An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?
A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?
An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?
An administrator needs to configure a new project so that pods deployed within it run with the restricted-v2 Security Context Constraint by default. Which action should the administrator perform?
A developer deploys a custom application pod that requires the hostIPC capability, but the pod creation is rejected by the apiserver. Upon inspecting the cluster SCCs, the administrator determines that the application uses a ServiceAccount named app-sa in the production namespace. How should the administrator grant the restricted SCC privileges safely without compromising cluster security?
An administrator wants to prevent developers from creating pods that run as the root user across the entire cluster. Which OpenShift resource or admission mechanism is best suited to enforce this restriction globally?
An administrator is troubleshooting an Ingress routing issue where external clients receive a 503 error when trying to access a secure application through a Route configured with passthrough TLS termination. What is the most likely cause of this issue?
An administrator needs to ensure that a newly created ServiceAccount automatically receives a long-lived API token when created in OpenShift 4.14+. What is the correct procedure?
An auditor requests a report of all security context constraints currently assigned to a specific user named alice in the cluster. Which OpenShift CLI command should the administrator run?
An administrator is configuring an OAuth identity provider and needs to map claims from an external provider to OpenShift usernames. Which field in the OAuth configuration specifies the claim to use as the username?
A security engineer needs to configure the cluster-wide OAuth identity provider to use an existing LDAP server. The administrator creates an LDAP identity provider object in the cluster OAuth configuration resource (cluster). Which configuration property specifies the attribute mapping to map the LDAP entry's unique identifier to the OpenShift user name?
An application pod needs to run with a specific user ID (UID 10005000) that falls outside the restricted-v2 SCC default allocated range for the namespace. The administrator decides to create a custom SCC. Which SCC security context strategy parameter must be adjusted to allow this specific UID?
An administrator needs to secure a Route using a custom wildcard certificate. The certificate and private key are stored in a TLS Secret named wildcard-tls-secret in the same namespace as the Route. Which section of the Route manifest should reference this Secret?
A pod fails to start with 'container has runAsNonRoot and image will run as root'. Which SCC field needs to be adjusted in a custom SCC to allow this image to run?
You have a private image registry that requires credentials. Where should you place the 'imagePullSecret' so that it is automatically injected into all pods created by a specific service account?
A deployment named payments-api runs in namespace finance-prod and uses the default service account. Security auditors require that the containers run with a read-only root filesystem and prohibit privilege escalation. The deployment currently has no securityContext defined. Which action will enforce these requirements at the pod level?
A pod in the project `payments` is being rejected at admission with the error `unable to validate against any security context constraint`. The pod manifest explicitly sets `securityContext.runAsUser: 1000100000` and `fsGroup: 1000100000`. The `payments` ServiceAccount is bound to the `nonroot-v2` SCC, and the namespace is not exempt from SCC admission. Which SCC setting is most likely causing the rejection?
A cluster administrator must allow a pod in namespace data-processing to use the hostPath volume /var/log/applogs for a log-forwarding sidecar. The pod currently uses the restricted-v2 SCC. Which step is required to permit this volume type?
An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?
An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?
An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?
An administrator needs to configure re-encrypt TLS termination on a Route. In addition to the router certificate, what other certificate component must typically be provided in the route configuration?
An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?
An administrator needs to view the current list of active Security Context Constraints installed in an OpenShift cluster. Which command should be executed?
An administrator is securing routes in an OpenShift cluster. Which THREE TLS termination types are supported natively by OpenShift Routes? (Choose THREE)
An administrator needs to troubleshoot an image pull failure caused by missing credentials. Which TWO locations or methods can be used to associate an image pull secret with a workload in OpenShift? (Choose TWO)
An administrator is configuring authentication in OpenShift. Which TWO of the following identity provider types are natively supported by the OpenShift OAuth server? (Choose TWO)
An administrator is reviewing the default Security Context Constraints in OpenShift 4.14+. Which THREE of the following SCCs are built-in and provided out-of-the-box by OpenShift? (Choose THREE)
An administrator is auditing Security Context Constraints and wants to identify which settings can be controlled within a custom SCC definition. Which THREE fields are valid configuration options inside an SCC resource? (Choose THREE)
An administrator needs to restrict pod creation based on Pod Security Standards namespaces. Which TWO of the following are valid Pod Security Standard levels defined by Kubernetes and supported in OpenShift? (Choose TWO)
An administrator is managing service accounts and wants to understand how tokens work in OpenShift 4.14+. Which TWO statements are correct regarding ServiceAccount tokens in this version? (Choose TWO)
An administrator is troubleshooting an OAuth authentication failure where users receive an error indicating invalid credentials against an HTPasswd provider. Which TWO steps or checks are critical for resolving this issue? (Choose TWO)
A cluster administrator needs to grant a Deployment in the production namespace permission to pull images from a private container registry. The image pull secret is named my-registry-secret. Which step must be performed so that pods created by this Deployment can successfully pull the image?
An administrator creates a new custom Security Context Constraint (SCC) named restrict-root. After creating the SCC resource, users complain that pods using a ServiceAccount tied to this SCC are still falling back to the restricted-v2 SCC. What is the most likely cause?
A developer deploys an application using a Route that terminates TLS using the Edge termination strategy. The developer wants to ensure that all insecure HTTP traffic to the route is automatically redirected to HTTPS. Where must this setting be configured?
A cluster administrator wishes to enforce the restricted Pod Security Standard across an entire namespace named auditing-ns. Which label should the administrator apply to the namespace to enforce this policy while generating audit warnings for non-compliant pods?
Which TWO methods can an administrator use to inspect or troubleshoot Security Context Constraint (SCC) assignments for a specific ServiceAccount in a namespace?
You need to allow a specific service account to run pods as root. Which command should you use to associate the 'privileged' SCC with the 'default' service account in the 'web-apps' namespace?
An administrator is preparing a custom Security Context Constraint (SCC) that will be granted to a specific ServiceAccount used by a log-forwarding DaemonSet. The DaemonSet pods must be able to mount a hostPath volume at /var/log but must not run as UID 0 and must not use the host network. Which SCC field combination must the administrator set to allow only the hostPath mount while still blocking privileged escalation and host networking?
An administrator is preparing a custom SecurityContextConstraints (SCC) named app-scc to allow pods to run with a specific user ID and to use the host network. Which two fields must be set in the SCC to achieve these requirements? (Choose two.)
A cluster administrator wants to prevent any pod in the `finance` namespace from requesting the `NET_RAW` capability, which is not needed by the applications there. The administrator plans to modify the SCC bound to the namespace's default ServiceAccount. Which SCC field should be used to explicitly drop `NET_RAW`?
A security team wants to ensure that all pods in a new namespace called secure-apps run with a specific SELinux context level. They create a custom SCC named selinux-scc with seLinuxContext: MustRunAs and a specific level. After binding the SCC to the default service account in secure-apps, pods still fail to start with an SELinux relabeling error. What is the most likely cause?
An administrator is reviewing why a pod in the `legacy` namespace runs as UID 1000070000 even though the pod manifest does not specify a `runAsUser`. The namespace annotation `openshift.io/sa.scc.uid-range` is `1000070000/10000`. Which SCC behavior explains the observed UID?
A security team requires that a specific ServiceAccount `app-sa` in project `prod` be allowed to run pods that use the `hostNetwork` namespace, while all other ServiceAccounts in `prod` must remain restricted. The administrator creates a new SCC `hostnet-scc` with `allowHostNetwork: true` and binds it only to `app-sa`. A developer then creates a pod using the `default` ServiceAccount with `hostNetwork: true` in its manifest. What is the result?