EX280 User And RBAC Management Practice Test 2 — 15 Questions

Question 1

You are troubleshooting project requests. A developer runs 'oc new-project test-proj' and receives an error that project requests are disabled or forbidden. Where is the global project request template or configuration managed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the cluster-scoped 'project.config.openshift.io/cluster' resource. The global project request configuration in OpenShift is managed through the cluster-scoped custom resource 'project.config.openshift.io/cluster'. This resource controls the project request template and other project-related settings. When a developer runs 'oc new-project', the cluster uses this configuration to determine whether project requests are enabled and how they are processed. Modifying or inspecting this resource is the correct way to troubleshoot errors about disabled project requests.

Answer

In the 'kube-system' namespace as a Secret

Answer

In the 'openshift-config' namespace as a ConfigMap named 'project-request'

Answer

In the OAuth configuration file on master nodes

Question 2

Which command displays the current user identity and cluster context information for the logged-in OpenShift CLI session?

Accepted Answer

oc whoami. The `oc whoami` command is the correct answer because it displays the current user identity for the logged-in OpenShift CLI session. It returns the username that the CLI is authenticated as, which is essential for verifying permissions and troubleshooting access issues. This command is a direct counterpart to the `whoami` command in Linux, adapted for OpenShift's authentication context.

Answer

oc current-user

Answer

oc get identity --current

Answer

oc auth status

Question 3

An administrator configures an external OIDC identity provider. Users can authenticate, but upon login, OpenShift reports that the user has no permissions because group synchronization fails. Where are OIDC group claims mapped in the OAuth configuration?

Accepted Answer

In the 'claims.groups' section of the OIDC identity provider CR. In OpenShift, when configuring an OIDC identity provider, the group claims are mapped in the 'claims.groups' field of the OIDC identity provider CR. This tells OpenShift which claim in the OIDC ID token contains the user's group memberships, enabling group synchronization.

Answer

In the cluster RoleBinding configuration file

Answer

In a separate GroupSync CR managed by the LDAP operator

Answer

Inside the kube-apiserver static pod manifest

Question 4

An administrator notices that a namespace has exceeded its object count quota for ConfigMaps. When a developer attempts to create a new ConfigMap, what error response is returned by the API server?

Accepted Answer

HTTP 403 Forbidden with a message stating the resource quota has been exceeded. When a namespace exceeds its object count quota for ConfigMaps, the API server rejects the create request with HTTP 403 Forbidden and a message indicating the resource quota has been exceeded. ResourceQuota admission control enforces this at admission time, so the object is never persisted. The error is a quota violation, not an authentication or timeout issue.

Answer

HTTP 401 Unauthorized forcing the user to re-authenticate

Answer

HTTP 200 OK, but the ConfigMap is placed in a pending state until quota frees up

Answer

HTTP 504 Gateway Timeout because the controller manager is blocked

Question 5

An administrator configures a LimitRange with a max CPU limit of 2 cores and max memory limit of 4Gi. A developer submits a pod specification where a container requests 3 cores of CPU. How does the OpenShift API server handle this request during admission?

Accepted Answer

The API server rejects the pod creation because the container's CPU request violates the LimitRange maximum constraint.. LimitRange constraints are enforced by the LimitRanger admission controller during pod creation. When a container's CPU request exceeds the LimitRange's max CPU limit, the admission controller rejects the pod immediately with a validation error, and the pod is never persisted to etcd. The API server does not silently cap or throttle the value — it refuses the request outright.

Answer

The API server throttles the container CPU usage at runtime to 2 cores automatically.

Answer

The pod enters a CrashLoopBackOff state while waiting for resource allocation.

Answer

The API server accepts the pod and caps the container spec value to 2 cores.

Question 6

Which TWO of the following methods can an administrator use to inspect existing RoleBindings within a project named 'app-namespace'? (Choose TWO)

Accepted Answer

oc describe rolebindings -n app-namespace. Option B is correct because 'oc describe rolebindings -n app-namespace' retrieves the RoleBindings in the specified namespace and displays their detailed configuration, including subjects, referenced roles, and labels. Option C is correct because 'oc get rolebindings -n app-namespace' lists the RoleBindings scoped to the app-namespace project, which is exactly what the administrator needs to inspect existing bindings. Option A is incorrect because 'clusterrolebindings' are cluster-scoped resources and are not filtered by the -n namespace flag, so it would not inspect project-level RoleBindings. Option D is incorrect because 'oc adm policy list-bindings' is not a valid oc adm policy subcommand for listing RoleBindings. Option E is incorrect because 'oc show' is not a valid oc command for displaying RoleBindings.

