EX280 User And RBAC Management Practice Test 3 — 15 Questions

Question 1

An administrator creates a new project request template that includes a custom RoleBinding. However, when users create new projects, the RoleBinding fails to bind because it references a ClusterRole that does not exist in the template namespace. How are ClusterRoles referenced in project templates resolved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ClusterRoles must be created cluster-wide prior to template instantiation because RoleBindings within the template reference them.. ClusterRoles are cluster-scoped resources, so any RoleBinding inside a project request template can reference an existing ClusterRole (like 'admin', 'edit', or custom ClusterRoles) because ClusterRoles exist cluster-wide. Wait, if the error states the cluster role does not exist, what could be the issue? The ClusterRole must exist cluster-wide. If it does, the RoleBinding binds successfully. If the question implies a custom ClusterRole must be created first before the template can reference it, that is the correct operational dependency.

Answer

ClusterRoles must be defined inside the same project request template YAML file.

Answer

Project request templates do not support RoleBindings; only ResourceQuotas are allowed.

Answer

The RoleBinding must use a Namespaced Role instead of a ClusterRole.

Question 2

You need to configure a ServiceAccount named 'app-runner' in the 'finance' namespace so that its authentication token does not automatically expire or get automatically generated as a short-lived token (in OCP 4.16+, tokens are bound to service account token volume projection). If you need to create a long-lived API token secret for this ServiceAccount manually, how should you do it?

Accepted Answer

oc create token app-runner -n finance --duration=8760h. In modern OpenShift versions, long-lived tokens are no longer automatically created for ServiceAccounts. To create one, you must create a Secret of type 'kubernetes.io/service-account-token' with an annotation pointing to the service account.

Answer

Edit the service account YAML to set 'automountServiceAccountToken: true'.

Answer

oc create secret generic my-token --type=kubernetes.io/service-account-token -n finance

Answer

oc adm create-token app-runner --permanent

Question 3

An administrator is troubleshooting a multi-tenant environment where a project administrator of the 'team-a' namespace attempts to bind the cluster-admin ClusterRole to a user in their namespace using a RoleBinding. What is the expected outcome of this operation?

Accepted Answer

The operation succeeds, and the user receives admin privileges restricted solely to the 'team-a' namespace.. A RoleBinding can reference a ClusterRole, which grants the permissions of that ClusterRole scoped to that namespace. However, binding cluster-admin via a RoleBinding grants full admin privileges *within that namespace*, not cluster-wide.

Answer

The API server rejects the request because RoleBindings cannot reference ClusterRoles.

Answer

The operation succeeds, but the authorization webhook automatically strips dangerous privileges like secret reading.

Answer

The operation succeeds, and the user receives cluster-admin privileges across the entire cluster.

Question 4

Which command allows an administrator to delete a user object named 'old-user' from the OpenShift cluster?

Accepted Answer

oc delete user old-user. The 'oc delete user old-user' command removes the user resource from the cluster database.

Answer

oc deactivate user old-user

Answer

oc purge user old-user --force

Answer

oc remove user old-user

Question 5

An administrator configures an OAuth provider with user mapping method 'lookup'. What does this mapping method do when a user authenticates for the first time?

Accepted Answer

It requires that a User object already exists and is pre-associated with the identity; otherwise, login fails.. The 'lookup' mapping method requires that both an Identity and a User object already exist and be linked; if not, authentication fails. (In contrast to 'add', which creates them).

Answer

It rejects all login attempts unless the user is member of the 'system:masters' group.

Answer

It automatically creates a new User object and links it to the incoming Identity.

Answer

It maps all incoming users to a single shared service account.

Question 6

You need to inspect the resource quota consumption and current usage status for a project named 'analytics'. Which command should you run?

Accepted Answer

oc get quota -n analytics. The 'oc describe quota' or 'oc get quota' command displays current resource consumption against defined limits.

Answer

oc describe project analytics --quotas

Answer

oc adm top quota -n analytics

Answer

oc status quota -n analytics

Question 7

Which built-in OpenShift role provides permissions to view all resources within a project but cannot see secrets or bindings? Wait, let's test: Which default role allows modifying resources in a project while excluding permission to modify RBAC roles and role bindings?

Accepted Answer

edit. The 'edit' role allows a user to create, modify, and delete most project resources, but prevents them from modifying Roles or RoleBindings.

