is referred to as a remote or cloud snapshot, specifically designed for disaster recovery, not a local snapshot.

B. A snapshot automatically backed up to the cloud is a "cloudsnap." While Portworx supports this, it is a distinct feature from a standard local snapshot.

1. Portworx Enterprise Documentation

"Create and use local snapshots": This document explicitly states

"Portworx can take snapshots of your volumes. These snapshots are local to a cluster... A local snapshot is a point-in-time copy of a volume that you can use to create a clone of that volume." This confirms that the snapshot's location is the same cluster.

2. Portworx Enterprise Documentation

"Volume Snapshots": The overview section distinguishes between different types of snapshots: "These snapshots can be local to a cluster or pushed to a cloud provider." This clearly separates the concept of a "local" snapshot from one stored remotely in the cloud.

3. Portworx Enterprise Documentation

"pxctl volume snapshot create": The command reference for creating snapshots shows options for local creation. The documentation for cloudsnaps (--cloudsnap) demonstrates that sending a snapshot to a remote location requires specific

separate parameters

reinforcing that the default snapshot is local to the cluster.

A Portworx volume is considered "Public" when the guestaccess parameter is enabled for it. This setting allows any authenticated user within the Portworx security domain to access the volume with a specified level of permission (read, write, or admin), even if they are not the owner or explicitly listed as a collaborator. This mechanism is the designated method for sharing a volume broadly across users in the cluster, effectively making it a public resource.

A. A volume owned by system.admin is simply under the control of that specific administrative role. Ownership does not inherently grant access to all other users.

C. When Portworx security is enabled, every volume is created with an associated owner. A volume without ownership is not the defined mechanism for making it public.

1. Portworx Enterprise Documentation

"Security -> Portworx with Kubernetes -> Volume-based access control -> Ownership and access": In the section "Make a volume public

" the documentation explicitly states: "You can make a volume public by granting access to guests. When you set guestaccess to read

write

or admin

any authenticated user can access the volume with the specified access level." This directly confirms that guest access defines a public volume.

2. Portworx Enterprise Documentation

"Security -> Portworx with Kubernetes -> Volume-based access control -> Ownership and access": The "Ownership" section clarifies: "When you create a volume

you become its owner." This refutes the idea that a volume can be public by having no owner.

When using the shared secret authentication method, Portworx requires the Kubernetes secret containing the authentication token to be located in the same namespace as the application that is requesting storage. The Portworx StorageClass is configured with parameters (px.io/secret-name and px.io/secret-namespace: ${pvc.namespace}) that instruct the CSI provisioner to dynamically look for the secret in the namespace where the PersistentVolumeClaim (PVC) is being created. This ensures that only applications within that specific namespace can use the secret to authenticate and provision Portworx volumes, adhering to Kubernetes' namespaced security model.

B. In the 'default' namespace: This is incorrect. Placing the secret in the default namespace would not make it accessible to applications in other namespaces without additional, non-standard configuration.

C. In the same namespace as the Portworx installation: This is incorrect. Storing the secret in the Portworx system namespace (e.g., kube-system) would require complex cross-namespace RBAC permissions for every application, which is not the standard procedure.

1. Portworx Enterprise Documentation

"Security -> With Kubernetes -> Configure Portworx security with Kubernetes secrets": This document explicitly states

"Create a Kubernetes secret in the namespace where you will be creating your PVCs." It provides the example command kubectl -n create secret generic px-secret ... to create the secret in the target application namespace.

2. Portworx Enterprise Documentation

"Storage Operations -> Storage Provisioning in Kubernetes -> Dynamic Provisioning": This page details the StorageClass parameters. It shows the use of px.io/secret-namespace: ${pvc.namespace}

which confirms that the provisioner resolves the secret's namespace to be the same as the PVC's namespace at the time of creation.