EX280 Security And SCC — 20 Questions

Question 1

An auditor requests a report of all security context constraints currently assigned to a specific user named alice in the cluster. Which OpenShift CLI command should the administrator run?

Accepted Answer

oc adm policy who-can use scc. The oc adm policy who-can command or oc get scc with appropriate filtering, or checking SCC matches via adm can-i commands, but the dedicated command to see which SCCs apply to a user is oc adm policy who-can use scc.

Answer

oc get scc --user=alice

Answer

oc describe user alice --with-scc

Answer

oc auth can-i use scc --as=alice

Question 2

An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?

Accepted Answer

Set runAsUser.type to MustRunAs and specify uid: 1000 in the uidRange. To force a specific UID execution, the runAsUser strategy must be set to MustRunAs with a uidRange specifying UID 1000.

Answer

Set runAsUser.type to RunAsAny and add securityContext.runAsUser: 1000 in the pod spec

Answer

Configure fsGroup.type to MustRunAs with uid: 1000

Answer

Set privileged: true and map the container user via supplementalGroups

Question 3

A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?

Accepted Answer

allowHostPorts: true. Allowing pods to bind to privileged ports (< 1024) is controlled by setting allowHostPorts to true or defining allowedHostPorts in a custom SCC.

Answer

runAsUser.type: RunAsAny

Answer

allowPrivilegedContainer: true

Answer

privileged: true

Question 4

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

Accepted Answer

In the Deployment configuration spec under template.spec.imagePullSecrets. Image pull secrets can be specified directly in the pod spec under imagePullSecrets, or linked to the ServiceAccount used by the pod.

Answer

As an annotation on the cluster-scoped Namespace object

Answer

Inside the Route object spec under tls.imagePullSecret

Answer

As an environment variable named IMAGE_PULL_SECRET in the container specification

Question 5

An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?

Accepted Answer

pod-security.kubernetes.io/enforce: restricted. To enforce a standard while generating audit log violations, the audit level is set to enforce while warning/audit levels are configured via namespace labels.

Answer

pod-security.openshift.io/standard: restricted

Answer

security.openshift.io/scc.enforce: restricted

Answer

openshift.io/cluster-monitoring: "true"

Question 6

An administrator needs to configure a new project so that pods deployed within it run with the restricted-v2 Security Context Constraint by default. Which action should the administrator perform?

Accepted Answer

Annotate the Namespace with security.openshift.io/scc: restricted-v2. Applying the security.openshift.io/scc: restricted-v2 annotation to the Namespace forces pods requesting no specific SCC to default to restricted-v2 via admission control.

Answer

Edit the default cluster-wide SCC object directly to set restricted-v2 as priority zero

Answer

Create a RoleBinding linking the restricted-v2 ClusterRole to the system:authenticated group

Answer

Patch the PodSecurity standards admission configuration in the APIServer resource

Question 7

An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?

Accepted Answer

spec.tls.certificate, spec.tls.key, and spec.tls.caCertificate. Edge termination routes configure TLS settings directly inside the spec.tls block of the Route resource.

Answer

spec.endpoint.tls with base64 encoded string data

Answer

metadata.annotations containing openshift.io/tls-cert and openshift.io/tls-key

Answer

status.ingress.tls for automatic cert-manager synchronization

Question 8

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

Accepted Answer

The cluster OAuth custom resource named cluster. LDAP identity providers are configured inside the cluster-scoped OAuth custom resource under the spec.identityProviders array.

Answer

A Secret named identity-provider in the openshift-authentication namespace

Answer

An Authentication custom resource named cluster in the kube-system namespace

Answer

A ConfigMap named ldap-config in the openshift-config namespace

Question 9

A developer deploys a custom application pod that requires the hostIPC capability, but the pod creation is rejected by the apiserver. Upon inspecting the cluster SCCs, the administrator determines that the application uses a ServiceAccount named app-sa in the production namespace. How should the administrator grant the restricted SCC privileges safely without compromising cluster security?

Accepted Answer

Create a RoleBinding in the production namespace referencing the system:openshift:scc:hostaccess cluster role and the app-sa ServiceAccount. To grant specific SCC privileges, the administrator must bind the SCC's corresponding cluster role to the target service account.

Answer

Add a subject entry referencing system:serviceaccount:production:app-sa to the users list inside the restricted SCC definition

Answer

Annotate the app-sa ServiceAccount with openshift.io/scc.constraint: hostaccess

Answer

Create a ClusterRoleBinding that binds the system:openshift:scc:restricted cluster role to system:serviceaccount:production:app-sa

Question 10

When configuring an OAuth identity provider of type HTPasswd, which object type must be created to store the username and hashed password pairs?

Accepted Answer

A Secret containing the htpasswd flat-file data. HTPasswd identity providers require a Secret containing the htpasswd file data referenced by the OAuth configuration.

Answer

A ServiceAccount with special token annotations

Answer

A ConfigMap containing plain-text user credentials

Answer

A custom resource of kind HTPasswdProvider in the openshift-config namespace

Question 11

An administrator needs to configure re-encrypt TLS termination on a Route. In addition to the router certificate, what other certificate component must typically be provided in the route configuration?

Accepted Answer

The destination CA certificate to validate the backend pod's TLS certificate. Re-encrypt routes require a destination CA certificate (spec.tls.destinationCACertificate) so the router can trust the backend pod's self-signed or internal certificate.

