EX280 User And RBAC Management Practice Test 2 — 15 Questions

Question 1

What is the primary function of the 'self-provisioner' cluster role in OpenShift?

Accepted Answer

It allows authenticated users to create new projects.. The 'self-provisioner' role allows authenticated users to create new projects via the project request API.

Answer

It allows users to scale deployments automatically.

Answer

It allows users to provision persistent storage volumes.

Answer

It allows users to generate their own OAuth tokens.

Question 2

An administrator wants to prevent non-admin users from creating any new projects in the OpenShift cluster. How can this be accomplished?

Accepted Answer

Delete the 'self-provisioner' ClusterRoleBinding attached to the 'system:authenticated' group.. Removing the 'self-provisioner' cluster role binding from the 'system:authenticated' group prevents regular users from self-provisioning new projects.

Answer

Set the project request limit quota to zero globally.

Answer

Delete the 'cluster-admin' role from all users.

Answer

Modify the OAuth configuration to reject all login requests.

Question 3

A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?

Accepted Answer

Add 'system:serviceaccount:app-ns:app-sa' to the 'users' list inside the 'restricted-custom' SCC object.. SCCs are cluster-scoped resources that grant permissions by referencing either users, groups, or service accounts directly within the SCC's 'users' or 'groups' lists, or by binding a ClusterRole/Role that allows the 'use' verb on the specific SCC resource.

Answer

Create a RoleBinding in 'app-ns' linking 'app-sa' to a ClusterRole that permits 'use' on the 'restricted-custom' SCC.

Answer

Add an annotation to the 'app-sa' ServiceAccount object referencing the SCC name.

Answer

Create a ProjectRequest template that injects the SCC into the namespace.

Question 4

Which command allows an administrator to view all currently configured SecurityContextConstraints in an OpenShift cluster?

Accepted Answer

oc get securitycontextconstraints. The 'oc get scc' command lists all SecurityContextConstraints available in the cluster.

Answer

oc describe scc-cluster

Answer

oc get scc --namespaced

Answer

oc get policies -n openshift-config

Question 5

An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?

Accepted Answer

In the 'openshift-config' namespace as a Secret referenced by the OAuth configuration. LDAP identity provider bind passwords must be stored as a Secret in the 'openshift-config' namespace.

Answer

On each worker node at '/etc/origin/master/ldap.pass'

Answer

As an environment variable on the oauth-openshift deployment

Answer

In the 'openshift-authentication' namespace as a ConfigMap

Question 6

A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?

Accepted Answer

oc auth can-i create pods -n target-ns. The developer can use 'oc auth can-i create pods --namespace=target-ns' to check their own permissions, or specify their service account token if testing externally.

Answer

oc get rolebindings -n target-ns --user=self

Answer

oc check-permission create pods -n target-ns

Answer

oc describe authorization -n target-ns

Question 7

Which command is used to list all users who currently have the 'cluster-admin' role assigned via ClusterRoleBindings?

Accepted Answer

oc get clusterrolebindings cluster-admin -o jsonpath='{.subjects}'. The 'oc adm policy who-can' command inspects who can perform actions or who is bound to a specific role.

Answer

oc get users --role=cluster-admin

Answer

oc adm who-is cluster-admin

Answer

oc describe clusterrole cluster-admin

Question 8

You need to create a Role that allows reading and writing ConfigMaps and Secrets only within the 'database' project. Which API groups and resource types should be included in the rules?

Accepted Answer

apiGroups: [''], resources: ['configmaps', 'secrets'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']. ConfigMaps and Secrets belong to the core API group ('') and their resource names are 'configmaps' and 'secrets'.

Answer

apiGroups: ['rbac.authorization.k8s.io'], resources: ['roles', 'rolebindings'], verbs: ['*']

Answer

apiGroups: [''], resources: ['pods/exec'], verbs: ['create']

Answer

apiGroups: ['apps'], resources: ['configmaps', 'secrets'], verbs: ['*']

Question 9

An OpenShift administrator needs to restrict developers so they cannot delete any PersistentVolumeClaims in the 'finance-prod' namespace, even though they have the 'admin' role. How can this override be achieved?

