The Portworx OCI monitor (px-oci-mon) is a critical component that runs as a container within the Portworx DaemonSet on each node. Its primary function is to act as a watchdog for the node's health from a storage perspective. It continuously monitors the state of the underlying OCI-compliant container runtime (like containerd or Docker) and the main Portworx service. If it detects that either of these essential services has become unresponsive, it will take corrective action, such as restarting the Portworx container, to restore the node's functionality and ensure the stability of the Portworx storage cluster.

A. To facilitate the installation of Portworx: Installation is handled by the Portworx Operator or by applying Kubernetes spec files, not by the OCI monitor, which operates post-installation.

C. To manage Kubernetes network policies: Network policy enforcement is the responsibility of a Container Network Interface (CNI) plugin (e.g., Calico, Weave), not the Portworx storage layer.

1. Portworx Enterprise Documentation: In the section describing the components

the OCI monitor is explicitly defined. "The Portworx DaemonSet... includes the following containers: ... px-oci-mon: Monitors the OCI container runtime and restarts Portworx if it becomes unresponsive."

Source: Portworx Docs

Reference > Components > Portworx components on Kubernetes.

2. Portworx Enterprise Documentation: The troubleshooting guide for unresponsive nodes implicitly details the role of health monitoring components like the OCI monitor. It explains that if the Portworx daemon on a node becomes unhealthy

the monitor attempts to recover it.

Source: Portworx Docs

Operate and Maintain > Troubleshoot Portworx > Troubleshoot nodes > Node is down.

Portworx classifies every alert into one of three severities to indicate urgency and recommended operator action. The official Portworx alert documentation states that each alert is tagged as either INFO (informational, no action), WARNING (requires attention soon), or CRITICAL (requires immediate action). These are the only three severities defined in the product, so option B is the exclusive correct choice.

A. Uses “ERROR”; Portworx never assigns “ERROR” as an alert severity.

C. Uses “ALARM”; “ALARM” is not a recognised severity label in Portworx alerts.

1. Pure Storage Portworx Documentation – “Monitor Portworx › Alerts” section

paragraph “Alert format”

URL: https://docs.portworx.com/portworx-install-with-kubernetes/operate-and-maintain-on-kubernetes/alerts/

(States: “severity: INFO | WARNING | CRITICAL”)

2. Pure Storage Portworx Enterprise 2.6 Admin Guide

Chapter 7 “Alert Reference”

p. 125–126

(Lists each alert with a ‘severity’ field whose possible values are only INFO

WARNING

CRITICAL.)

Portworx defragmentation is an I/O-intensive operation designed to reclaim space and improve the performance of volumes. Because of its resource-intensive nature, it can impact the performance of active applications. By setting a defragmentation schedule, administrators can automate this task to run during periods of low cluster workload, such as nights or weekends. This ensures that the performance benefits of defragmentation are achieved without negatively affecting production services during peak hours.

B. To back up data to the cloud.

This is incorrect. Portworx uses separate features like CloudSnaps or PX-Backup for backing up data to cloud object stores, which is a distinct process from defragmentation.

C. To monitor the health of the storage cluster.

This is incorrect. Cluster health is monitored using tools like pxctl status, the Portworx monitoring stack (Prometheus/Grafana), or other observability platforms, not by scheduling defragmentation.

1. Portworx Enterprise Documentation

"Defragmentation": "Defragmentation is an I/O intensive operation

so you should run it during a maintenance window or when your cluster is not under a heavy I/O load. You can schedule defragmentation to run at a specific time on a recurring basis to avoid impacting your applications." (This section explicitly states the purpose is to improve performance and the reason for scheduling is to run during low workload periods).

2. Portworx Enterprise Documentation

"pxctl volume commands"

pxctl volume defrag schedule create: The documentation for this command details how to "Create a recurring defragmentation schedule for a volume

" providing options for daily

weekly

and monthly schedules at specific times

reinforcing the concept of running the operation during planned

low-impact windows.

In a modern Portworx deployment on Kubernetes managed by an Operator, the standard and recommended method for verification is through Kubernetes-native tooling. The kubectl get storagenodes command queries the StorageNode Custom Resource Definition (CRD), which is the authoritative representation of the Portworx nodes within the Kubernetes API. The output directly displays the status, and most importantly, the VERSION of the Portworx software on each node. This aligns with the declarative, Operator-driven management paradigm, which is the current best practice for running complex stateful services on Kubernetes.

A. pxctl get storagenodes: While this command provides similar information by querying the Portworx daemon directly, the Kubernetes-native approach (kubectl) is the recommended practice for verification in modern, Operator-managed environments.

C. kubectl get nodes -o wide: This command displays information about the Kubernetes cluster nodes (like OS and kernel version), not the version of the Portworx application running on them.

1. Portworx Enterprise Documentation

"Upgrade Portworx on Kubernetes using the Operator": In the section "Verify the Portworx upgrade

" the documentation explicitly instructs the administrator to use kubectl: "Verify that all Portworx pods are running the upgraded version... You can verify this by running the kubectl get storagenodes -n kube-system command and looking at the VERSION column."