Answer

oc get clusterrolebindings -n app-namespace

Answer

oc adm policy list-bindings -n app-namespace

Answer

oc show rolebindings -n app-namespace

Question 7

Which TWO of the following mechanisms can prevent developers from exhausting cluster memory resources through unbounded pod creation in a namespace? (Choose TWO)

Accepted Answer

Configuring a LimitRange with default container memory limits.. Option C is correct because a LimitRange with default container memory limits ensures that any pod created in the namespace without explicit resource requests/limits automatically receives a bounded memory limit, so each pod consumes a capped amount of memory and cannot individually exhaust cluster memory. Option D is correct because a ResourceQuota with limits.memory constraints caps the total sum of memory limits (and requests) that all pods in the namespace can consume, so once the quota is reached, further pod creation is rejected by the API server, directly preventing unbounded pod creation from exhausting memory. Option A is not correct because Cluster Autoscaler node group scaling limits only bound how many nodes can be added or removed; they do not prevent developers from creating unbounded pods or consuming memory within existing nodes. Option B is not correct because a ClusterRole restricting memory API verbs is not a real Kubernetes mechanism for limiting memory consumption; RBAC controls access to API operations, not resource usage, and there is no 'memory API' whose verbs would cap memory. Option E is not correct because an egress firewall blocking external APIs does not limit pod creation or memory usage inside the cluster and is unrelated to namespace memory exhaustion.

Answer

Enabling Cluster Autscaler node group scaling limits.

Answer

Applying a ClusterRole restricting memory API verbs.

Answer

Creating an egress firewall blocking memory-intensive external APIs.

Question 8

Which THREE of the following rules must be included in a custom ClusterRole to allow monitoring tools to scrape cluster-wide component metrics securely? (Choose THREE)

Accepted Answer

apiGroups: [''], resources: ['services', 'endpoints', 'pods'], verbs: ['get', 'list', 'watch']. Option A is correct because a monitoring tool needs to discover scrape targets by listing and watching core resources such as services, endpoints, and pods, which requires get/list/watch on the empty API group. Option B is correct because scraping cluster-wide component metrics often relies on the metrics.k8s.io API to read pod and node resource metrics via get/list. Option D is correct because accessing node-level metrics securely uses the nodes/metrics subresource and nodes/proxy with get permission, which is the standard non-privileged way to scrape kubelet metrics. Option C is not needed and would be overly broad, since granting wildcard access to clusterroles is a privilege-escalation risk unrelated to scraping metrics. Option E is unrelated because deleting deployments is a destructive application-management action, not a monitoring read operation.

Answer

apiGroups: ['rbac.authorization.k8s.io'], resources: ['clusterroles'], verbs: ['*']

Answer

apiGroups: ['apps'], resources: ['deployments'], verbs: ['delete']

Question 9

An administrator needs to grant a developer named 'alice' read-only access to all pods specifically within the 'development' namespace. Which command should be used to accomplish this while following the principle of least privilege?

Accepted Answer

oc create rolebinding alice-view --clusterrole=view --user=alice -n development. The correct command is `oc create rolebinding alice-view --clusterrole=view --user=alice -n development`, which binds the built-in 'view' ClusterRole to user alice within the development namespace only. This grants read-only access to pods (and other resources) scoped to that namespace, following least privilege. A RoleBinding (not ClusterRoleBinding) is required to limit the grant to a single namespace.

Answer

oc create role alice-view --verb=get,list,watch --resource=pods --user=alice -n development

Answer

oc adm policy add-cluster-role-to-user cluster-admin alice

Answer

oc create clusterrolebinding alice-view --clusterrole=view --user=alice

Question 10

Which THREE of the following components are involved in authenticating a user via an external OAuth identity provider in OpenShift? (Choose THREE)

Accepted Answer

OpenShift OAuth Server. The OpenShift OAuth Server (B) is the built-in authorization server that brokers the login flow, issuing OAuth tokens and redirecting users to the configured identity provider for authentication. The External Identity Provider (C), such as an LDAP directory or an OIDC server, is the actual authority that validates the user's credentials and returns an identity assertion or token to the OAuth server. The OpenShift API Server (E) participates because it accepts the OAuth access token as a bearer credential, validates it against the OAuth server, and then authorizes the API requests under the resulting user identity. The Kubelet node agent (A) only manages pod lifecycle on nodes and plays no role in user authentication, while the Cluster Storage Operator (D) manages storage components and is unrelated to the OAuth login flow.

