EX280 User And RBAC Management Practice Test 4 — 15 Questions

Question 1

An OpenShift administrator needs to restrict developers so they cannot delete any PersistentVolumeClaims in the 'finance-prod' namespace, even though they have the 'admin' role. How can this override be achieved?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom Role that omits the 'delete' verb for persistentvolumeclaims, remove the 'admin' role binding, and bind this custom Role instead.. To prevent deletion of PVCs despite the 'admin' role, you must remove the role binding that grants the admin role and instead bind a custom Role that includes all necessary permissions except the 'delete' verb for persistentvolumeclaims. This effectively overrides the default admin permissions by not granting delete rights.

Answer

Add a negative annotation to the user's account object.

Answer

Configure a LimitRange object with delete blocks.

Answer

Create a DenyRoleBinding specifying delete verb exclusion for persistentvolumeclaims.

Question 2

Which command is used to switch the active project context to a namespace named 'staging' in the OpenShift CLI?

Accepted Answer

oc project staging. The `oc project <name>` command is the documented OpenShift CLI method for switching the active project (namespace) context for subsequent commands. It updates the current context in the kubeconfig so that all future `oc` commands target the 'staging' namespace without needing `-n staging`. This is functionally equivalent to `oc config set-context --current --namespace=staging` but is the idiomatic OpenShift shortcut.

Answer

oc config set-namespace staging

Answer

oc use project staging

Answer

oc switch-context staging

Question 3

You need to assign the 'cluster-reader' ClusterRole to an LDAP group named 'ldap-auditors' across the entire cluster. Which command accomplishes this?

Accepted Answer

oc adm policy add-cluster-role-to-group cluster-reader ldap-auditors. `oc adm policy add-cluster-role-to-group` is the canonical OpenShift command that binds a ClusterRole to a group at the cluster scope, creating a ClusterRoleBinding. Passing 'cluster-reader' as the role and 'ldap-auditors' as the group grants the LDAP group cluster-wide read access.

Answer

oc set cluster-role cluster-reader --group=ldap-auditors

Answer

oc adm policy add-role-to-group cluster-reader ldap-auditors --global

Answer

oc create rolebinding ldap-auditors --clusterrole=cluster-reader --group=ldap-auditors --cluster

Question 4

An administrator needs to configure resource requests and limits such that any pod created without explicit CPU requests in the 'web-tier' namespace automatically gets assigned a default CPU request of 200m and a default CPU limit of 500m. Which object achieves this?

Accepted Answer

LimitRange with default and defaultRequest parameters. A LimitRange object with default and defaultRequest parameters is specifically designed to set default resource requests and limits for containers in a namespace. When a pod is created without explicit CPU requests, the LimitRange's defaultRequest value (200m) is applied as the request, and the default value (500m) is applied as the limit. This ensures consistent resource allocation and prevents pods from being created without any resource constraints.

Answer

ResourceQuota

Answer

PodPreset

Answer

ClusterResourceQuota

Question 5

A security audit requires identifying all users who have direct cluster-admin privileges assigned via individual user bindings rather than groups. How can an administrator inspect the cluster-admin ClusterRoleBinding subjects?

Accepted Answer

oc get clusterrolebinding cluster-admin -o jsonpath='{.subjects[*]}'. The cluster-admin ClusterRoleBinding object stores its subjects (Users, Groups, ServiceAccounts) in the .subjects array of its JSON representation. Using 'oc get clusterrolebinding cluster-admin -o jsonpath="{.subjects[*]}"' extracts every subject entry, allowing the administrator to enumerate exactly which individual users, groups, and service accounts hold cluster-admin. This is the canonical way to audit direct user bindings versus group-derived bindings.

Answer

oc describe clusterrolebinding cluster-admin --users-only

Answer

oc get users --filter='cluster-admin'

Answer

oc adm policy list-cluster-admins

Question 6

An administrator creates a new project request template that includes a custom RoleBinding. However, when users create new projects, the RoleBinding fails to bind because it references a ClusterRole that does not exist in the template namespace. How are ClusterRoles referenced in project templates resolved?

Accepted Answer

ClusterRoles must be created cluster-wide prior to template instantiation because RoleBindings within the template reference them.. RoleBindings inside a project request template reference ClusterRoles by name, and those ClusterRoles must already exist cluster-wide before the template is instantiated. The template does not embed or create ClusterRoles; it only creates namespaced resources in the new project. If the referenced ClusterRole is missing, the RoleBinding fails to bind.

