EX280 User And RBAC Management Practice Test 3 — 15 Questions

Question 1

A security team wants to verify that no user or group can create RoleBindings in the 'finance' namespace except the 'finance-admins' group. Which command best helps an administrator enumerate the effective subjects allowed to create rolebindings in that namespace?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

oc auth can-i create rolebindings --list -n finance. The 'oc auth can-i --list' command with a namespace reports the full set of subjects authorized for a given action, aggregating RoleBindings and ClusterRoleBindings that apply there. Querying 'create rolebindings' in 'finance' therefore enumerates exactly who can modify RBAC in that namespace, matching the audit requirement.

Answer

oc adm policy who-can get rolebindings -n finance

Answer

oc describe clusterrole system:admin -n finance

Answer

oc get rolebindings -n finance -o yaml

Question 2

A developer reports they cannot deploy applications because their deployment quota is exhausted. Upon inspecting the 'LimitRange' object in the namespace, you notice default limits are set. However, a specific container in their deployment YAML fails validation during creation with an admission webhook error stating 'container exceeds minimum cpu request'. Where must the adjustment be made to allow this specific deployment?

Accepted Answer

Update the container resource requests in the deployment YAML to meet or exceed the LimitRange minimums, or adjust the LimitRange object.. The admission webhook error 'container exceeds minimum cpu request' comes from the LimitRange's min constraint, which is enforced at pod admission time. To resolve it, the container's `resources.requests.cpu` must be raised to at least the LimitRange minimum, or the LimitRange's min value must be lowered to accommodate the container. Both are valid fixes, and the option correctly names both.

Answer

Modify the ClusterQuota object to increase the CPU limit.

Answer

Create a ClusterRoleBinding giving the developer cluster-admin rights to bypass admission webhooks.

Answer

Add the developer to the 'system:masters' group to override resource constraints.

Question 3

You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?

Accepted Answer

oc auth can-i list deployments --as=system:serviceaccount:ci-cd:cicd-bot -n ci-cd. `oc auth can-i` performs a SubjectAccessReview against the OpenShift API server, and the `--as=system:serviceaccount::` flag impersonates the service account so the answer reflects that SA's effective RBAC permissions rather than the current user's. Adding `-n ci-cd` scopes the check to the ci-cd namespace, which is required because RoleBindings are namespace-scoped. This is the canonical way to verify whether a specific SA can perform a verb on a resource.

Answer

oc adm policy who-can get deployments -n ci-cd

Answer

oc describe serviceaccount cicd-bot -n ci-cd

Answer

oc get rolebindings --serviceaccount=cicd-bot

Question 4

A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?

Accepted Answer

Create a RoleBinding in the 'app-dev' namespace referencing the 'pod-debugger' ClusterRole and the 'development' group.. A RoleBinding can reference a ClusterRole, and when it does, the permissions defined in the ClusterRole are granted only within the namespace where the RoleBinding is created. By creating a RoleBinding in the 'app-dev' namespace that references the 'pod-debugger' ClusterRole and binds it to the 'development' group, the administrator ensures that only members of that group can use the role's permissions within that specific project. This is the standard OpenShift/Kubernetes pattern for scoping cluster-defined roles to a single namespace.

Answer

Modify the 'pod-debugger' ClusterRole directly to include a namespace selector for 'app-dev'.

Answer

Create a Role in the 'app-dev' namespace and assign it to the 'pod-debugger' subject.

Answer

Create a ClusterRoleBinding for the 'development' group pointing to 'pod-debugger'.

Question 5

An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?

Accepted Answer

A ClusterRole and a ClusterRoleBinding. To grant read-only access to pods across all namespaces, the permissions must be cluster-scoped. A ClusterRole defines the permissions (e.g., get, list, watch on pods), and a ClusterRoleBinding binds that ClusterRole to the service account, granting access cluster-wide. This is the correct RBAC configuration for cross-namespace access.

Answer

A SecurityContextConstraints object assigned to the ServiceAccount

Answer

A ClusterRole and a RoleBinding in the monitoring namespace

Answer

A Role and a RoleBinding in the monitoring namespace

Question 6

Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?

Accepted Answer

admin. The 'admin' cluster role is a default OpenShift role that grants full read/write access to most resources within a project, including the ability to manage roles and rolebindings inside that namespace. When bound via a RoleBinding (namespace-scoped), it confers project-level administrative rights without granting cluster-wide privileges. This is distinct from 'cluster-admin', which is a cluster-scoped role granting unrestricted access across all projects and cluster resources.

Answer

edit

Answer

view

Answer

cluster-admin

Question 7

A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?

Accepted Answer

Configure a LimitRange object in the 'data-tier' namespace with max storage constraints for persistent volume claims.. A LimitRange object in the 'data-tier' namespace can enforce a maximum storage request for PersistentVolumeClaims, rejecting any PVC that requests more than 50Gi. This is the native Kubernetes mechanism for per-namespace resource constraints on PVCs.

Answer

Set a StorageClass default size restriction.

Answer

Apply a ClusterRole restricting PVC creation sizes.

Answer

Configure an egress firewall rule blocking large volume attachments.

Question 8

You are configuring an OAuth identity provider in OpenShift using the HTPasswdPasswordIdentityProvider method. Where must the generated htpasswd user credentials file be stored so the cluster authentication operator can read it?