Answer

Kubelet node agent

Answer

Cluster Storage Operator

Question 11

An administrator needs to view which users currently possess the 'cluster-admin' cluster role across the OpenShift cluster. Which command is most efficient for displaying this information?

Accepted Answer

oc describe clusterrolebinding cluster-admin. The `oc describe clusterrolebinding cluster-admin` command directly displays the subjects (users, groups, service accounts) bound to the cluster-admin ClusterRole via the clusterrolebinding named 'cluster-admin'. This binding is the default one created by OpenShift that grants cluster-admin privileges, so describing it efficiently reveals all users who currently possess that role. The output includes the subjects field, which lists the users, making it the most straightforward and efficient method.

Answer

oc auth can-i --list --all-namespaces

Answer

oc get clusterroles cluster-admin -o jsonpath='{.subjects}'

Answer

oc get users --selector=role=cluster-admin

Question 12

A platform administrator needs a user named 'dba@corp.example' to be able to create and delete pods in the 'database' project, but nothing else. Which command accomplishes this with the least privilege?

Accepted Answer

oc adm policy add-role-to-user pod-admin dba@corp.example -n database. To grant only pod create and delete, an administrator must bind a role that contains exactly those verbs on pods. None of the built-in cluster roles ('view', 'edit', 'admin') match that narrow scope, so the correct approach would be a custom Role bound via a RoleBinding in the 'database' project.

Answer

oc adm policy add-role-to-user edit dba@corp.example -n database

Answer

oc adm policy add-role-to-user admin dba@corp.example -n database

Answer

oc adm policy add-role-to-user view dba@corp.example -n database

Question 13

A developer reports that after logging in, 'oc get pods -n staging' returns a Forbidden error, but the same command works in the 'dev' project. Which command should the administrator run to see what roles the developer currently holds in the 'staging' project?

Accepted Answer

oc auth can-i --list -n staging --as=developer. To determine a user's effective permissions in a namespace, the administrator should impersonate the user with 'oc auth can-i --list'. This shows both the allowed verbs and the roles responsible, making it the fastest way to confirm the developer lacks any binding in 'staging'.

Answer

oc get rolebindings -n staging

Answer

oc get clusterrolebindings

Answer

oc describe project staging

Question 14

An administrator needs to grant the user 'jdoe' the ability to create and delete pods, services, and deployments in the 'staging' namespace only, using the fewest custom objects. Which approach best satisfies this requirement?

Accepted Answer

Create a RoleBinding in 'staging' that references the default 'edit' ClusterRole for user 'jdoe'.. A RoleBinding created in the 'staging' namespace can point at the default 'edit' ClusterRole and confine its rules to that namespace. This grants jdoe the requested create and delete operations on pods, services, and deployments without cluster-wide impact, and it avoids writing a custom Role, satisfying the fewest-objects constraint.

Answer

Create a Role in 'staging' with a wildcard on all verbs and resources and bind it to 'jdoe'.

Answer

Create a ClusterRoleBinding to the default 'edit' ClusterRole for user 'jdoe'.

Answer

Add 'jdoe' to the 'system:cluster-admins' group so the permissions are inherited.

Question 15

A cluster administrator is designing RBAC for a shared OpenShift cluster and wants to delegate namespace administration to team leads while keeping cluster-wide resources protected. Which TWO statements about OpenShift's default cluster roles are accurate? (Choose two.)

Accepted Answer

The 'admin' ClusterRole can create RoleBindings within its namespace, allowing a team lead to grant the 'view' role to teammates.. The 'admin' role is scoped to allow namespace-level RBAC delegation through RoleBindings, and 'cluster-admin' bound cluster-wide permits modification of RBAC policies everywhere. These two properties reflect OpenShift's tiered administration model, where project admins delegate within their namespace while cluster admins control the global policy surface.

Answer

The 'basic-user' ClusterRole grants authenticated users the ability to create new projects in the cluster.

Answer

The 'view' ClusterRole includes permission to read Secrets within the namespace.

Answer

The 'edit' ClusterRole can modify the project's ResourceQuota objects to increase the quota limit.