Answer

view

Answer

cluster-admin

Answer

admin

Question 8

An administrator needs to ensure that no pod in the 'secure-zone' namespace can run with root privileges or use host networking. Which mechanism natively enforces this across all pods in the namespace?

Accepted Answer

Assigning a restrictive SecurityContextConstraints (SCC) policy to the service accounts running the pods. SecurityContextConstraints (SCCs) control pod security attributes. By assigning a restrictive SCC (like 'restricted') to the service accounts in the namespace, root execution and host networking are prevented.

Answer

Setting container securityContext in every deployment manually

Answer

Configuring a NetworkPolicy to block root network namespaces

Answer

ResourceQuota limits on security capabilities

Question 9

You are troubleshooting project requests. A developer runs 'oc new-project test-proj' and receives an error that project requests are disabled or forbidden. Where is the global project request template or configuration managed?

Accepted Answer

In the cluster-scoped 'project.config.openshift.io/cluster' resource. Project request configurations are managed via the 'Project' cluster operator configuration resource ('cluster' instance of project.config.openshift.io).

Answer

In the 'kube-system' namespace as a Secret

Answer

In the 'openshift-config' namespace as a ConfigMap named 'project-request'

Answer

In the OAuth configuration file on master nodes

Question 10

Which command displays the current user identity and cluster context information for the logged-in OpenShift CLI session?

Accepted Answer

oc whoami. The 'oc whoami' command outputs the username of the currently authenticated CLI session.

Answer

oc current-user

Answer

oc get identity --current

Answer

oc auth status

Question 11

A cluster administrator wants to grant a group of users read access to all Pod logs across every namespace in the cluster. Which ClusterRole and binding approach should be used?

Accepted Answer

ClusterRole with apiGroups: [''], resources: ['pods/log'], verbs: ['get'] bound via ClusterRoleBinding. Reading pod logs requires permissions on the 'pods/log' subresource. A ClusterRole granting 'get' on 'pods/log' combined with a ClusterRoleBinding achieves this cluster-wide.

Answer

RoleBinding in each individual namespace pointing to the 'view' ClusterRole

Answer

SecurityContextConstraints modification

Answer

ClusterRole with apiGroups: ['apps'], resources: ['deployments/scale'], verbs: ['get']

Question 12

An administrator configures an external OIDC identity provider. Users can authenticate, but upon login, OpenShift reports that the user has no permissions because group synchronization fails. Where are OIDC group claims mapped in the OAuth configuration?

Accepted Answer

In the 'claims.groups' section of the OIDC identity provider CR. In OpenShift OAuth OIDC configuration, group claims are specified under the 'claims.groups' field of the identity provider specification.

Answer

In the cluster RoleBinding configuration file

Answer

In a separate GroupSync CR managed by the LDAP operator

Answer

Inside the kube-apiserver static pod manifest

Question 13

Which command is used to create a new cluster role named 'storage-reader' that permits getting and listing PersistentVolumes cluster-wide?

Accepted Answer

oc create clusterrole storage-reader --verb=get,list --resource=persistentvolumes. The 'oc create clusterrole' command creates a cluster role with specified verbs and resources.

Answer

oc new clusterrole storage-reader --permissions=pv:get,list

Answer

oc create role storage-reader --cluster --verb=get,list --resource=persistentvolumes

Answer

oc adm create-role storage-reader --cluster-wide --verbs=get,list --resources=pv

Question 14

You need to verify whether a particular ServiceAccount in your project has permissions to read Secrets. Which command tests this authorization?

Accepted Answer

oc auth can-i get secrets --as=system:serviceaccount::. Using 'oc auth can-i' with the '--as' flag pointing to the service account tests its permissions.

Answer

oc describe rolebinding --serviceaccount=<serviceaccount-name>

Answer

oc check secrets --serviceaccount=<serviceaccount-name>

Answer

oc adm verify-sa <serviceaccount-name>

Question 15

An administrator notices that a namespace has exceeded its object count quota for ConfigMaps. When a developer attempts to create a new ConfigMap, what error response is returned by the API server?

Accepted Answer

HTTP 403 Forbidden with a message stating the resource quota has been exceeded. When a ResourceQuota is exceeded, the API server rejects the admission request with a 403 Forbidden or 422 Unprocessable Entity error indicating the quota has been exceeded.

Answer

HTTP 401 Unauthorized forcing the user to re-authenticate

Answer

HTTP 200 OK, but the ConfigMap is placed in a pending state until quota frees up

Answer

HTTP 504 Gateway Timeout because the controller manager is blocked