Security And SCC

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

When configuring an OAuth identity provider of type HTPasswd, which object type must be created to store the username and hashed password pairs?

An administrator needs to configure re-encrypt TLS termination on a Route. In addition to the router certificate, what other certificate component must typically be provided in the route configuration?

An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?

An administrator needs to view the current list of active Security Context Constraints installed in an OpenShift cluster. Which command should be executed?

An administrator is securing routes in an OpenShift cluster. Which THREE TLS termination types are supported natively by OpenShift Routes? (Choose THREE)

An administrator needs to troubleshoot an image pull failure caused by missing credentials. Which TWO locations or methods can be used to associate an image pull secret with a workload in OpenShift? (Choose TWO)

An administrator is configuring authentication in OpenShift. Which TWO of the following identity provider types are natively supported by the OpenShift OAuth server? (Choose TWO)

An administrator is reviewing the default Security Context Constraints in OpenShift 4.14+. Which THREE of the following SCCs are built-in and provided out-of-the-box by OpenShift? (Choose THREE)

An administrator is auditing Security Context Constraints and wants to identify which settings can be controlled within a custom SCC definition. Which THREE fields are valid configuration options inside an SCC resource? (Choose THREE)

An administrator needs to restrict pod creation based on Pod Security Standards namespaces. Which TWO of the following are valid Pod Security Standard levels defined by Kubernetes and supported in OpenShift? (Choose TWO)

An administrator is managing service accounts and wants to understand how tokens work in OpenShift 4.14+. Which TWO statements are correct regarding ServiceAccount tokens in this version? (Choose TWO)

An administrator is troubleshooting an OAuth authentication failure where users receive an error indicating invalid credentials against an HTPasswd provider. Which TWO steps or checks are critical for resolving this issue? (Choose TWO)

A cluster administrator needs to grant a Deployment in the production namespace permission to pull images from a private container registry. The image pull secret is named my-registry-secret. Which step must be performed so that pods created by this Deployment can successfully pull the image?

An administrator creates a new custom Security Context Constraint (SCC) named restrict-root. After creating the SCC resource, users complain that pods using a ServiceAccount tied to this SCC are still falling back to the restricted-v2 SCC. What is the most likely cause?

A developer deploys an application using a Route that terminates TLS using the Edge termination strategy. The developer wants to ensure that all insecure HTTP traffic to the route is automatically redirected to HTTPS. Where must this setting be configured?

A cluster administrator wishes to enforce the restricted Pod Security Standard across an entire namespace named auditing-ns. Which label should the administrator apply to the namespace to enforce this policy while generating audit warnings for non-compliant pods?

Which TWO methods can an administrator use to inspect or troubleshoot Security Context Constraint (SCC) assignments for a specific ServiceAccount in a namespace?

Which TWO actions are required when configuring an external OpenID Connect (OIDC) identity provider in OpenShift Container Platform?

You are integrating an external LDAP identity provider. Which secret must be created to store the bind password for the LDAP server?

You need to allow a specific service account to run pods as root. Which command should you use to associate the 'privileged' SCC with the 'default' service account in the 'web-apps' namespace?

How do you view the currently active OAuth identity providers in an OpenShift cluster?

Which tool should be used to troubleshoot why an SCC is being rejected for a pod?

You need to terminate TLS for a route using a custom certificate. Which object must contain the TLS key and certificate?

Which SCC is assigned by default to authenticated users who are not service accounts?

A developer needs to expose a service via a route with re-encryption. What is required in the Route configuration?

When using OIDC for authentication, what does the 'issuer' field in the configuration represent?

Where do you define the default image pull secrets for all service accounts in a namespace?

Which service account is used by default for pods that do not specify a service account in their manifest?

When creating a custom SCC, what is the best practice for assigning it to users?

What happens if a pod does not match any SCC?

You are configuring an OAuth identity provider using 'htpasswd'. Which secret must contain the file?

Which TWO of the following are valid ways to secure a route?

How can you view the list of all SCCs available in the cluster?

Which THREE of the following are required when configuring an OIDC identity provider?

Which THREE parameters are commonly found in the SCC 'spec' section?

Which TWO authentication methods are supported by the OpenShift OAuth server?

Which THREE components are involved in TLS termination for routes?

Which TWO security standards are natively tracked in OpenShift?

Which TWO things must be configured to use a Private Image Registry?

An administrator is preparing a custom Security Context Constraint (SCC) that will be granted to a specific ServiceAccount used by a log-forwarding DaemonSet. The DaemonSet pods must be able to mount a hostPath volume at /var/log but must not run as UID 0 and must not use the host network. Which SCC field combination must the administrator set to allow only the hostPath mount while still blocking privileged escalation and host networking?

An administrator is preparing a custom SecurityContextConstraints (SCC) named app-scc to allow pods to run with a specific user ID and to use the host network. Which two fields must be set in the SCC to achieve these requirements? (Choose two.)

A cluster administrator wants to prevent any pod in the `finance` namespace from requesting the `NET_RAW` capability, which is not needed by the applications there. The administrator plans to modify the SCC bound to the namespace's default ServiceAccount. Which SCC field should be used to explicitly drop `NET_RAW`?

A security team wants to ensure that all pods in a new namespace called secure-apps run with a specific SELinux context level. They create a custom SCC named selinux-scc with seLinuxContext: MustRunAs and a specific level. After binding the SCC to the default service account in secure-apps, pods still fail to start with an SELinux relabeling error. What is the most likely cause?

An administrator is reviewing why a pod in the `legacy` namespace runs as UID 1000070000 even though the pod manifest does not specify a `runAsUser`. The namespace annotation `openshift.io/sa.scc.uid-range` is `1000070000/10000`. Which SCC behavior explains the observed UID?

A security team requires that a specific ServiceAccount `app-sa` in project `prod` be allowed to run pods that use the `hostNetwork` namespace, while all other ServiceAccounts in `prod` must remain restricted. The administrator creates a new SCC `hostnet-scc` with `allowHostNetwork: true` and binds it only to `app-sa`. A developer then creates a pod using the `default` ServiceAccount with `hostNetwork: true` in its manifest. What is the result?