An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?
You need to create a new project named 'secure-store' with a specified display name and description, and assign 'jane' as the project admin using the OpenShift CLI. Which command should you execute?
A new user named 'sarah' requires read-only access to all resources within the 'web-frontend' project. Which CLI command creates the appropriate RoleBinding?
An administrator needs to prevent developers from consuming more than 10 CPU cores and 40Gi of memory collectively across all pods running in the 'production' namespace. Which object satisfies this requirement?
Which OpenShift default role allows a user to see the resources in a project but explicitly prevents them from viewing build configurations, build logs, and secrets?
An organization requires that specific projects created by developers automatically receive a default ResourceQuota and LimitRange. How can an administrator achieve this in OpenShift?
You need to configure a ClusterRole that permits reading metrics endpoints across all namespaces but nothing else. Which API groups and resources must be specified in the rules block?
A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?
Which command creates a new user identity mapping using the HTPasswd provider if configured, or views user details? Let's focus on user management: Which command lists all registered user objects in the OpenShift cluster?
You need to configure a ServiceAccount named 'app-runner' in the 'finance' namespace so that its authentication token does not automatically expire or get automatically generated as a short-lived token (in OCP 4.16+, tokens are bound to service account token volume projection). If you need to create a long-lived API token secret for this ServiceAccount manually, how should you do it?
An administrator is troubleshooting a multi-tenant environment where a project administrator of the 'team-a' namespace attempts to bind the cluster-admin ClusterRole to a user in their namespace using a RoleBinding. What is the expected outcome of this operation?
Which built-in OpenShift role provides permissions to view all resources within a project but cannot see secrets or bindings? Wait, let's test: Which default role allows modifying resources in a project while excluding permission to modify RBAC roles and role bindings?
You are troubleshooting project requests. A developer runs 'oc new-project test-proj' and receives an error that project requests are disabled or forbidden. Where is the global project request template or configuration managed?
An administrator configures an external OIDC identity provider. Users can authenticate, but upon login, OpenShift reports that the user has no permissions because group synchronization fails. Where are OIDC group claims mapped in the OAuth configuration?
An administrator notices that a namespace has exceeded its object count quota for ConfigMaps. When a developer attempts to create a new ConfigMap, what error response is returned by the API server?
An administrator configures a LimitRange with a max CPU limit of 2 cores and max memory limit of 4Gi. A developer submits a pod specification where a container requests 3 cores of CPU. How does the OpenShift API server handle this request during admission?
Which TWO of the following mechanisms can prevent developers from exhausting cluster memory resources through unbounded pod creation in a namespace? (Choose TWO)
Which THREE of the following rules must be included in a custom ClusterRole to allow monitoring tools to scrape cluster-wide component metrics securely? (Choose THREE)
An administrator needs to grant a developer named 'alice' read-only access to all pods specifically within the 'development' namespace. Which command should be used to accomplish this while following the principle of least privilege?
An administrator needs to view which users currently possess the 'cluster-admin' cluster role across the OpenShift cluster. Which command is most efficient for displaying this information?
A platform administrator needs a user named 'dba@corp.example' to be able to create and delete pods in the 'database' project, but nothing else. Which command accomplishes this with the least privilege?
A developer reports that after logging in, 'oc get pods -n staging' returns a Forbidden error, but the same command works in the 'dev' project. Which command should the administrator run to see what roles the developer currently holds in the 'staging' project?
An administrator needs to grant the user 'jdoe' the ability to create and delete pods, services, and deployments in the 'staging' namespace only, using the fewest custom objects. Which approach best satisfies this requirement?
A cluster administrator is designing RBAC for a shared OpenShift cluster and wants to delegate namespace administration to team leads while keeping cluster-wide resources protected. Which TWO statements about OpenShift's default cluster roles are accurate? (Choose two.)
A security team wants to verify that no user or group can create RoleBindings in the 'finance' namespace except the 'finance-admins' group. Which command best helps an administrator enumerate the effective subjects allowed to create rolebindings in that namespace?
A developer reports they cannot deploy applications because their deployment quota is exhausted. Upon inspecting the 'LimitRange' object in the namespace, you notice default limits are set. However, a specific container in their deployment YAML fails validation during creation with an admission webhook error stating 'container exceeds minimum cpu request'. Where must the adjustment be made to allow this specific deployment?
You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?
A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?
An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?
Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?
A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?
You are configuring an OAuth identity provider in OpenShift using the HTPasswdPasswordIdentityProvider method. Where must the generated htpasswd user credentials file be stored so the cluster authentication operator can read it?
A system administrator needs to revoke the 'admin' role from user 'bob' in the 'finance' project without deleting the project or affecting other users. Which command should be used?