Accepted Answer

In the 'openshift-config' namespace as a Secret. In OpenShift 4, the OAuth configuration is defined in the cluster-scoped OAuth custom resource, and any referenced identity provider secrets must live in the openshift-config namespace. The authentication operator watches this namespace and mounts the referenced Secret into the openshift-authentication pods. Therefore, the htpasswd file must be uploaded as a Secret in openshift-config and referenced via the htpasswd.fileData.name field.

Answer

In the 'openshift-authentication' namespace as a ConfigMap

Answer

In the target user's project namespace as a Secret

Answer

On the master node filesystem at '/etc/origin/master/htpasswd'

Question 9

A system administrator needs to revoke the 'admin' role from user 'bob' in the 'finance' project without deleting the project or affecting other users. Which command should be used?

Accepted Answer

oc adm policy remove-role-from-user admin bob -n finance. The correct command to revoke a role from a user in a specific project is 'oc adm policy remove-role-from-user admin bob -n finance'. This command removes the role binding that grants the 'admin' role to user 'bob' in the 'finance' namespace, without affecting other users or the project itself.

Answer

oc revoke role admin bob --namespace=finance

Answer

oc delete user bob -n finance

Answer

oc remove-user bob --project=finance

Question 10

What is the primary function of the 'self-provisioner' cluster role in OpenShift?

Accepted Answer

It allows authenticated users to create new projects.. The self-provisioner cluster role in OpenShift is a default cluster role bound to authenticated users, allowing them to create new projects (namespaces) on demand. This enables developers to self-service project creation without requiring an administrator to create namespaces for them. It is a key part of OpenShift's multi-tenant model.

Answer

It allows users to scale deployments automatically.

Answer

It allows users to provision persistent storage volumes.

Answer

It allows users to generate their own OAuth tokens.

Question 11

An administrator wants to prevent non-admin users from creating any new projects in the OpenShift cluster. How can this be accomplished?

Accepted Answer

Delete the 'self-provisioner' ClusterRoleBinding attached to the 'system:authenticated' group.. The ability for authenticated users to create projects is granted by the self-provisioner ClusterRole, which is bound to the system:authenticated group via a ClusterRoleBinding. Removing that binding revokes the self-provisioner capability cluster-wide, preventing non-admin users from creating new projects. This is the standard OpenShift method to disable self-provisioning.

Answer

Set the project request limit quota to zero globally.

Answer

Delete the 'cluster-admin' role from all users.

Answer

Modify the OAuth configuration to reject all login requests.

Question 12

Which command allows an administrator to view all currently configured SecurityContextConstraints in an OpenShift cluster?

Accepted Answer

oc get securitycontextconstraints. SecurityContextConstraints (SCCs) are cluster-scoped resources in OpenShift, so they are queried with the standard 'oc get' verb using the resource name 'securitycontextconstraints' (or its short form 'scc'). The command 'oc get securitycontextconstraints' returns the list of all SCCs currently defined in the cluster, such as restricted, anyuid, hostaccess, and privileged. Because SCCs are not namespaced, no -n flag is required or meaningful.

Answer

oc describe scc-cluster

Answer

oc get scc --namespaced

Answer

oc get policies -n openshift-config

Question 13

An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?

Accepted Answer

In the 'openshift-config' namespace as a Secret referenced by the OAuth configuration. When configuring an LDAP identity provider in OpenShift, the bind DN password must be stored as a Secret in the 'openshift-config' namespace and referenced in the OAuth configuration. This is the required location for sensitive credentials used by the OAuth server to authenticate against LDAP.

Answer

On each worker node at '/etc/origin/master/ldap.pass'

Answer

As an environment variable on the oauth-openshift deployment

Answer

In the 'openshift-authentication' namespace as a ConfigMap

Question 14

A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?

Accepted Answer

oc auth can-i create pods -n target-ns. The 'oc auth can-i' command is the OpenShift-native way to perform a SelfSubjectAccessReview against the API server, returning yes or no for a specific verb/resource combination. Adding '-n target-ns' scopes the check to the target namespace, so the developer can verify whether their current service account or user can create pods there. This is the exact command documented for permission troubleshooting in OpenShift.

Answer

oc get rolebindings -n target-ns --user=self

Answer

oc check-permission create pods -n target-ns

Answer

oc describe authorization -n target-ns

Question 15

You need to create a Role that allows reading and writing ConfigMaps and Secrets only within the 'database' project. Which API groups and resource types should be included in the rules?

Accepted Answer

apiGroups: [''], resources: ['configmaps', 'secrets'], verbs: ['get', 'list', 'watch', 'create', 'update', 'patch', 'delete']. ConfigMaps and Secrets belong to the core API group, represented as an empty string ('') in RBAC rules. The correct verbs for read and write access are get, list, watch (read) and create, update, patch, delete (write). This Role, when bound within the 'database' project via a RoleBinding, grants the intended permissions.

Answer

apiGroups: ['rbac.authorization.k8s.io'], resources: ['roles', 'rolebindings'], verbs: ['*']

Answer

apiGroups: [''], resources: ['pods/exec'], verbs: ['create']

Answer

apiGroups: ['apps'], resources: ['configmaps', 'secrets'], verbs: ['*']