Answer

A base64 encoded kubeconfig file for the ingress operator

Answer

An identity provider public key for JSON Web Token validation

Answer

A client certificate for mutual TLS authentication against the OAuth server

Question 12

An administrator wants to prevent developers from creating pods that run as the root user across the entire cluster. Which OpenShift resource or admission mechanism is best suited to enforce this restriction globally?

Accepted Answer

Modifying the restricted-v2 SCC to ensure root execution is disallowed via user ID restrictions. OpenShift enforces user restrictions cluster-wide primarily through Security Context Constraints (SCC) where runAsUser.type is set to MustRunAsRange or MustRunAs, restricting root execution.

Answer

Disabling the ServiceAccount controller in the cluster operator configuration

Answer

Adding a cluster-wide ValidatingWebhookConfiguration that intercepts Route creations

Answer

Creating a global ConfigMap in the openshift-config namespace named root-blocker

Question 13

An administrator is troubleshooting an Ingress routing issue where external clients receive a 503 error when trying to access a secure application through a Route configured with passthrough TLS termination. What is the most likely cause of this issue?

Accepted Answer

The target application pod is not configured to terminate TLS and present a valid certificate matching the route hostname. With passthrough TLS termination, the router passes encrypted traffic directly to the backend pod, meaning the pod must handle TLS termination and present a valid certificate matching the hostname.

Answer

The Route manifest is missing the spec.tls.destinationCACertificate field

Answer

The default Ingress controller wildcard certificate has expired

Answer

The Route object lacks an annotation specifying openshift.io/router.router-credentials

Question 14

An administrator needs to ensure that a newly created ServiceAccount automatically receives a long-lived API token when created in OpenShift 4.14+. What is the correct procedure?

Accepted Answer

Create a Secret of type kubernetes.io/service-account-token and reference the ServiceAccount name in the secret metadata annotations. In OpenShift 4.14+, bound service account tokens are ephemeral by default. To create a legacy long-lived token, a Secret object must be explicitly created and linked to the service account.

Answer

Patch the default cluster authentication profile to revert to automountServiceAccountToken globally

Answer

Add the annotation serviceaccounts.openshift.io/want-token: "true" to the ServiceAccount metadata

Answer

Execute the oc create token command and store the output in a ConfigMap

Question 15

An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?

Accepted Answer

Create a dedicated ServiceAccount, a Role granting get and list on pods, and a RoleBinding linking them in the namespace. To grant least privilege API access, create a dedicated ServiceAccount, bind a custom Role or ClusterRole with limited verbs (get, list, watch) on pods via a RoleBinding in that namespace.

Answer

Bind the cluster-admin ClusterRole to the default ServiceAccount in the namespace using a ClusterRoleBinding

Answer

Annotate the default ServiceAccount with rbac.authorization.k8s.io/authtype: reader

Answer

Grant the system:openshift:scc:restricted ClusterRole to the ServiceAccount using a RoleBinding

Question 16

An administrator is configuring an OAuth identity provider and needs to map claims from an external provider to OpenShift usernames. Which field in the OAuth configuration specifies the claim to use as the username?

Accepted Answer

mappingMethod and attributes.username. When configuring identity providers like OpenID in the OAuth resource, the mapping is defined using attributes such as username for claims.

Answer

metadata.annotations['oauth.openshift.io/username-claim']

Answer

spec.identityProviders.providerConfig.userField

Answer

status.providerStatus.usernameMapping

Question 17

An administrator needs to view the current list of active Security Context Constraints installed in an OpenShift cluster. Which command should be executed?

Accepted Answer

oc get scc. SCCs are cluster-scoped resources. Running oc get scc lists all security context constraints available in the cluster.

Answer

oc get securityconstraints

Answer

oc adm policy list-constraints

Answer

oc describe clustersecurity

Question 18

An administrator is securing routes in an OpenShift cluster. Which THREE TLS termination types are supported natively by OpenShift Routes? (Choose THREE)

Accepted Answer

Passthrough. OpenShift Routes support edge, re-encrypt, and passthrough TLS termination types.

Answer

Proxy

Answer

FullMesh

Question 19

An administrator needs to troubleshoot an image pull failure caused by missing credentials. Which TWO locations or methods can be used to associate an image pull secret with a workload in OpenShift? (Choose TWO)

Accepted Answer

Linking the image pull secret to the ServiceAccount referenced by the deployment's pod spec via oc secrets link. Image pull secrets can be referenced directly in the pod template spec under imagePullSecrets, or linked directly to the ServiceAccount used by the pods.

Answer

Defining the secret inside the cluster Ingress controller custom resource spec

Answer

Placing the pull secret in the global openshift-config ConfigMap

Answer

Annotating the Namespace with openshift.io/image-pull-secret-ref

Question 20

An administrator is configuring authentication in OpenShift. Which TWO of the following identity provider types are natively supported by the OpenShift OAuth server? (Choose TWO)

Accepted Answer

HTPasswd. OpenShift natively supports multiple identity providers including HTPasswd, LDAP, OpenID Connect, GitHub, and Keystone.

Answer

CustomDatabaseProvider

Answer

LocalFileAuthService

Answer

ActiveDirectoryNativeProtocol