EX280 Security And SCC — 10 Questions

Question 1

An auditor requests a report of all security context constraints currently assigned to a specific user named alice in the cluster. Which OpenShift CLI command should the administrator run?

Accepted Answer

oc adm policy who-can use scc. The oc adm policy who-can command or oc get scc with appropriate filtering, or checking SCC matches via adm can-i commands, but the dedicated command to see which SCCs apply to a user is oc adm policy who-can use scc.

Answer

oc get scc --user=alice

Answer

oc describe user alice --with-scc

Answer

oc auth can-i use scc --as=alice

Question 2

An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?

Accepted Answer

Set runAsUser.type to MustRunAs and specify uid: 1000 in the uidRange. To force a specific UID execution, the runAsUser strategy must be set to MustRunAs with a uidRange specifying UID 1000.

Answer

Set runAsUser.type to RunAsAny and add securityContext.runAsUser: 1000 in the pod spec

Answer

Configure fsGroup.type to MustRunAs with uid: 1000

Answer

Set privileged: true and map the container user via supplementalGroups

Question 3

A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?

Accepted Answer

allowHostPorts: true. Allowing pods to bind to privileged ports (< 1024) is controlled by setting allowHostPorts to true or defining allowedHostPorts in a custom SCC.

Answer

runAsUser.type: RunAsAny

Answer

allowPrivilegedContainer: true

Answer

privileged: true

Question 4

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

Accepted Answer

In the Deployment configuration spec under template.spec.imagePullSecrets. Image pull secrets can be specified directly in the pod spec under imagePullSecrets, or linked to the ServiceAccount used by the pod.

Answer

As an annotation on the cluster-scoped Namespace object

Answer

Inside the Route object spec under tls.imagePullSecret

Answer

As an environment variable named IMAGE_PULL_SECRET in the container specification

Question 5

An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?

Accepted Answer

pod-security.kubernetes.io/enforce: restricted. To enforce a standard while generating audit log violations, the audit level is set to enforce while warning/audit levels are configured via namespace labels.

Answer

pod-security.openshift.io/standard: restricted

Answer

security.openshift.io/scc.enforce: restricted

Answer

openshift.io/cluster-monitoring: "true"

Question 6

An administrator needs to configure a new project so that pods deployed within it run with the restricted-v2 Security Context Constraint by default. Which action should the administrator perform?

Accepted Answer

Annotate the Namespace with security.openshift.io/scc: restricted-v2. Applying the security.openshift.io/scc: restricted-v2 annotation to the Namespace forces pods requesting no specific SCC to default to restricted-v2 via admission control.

Answer

Edit the default cluster-wide SCC object directly to set restricted-v2 as priority zero

Answer

Create a RoleBinding linking the restricted-v2 ClusterRole to the system:authenticated group

Answer

Patch the PodSecurity standards admission configuration in the APIServer resource

Question 7

An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?

Accepted Answer

spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate. Edge termination routes configure TLS settings directly inside the spec.tls block of the Route resource.

Answer

spec.endpoint.tls with base64 encoded string data

Answer

metadata.annotations containing openshift.io/tls-cert and openshift.io/tls-key

Answer

status.ingress.tls for automatic cert-manager synchronization

Question 8

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

Accepted Answer

The cluster OAuth custom resource named cluster. LDAP identity providers are configured inside the cluster-scoped OAuth custom resource under the spec.identityProviders array.

Answer

A Secret named identity-provider in the openshift-authentication namespace

Answer

An Authentication custom resource named cluster in the kube-system namespace

Answer

A ConfigMap named ldap-config in the openshift-config namespace

Question 9

A developer deploys a custom application pod that requires the hostIPC capability, but the pod creation is rejected by the apiserver. Upon inspecting the cluster SCCs, the administrator determines that the application uses a ServiceAccount named app-sa in the production namespace. How should the administrator grant the restricted SCC privileges safely without compromising cluster security?

Accepted Answer

Create a RoleBinding in the production namespace referencing the system:openshift:scc:hostaccess cluster role and the app-sa ServiceAccount. To grant specific SCC privileges, the administrator must bind the SCC's corresponding cluster role to the target service account.

Answer

Add a subject entry referencing system:serviceaccount:production:app-sa to the users list inside the restricted SCC definition

Answer

Annotate the app-sa ServiceAccount with openshift.io/scc.constraint: hostaccess

Answer

Create a ClusterRoleBinding that binds the system:openshift:scc:restricted cluster role to system:serviceaccount:production:app-sa

Question 10

When configuring an OAuth identity provider of type HTPasswd, which object type must be created to store the username and hashed password pairs?

Accepted Answer

A Secret containing the htpasswd flat-file data. HTPasswd identity providers require a Secret containing the htpasswd file data referenced by the OAuth configuration.

Answer

A ServiceAccount with special token annotations

Answer

A ConfigMap containing plain-text user credentials

Answer

A custom resource of kind HTPasswdProvider in the openshift-config namespace