2. Portworx Enterprise Documentation

"Monitor Portworx on Kubernetes": In the section "Monitor Portworx components

" the documentation states: "The Portworx Operator creates StorageNode and StorageCluster objects... You can view the status of your storage nodes by running the kubectl get storagenodes command." This reinforces that querying the StorageNode CRD is the standard monitoring and verification procedure.

3. Kubernetes Documentation

"Custom Resources": This documentation explains the concept of Custom Resource Definitions (CRDs) and how kubectl is the standard tool for interacting with these resources. The StorageNode object is a CRD installed by Portworx

making kubectl get storagenodes the correct

Kubernetes-native interaction pattern.

To expose Portworx metrics to an externally managed Prometheus instance, the administrator must modify the StorageCluster custom resource. The correct method is to set the exportMetrics flag to true under the spec.monitoring.prometheus path. This declarative approach instructs the Portworx Operator to create the necessary ServiceMonitor or PodMonitor resources that the external Prometheus Operator can discover, allowing it to scrape metrics from Portworx pods without deploying the Portworx-internal Prometheus stack.

B. The exportMetrics field is incorrectly placed. According to the StorageCluster CRD schema, it must be nested within the prometheus object, not directly under monitoring.

C. Using pxctl is an imperative command. The standard, declarative, and idempotent method for managing cluster-wide configuration in an operator-managed Portworx installation is by modifying the StorageCluster object.

1. Portworx Enterprise Documentation

"Monitor Portworx with Prometheus": This official document details the configuration for monitoring. In the section "Using an existing Prometheus Operator

" it explicitly states: "If you want to use an existing Prometheus Operator to monitor Portworx

you must enable the exportMetrics flag in the StorageCluster spec." It then provides the exact YAML structure shown in option A.

Source: Portworx by Pure Storage Official Documentation. Navigate to the Monitor and Troubleshoot -> Monitor Portworx with Prometheus -> Using an existing Prometheus Operator section.

2. Portworx Enterprise Documentation

"Portworx Operator Spec / CRD Reference": The reference for the StorageCluster Custom Resource Definition confirms the object hierarchy. The monitoring spec contains a prometheus object

which in turn contains the exportMetrics boolean field. This schema validates that spec.monitoring.prometheus.exportMetrics is the correct path.

Source: Portworx by Pure Storage Official Documentation. Navigate to the Reference -> Portworx Operator on Kubernetes -> Operator Spec / CRD Reference section and inspect the StorageCluster spec.

To enable security and disable guest access using the Portworx Operator, the StorageCluster custom resource must be modified. The spec.security.enabled field must be set to the boolean value true. To control guest access, the spec.security.auth.guestAccess field must be set to the boolean value false. This configuration explicitly activates Portworx security features and ensures that only authenticated users can access the storage cluster, aligning with security best practices.

A: The guestAccess field requires a boolean value (true or false), not a string like 'Disabled'. This would result in a configuration error.

B: The security field is an object that contains multiple configuration keys. Assigning it a single string value like 'Enabled' is an invalid structure for the StorageCluster spec.

1. Portworx Enterprise Documentation: Enable Portworx Security with the Operator. This document details the StorageCluster spec for enabling security. It explicitly shows the required structure:

yaml

spec:

security:

enabled: true

This confirms the first part of the correct answer.

2. Portworx Enterprise Documentation: Secure -> Authentication -> Configure guest access. This section specifies how to manage guest access for authenticated clusters. It states

"To disable guest access

set the guestAccess field to false in the auth section of your StorageCluster spec":

yaml

spec:

security:

enabled: true

auth:

guestAccess: false

This directly validates that option C is the correct and complete configuration.

The recommended practice for managing the lifecycle of snapshots in Portworx is to configure retention policies. Portworx provides native tools, such as the pxctl command-line interface, to create automated snapshot schedules. These schedules can include a retention policy using the --retain flag, which specifies the number of snapshots to keep. When a new snapshot is created beyond this limit, the oldest one is automatically deleted. This policy-driven approach ensures efficient storage utilization, prevents uncontrolled data growth, and eliminates the need for manual, error-prone cleanup tasks, making it the most scalable and reliable method.

A. Manually deleting old snapshots is not a recommended practice because it is inefficient, not scalable, and susceptible to human error, especially in large-scale environments.

C. Retaining all snapshots indefinitely is impractical and unsustainable. It leads to excessive storage consumption, increased costs, and complex management overhead.

1. Portworx Enterprise Documentation

"Create and use local snapshots

" section "Schedule snapshots." This section details the pxctl volume snapshot schedule create command

which includes the --retain flag. The documentation states

"--retain specifies how many snapshots to retain. Once the schedule creates the specified number of snapshots

it deletes the oldest snapshot before creating a new one." This directly supports the use of retention policies for lifecycle management.