Accepted Answer

Create a custom Role that omits the 'delete' verb for persistentvolumeclaims, remove the 'admin' role binding, and bind this custom Role instead.. RBAC in Kubernetes/OpenShift is strictly additive. To deny a specific action like deletion while granting admin, a custom role and binding cannot deny by default unless using specialized admission webhooks or custom authorization webhooks. Wait, Kubernetes RBAC does not support explicit denies. However, you can create a custom role without delete verbs and bind that, but if they have 'admin', they keep admin unless you remove it. To truly restrict specific verbs when using built-in roles, you cannot override unless you modify the role or use a custom authorization webhook/admission control. Let's check alternative mechanisms: Exclusion is handled by custom RBAC roles instead of 'admin', or using admission webhooks. Since standard RBAC is additive, a user cannot have 'admin' and simultaneously be denied a subset via RBAC alone without replacing the role. Let's frame the question around replacing 'admin' with a custom role that omits delete verbs.

Answer

Add a negative annotation to the user's account object.

Answer

Configure a LimitRange object with delete blocks.

Answer

Create a DenyRoleBinding specifying delete verb exclusion for persistentvolumeclaims.

Question 10

Which command displays all projects that the currently logged-in user has permission to access?

Accepted Answer

oc projects. The 'oc projects' command lists all projects accessible to the current user session.

Answer

oc list accessible-namespaces

Answer

oc auth list-projects

Answer

oc get projects

Question 11

Which command is used to switch the active project context to a namespace named 'staging' in the OpenShift CLI?

Accepted Answer

oc project staging. The 'oc project' command switches the active namespace context.

Answer

oc config set-namespace staging

Answer

oc use project staging

Answer

oc switch-context staging

Question 12

You need to assign the 'cluster-reader' ClusterRole to an LDAP group named 'ldap-auditors' across the entire cluster. Which command accomplishes this?

Accepted Answer

oc adm policy add-cluster-role-to-group cluster-reader ldap-auditors. The 'oc adm policy add-cluster-role-to-group' command correctly binds a cluster role to a group cluster-wide.

Answer

oc set cluster-role cluster-reader --group=ldap-auditors

Answer

oc adm policy add-role-to-group cluster-reader ldap-auditors --global

Answer

oc create rolebinding ldap-auditors --clusterrole=cluster-reader --group=ldap-auditors --cluster

Question 13

An administrator needs to configure resource requests and limits such that any pod created without explicit CPU requests in the 'web-tier' namespace automatically gets assigned a default CPU request of 200m and a default CPU limit of 500m. Which object achieves this?

Accepted Answer

LimitRange with default and defaultRequest parameters. A LimitRange object defines default resource requests and limits applied to containers that do not specify them.

Answer

ResourceQuota

Answer

PodPreset

Answer

ClusterResourceQuota

Question 14

A security audit requires identifying all users who have direct cluster-admin privileges assigned via individual user bindings rather than groups. How can an administrator inspect the cluster-admin ClusterRoleBinding subjects?

Accepted Answer

oc get clusterrolebinding cluster-admin -o jsonpath='{.subjects[*]}'. Inspecting the 'cluster-admin' ClusterRoleBinding object using jsonpath or yaml output displays all subjects (users, groups, service accounts).

Answer

oc describe clusterrolebinding cluster-admin --users-only

Answer

oc get users --filter='cluster-admin'

Answer

oc adm policy list-cluster-admins

Question 15

Which command creates a new user identity mapping using the HTPasswd provider if configured, or views user details? Let's focus on user management: Which command lists all registered user objects in the OpenShift cluster?

Accepted Answer

oc get users. The 'oc get users' command lists all internal User objects created in the cluster.

Answer

oc get identities

Answer

oc get accounts

Answer

oc get subjects