An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?
A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?
You need to create a Role that allows reading and writing ConfigMaps and Secrets only within the 'database' project. Which API groups and resource types should be included in the rules?
An OpenShift administrator needs to restrict developers so they cannot delete any PersistentVolumeClaims in the 'finance-prod' namespace, even though they have the 'admin' role. How can this override be achieved?
An administrator needs to configure resource requests and limits such that any pod created without explicit CPU requests in the 'web-tier' namespace automatically gets assigned a default CPU request of 200m and a default CPU limit of 500m. Which object achieves this?
A security audit requires identifying all users who have direct cluster-admin privileges assigned via individual user bindings rather than groups. How can an administrator inspect the cluster-admin ClusterRoleBinding subjects?
An administrator creates a new project request template that includes a custom RoleBinding. However, when users create new projects, the RoleBinding fails to bind because it references a ClusterRole that does not exist in the template namespace. How are ClusterRoles referenced in project templates resolved?
An administrator configures an OAuth provider with user mapping method 'lookup'. What does this mapping method do when a user authenticates for the first time?
An administrator needs to ensure that no pod in the 'secure-zone' namespace can run with root privileges or use host networking. Which mechanism natively enforces this across all pods in the namespace?
A cluster administrator wants to grant a group of users read access to all Pod logs across every namespace in the cluster. Which ClusterRole and binding approach should be used?
You need to ensure that a specific ServiceAccount named 'builder-sa' in the 'cicd' project can use the 'privileged' SecurityContextConstraints. Which command accomplishes this?
An OpenShift cluster integrates with an LDAP server where user attribute names differ from default settings (e.g., mail instead of preferredUsername). Where are these LDAP attribute mappings configured?
Which TWO of the following conditions must be met for a ServiceAccount from 'namespace-a' to successfully access API resources in 'namespace-b'? (Choose TWO)
A cluster administrator has created a new ProjectRequest template to ensure that every newly created project automatically includes a predefined LimitRange. Where must this template be configured so that it applies cluster-wide to all new projects?
An administrator is troubleshooting a service account named 'cicd-bot' in the 'ci-cd' namespace that is failing to read pods in the 'production' namespace, despite a RoleBinding existing. Upon inspection, the RoleBinding references a Role (not a ClusterRole) in the 'ci-cd' namespace. Why is the service account failing to access resources in 'production'?
An administrator wants to prevent developers from accidentally deploying containers that request excessive CPU resources in the 'analytics' namespace. Which object should the administrator create in that namespace?
A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?
An administrator is configuring a ResourceQuota named 'quota-dev' in the 'development' namespace. Which TWO of the following resource types can be directly tracked and limited by this ResourceQuota? (Choose TWO)
An administrator needs to provision a new user named 'sarah' using the HTPasswd identity provider. After updating the htpasswd file and secret, Sarah logs in successfully. What command should the administrator run to verify that OpenShift has successfully created the corresponding User object for Sarah?
An administrator needs to restrict a user group named 'contractors' so they can view pods and services, but cannot view secrets across the 'staging' namespace. Which THREE of the following steps or configurations are valid and necessary to achieve this? (Choose THREE)
When setting up authentication and user provisioning in OpenShift 4, which THREE identity providers are natively supported out-of-the-box by the OAuth server configuration? (Choose THREE)
An OpenShift administrator must give the user 'dana' permission to list and watch pods and services across every project in the cluster, but nothing else. The administrator decides to create a new ClusterRole named 'ns-reader' containing only those rules and bind it to dana. Which command correctly creates this ClusterRole?
A platform administrator is auditing RBAC in the 'payments' namespace. They notice that the group 'contractors' can list and get secrets in that namespace, but the administrators never created a RoleBinding or ClusterRoleBinding granting those permissions. Which mechanism most likely granted this access?
An administrator wants members of the LDAP-backed group 'cn=auditors,ou=groups,dc=corp' to have read-only access to every project in the cluster, including future ones, without granting them any write capability. Which action achieves this?
A user reports that 'oc get pods -n analytics' returns a Forbidden error, but 'oc get pods -n analytics --as=system:admin' succeeds. The administrator confirms the user is a member of the LDAP group 'data-team' and that a ClusterRoleBinding grants 'view' to that group. What should the administrator check first to explain the discrepancy?
An administrator is preparing to grant a ServiceAccount named 'reporter-sa' in the 'monitoring' namespace read-only access to pods and services across all namespaces in the cluster. Which TWO actions should the administrator take? (Choose two.)
An administrator must allow the ServiceAccount 'report-sa' in the 'metrics' namespace to list nodes cluster-wide, but must not grant any other cluster-level access. Which command accomplishes this?