2. Portworx Enterprise Documentation

"pxctl reference

" section "pxctl volume snapshot schedule create." The command reference explicitly defines the --retain option as the mechanism to "Specify number of snapshots to retain." This confirms that retention is a built-in

configurable feature intended for managing the number of snapshots.

Portworx Autopilot is a rule-based automation engine designed to manage storage operations within a Portworx cluster without manual intervention. Its primary function is to monitor the state of storage resources, such as Persistent Volume Claims (PVCs), and automatically trigger predefined actions when specific conditions are met. A common use case is to define a rule that monitors a volume's usage percentage and automatically expands the volume's size once it crosses a specified threshold, ensuring applications do not run out of space.

A. Migration of containers and applications across clusters is a disaster recovery or application mobility function, which is primarily handled by Portworx DR (PX-DR) and Stork.

B. Enhanced security features, such as role-based access control (RBAC) and volume encryption, are managed by the Portworx Security component, not Autopilot.

1. Portworx Enterprise Documentation

"Autopilot Overview": "Portworx Autopilot is a rule-based engine that allows you to programmatically and automatically manage your Portworx cluster. Autopilot allows you to specify conditions and actions to automate common maintenance operations

such as volume expansion or pool rebalancing."

Source: Portworx Official Documentation

Operate and Maintain -> Autopilot -> Overview.

2. Portworx Enterprise Documentation

"Automatically resize a PVC": This section provides a specific example of an AutopilotRule object. The rule's conditions are set to pvc.usagepercentage > 60

and the actions are configured to perform a px.volume.resize to increase the volume size by 50%. This directly demonstrates the automated expansion of volumes based on rules.

Source: Portworx Official Documentation

Operate and Maintain -> Autopilot -> Use-cases -> Automatically resize a PVC.

3. Portworx Enterprise Documentation

"Portworx DR": "Portworx DR allows you to migrate applications and their data between clusters over a wide-area network (WAN)." This clearly distinguishes the function of disaster recovery from Autopilot's role.

Source: Portworx Official Documentation

Backup and Recovery -> Portworx DR.

Stork is Portworx's storage-aware scheduler for Kubernetes. Its architecture consists of two primary components that integrate with the native Kubernetes scheduler. The first is the Stork scheduler plugin, which runs as a separate pod and can be configured as the scheduler for specific applications. The second is a scheduler extender, which is a webhook that the default Kubernetes scheduler calls. This extender allows Stork to filter and prioritize nodes for pods using Portworx volumes, ensuring pods are co-located with their data to optimize performance and availability.

B. Stork snapshots and restores are features or operations that Stork orchestrates for data protection, not its fundamental architectural components.

C. An object store, such as an S3 bucket, is an external location used by Portworx to store backups, not an internal component of Stork.

1. Portworx Documentation

"Stork on Kubernetes": "Stork is a scheduler extender. It allows a user to co-locate pods with their data

enabling hyperconvergence. Stork also provides the ability to seamlessly migrate your applications and data from one Kubernetes cluster to another." This section explicitly identifies Stork as a scheduler extender.

2. Portworx Documentation

"Install Stork": The installation instructions detail the deployment of both the stork (controller/operator) and stork-scheduler components

confirming the two-part nature of its scheduler functionality.

3. Portworx Documentation

"Scheduler Extender": "Stork is a scheduler extender plugin for Kubernetes. When a pod is scheduled

the default Kubernetes scheduler makes an API call to the Stork extender. The Stork extender inspects the pod and if it uses Portworx volumes

it finds the best nodes for the pod to run on." This page details the function of the extender component.

The Kubernetes secret named px-kvdb-auth is used to store authentication credentials required for Portworx to connect to a secure, external key-value database (KVDB) like etcd or Consul. When the external KVDB is secured using TLS, this secret must contain the necessary client certificate, client private key, and the CA certificate. The Portworx Operator or DaemonSet references this secret to establish a secure, authenticated connection to the KVDB for storing cluster metadata.

A. px-kvdb: This is an incorrect name. While related to the KVDB, it is not the standard name for the secret containing TLS authentication certificates.

B. px-kvdb-cert: This name is descriptive but not the one specified in the official Portworx documentation for storing KVDB authentication materials.

1. Portworx Enterprise Documentation - Install Portworx on Kubernetes -> Prerequisites -> Key-value store: "If you are using a secure etcd

you need to create a secret called px-kvdb-auth in the kube-system namespace with the following files: ca.crt

etcd-client.crt

etcd-client.key." This section explicitly names the secret.

2. Portworx Enterprise Documentation - Use an external key-value store -> Secure etcd with TLS: "Create a Kubernetes secret called px-kvdb-auth with the client certificate

key

and CA certificate you generated in the previous section." This guide provides a step-by-step process

reinforcing the required secret name.

3. Portworx Enterprise Documentation - Reference -> StorageCluster -> kvdb: The StorageCluster Custom Resource Definition (CRD) includes the field spec.kvdb.authSecret. The documentation notes: "Name of the secret that has the credentials for the KVDB. If the secret is not provided

Portworx will use the default secret name px-kvdb-auth." This confirms the default and expected name.