Answer

ClusterRoles must be defined inside the same project request template YAML file.

Answer

Project request templates do not support RoleBindings; only ResourceQuotas are allowed.

Answer

The RoleBinding must use a Namespaced Role instead of a ClusterRole.

Question 7

Which command allows an administrator to delete a user object named 'old-user' from the OpenShift cluster?

Accepted Answer

oc delete user old-user. The correct command is 'oc delete user old-user'. This command removes the user object from the OpenShift cluster. OpenShift users are represented as cluster-scoped resources, and the standard 'oc delete' verb is used to remove them. Other options are not valid OpenShift commands.

Answer

oc deactivate user old-user

Answer

oc purge user old-user --force

Answer

oc remove user old-user

Question 8

An administrator configures an OAuth provider with user mapping method 'lookup'. What does this mapping method do when a user authenticates for the first time?

Accepted Answer

It requires that a User object already exists and is pre-associated with the identity; otherwise, login fails.. The 'lookup' mapping method in OpenShift's OAuth configuration requires that a User object already exists and is pre-associated with the incoming Identity. When a user authenticates for the first time, the OAuth server checks if an Identity exists for the provider's user ID; if not, it attempts to find a User with that identity. If no such User exists, login fails. This is in contrast to the 'claim' method, which dynamically creates User and Identity objects based on claims from the identity provider.

Answer

It rejects all login attempts unless the user is member of the 'system:masters' group.

Answer

It automatically creates a new User object and links it to the incoming Identity.

Answer

It maps all incoming users to a single shared service account.

Question 9

An administrator needs to ensure that no pod in the 'secure-zone' namespace can run with root privileges or use host networking. Which mechanism natively enforces this across all pods in the namespace?

Accepted Answer

Assigning a restrictive SecurityContextConstraints (SCC) policy to the service accounts running the pods. SecurityContextConstraints (SCCs) are OpenShift's native cluster-level policy objects that control pod security settings such as running as root, host networking, and volume types. Assigning a restrictive SCC to the service accounts used by pods in the namespace enforces these restrictions across all pods.

Answer

Setting container securityContext in every deployment manually

Answer

Configuring a NetworkPolicy to block root network namespaces

Answer

ResourceQuota limits on security capabilities

Question 10

A cluster administrator wants to grant a group of users read access to all Pod logs across every namespace in the cluster. Which ClusterRole and binding approach should be used?

Accepted Answer

ClusterRole with apiGroups: [''], resources: ['pods/log'], verbs: ['get'] bound via ClusterRoleBinding. To grant read access to pod logs across all namespaces, you need a ClusterRole that grants 'get' on the 'pods/log' subresource in the core API group, bound with a ClusterRoleBinding to the target group. The ClusterRoleBinding ensures the permission applies cluster-wide rather than in a single namespace. This is the canonical RBAC pattern for cross-namespace log access.

Answer

RoleBinding in each individual namespace pointing to the 'view' ClusterRole

Answer

SecurityContextConstraints modification

Answer

ClusterRole with apiGroups: ['apps'], resources: ['deployments/scale'], verbs: ['get']

Question 11

Which command is used to create a new cluster role named 'storage-reader' that permits getting and listing PersistentVolumes cluster-wide?

Accepted Answer

oc create clusterrole storage-reader --verb=get,list --resource=persistentvolumes. The correct command is `oc create clusterrole storage-reader --verb=get,list --resource=persistentvolumes`. This uses the `oc create clusterrole` subcommand, which is the standard OpenShift/Kubernetes imperative command for creating a ClusterRole resource. The `--verb` flag specifies the allowed actions (get, list), and `--resource` specifies the target resource type (persistentvolumes). This directly creates a ClusterRole named 'storage-reader' with the desired permissions cluster-wide.

Answer

oc new clusterrole storage-reader --permissions=pv:get,list

Answer

oc create role storage-reader --cluster --verb=get,list --resource=persistentvolumes

Answer

oc adm create-role storage-reader --cluster-wide --verbs=get,list --resources=pv

Question 12

You need to verify whether a particular ServiceAccount in your project has permissions to read Secrets. Which command tests this authorization?

Accepted Answer

oc auth can-i get secrets --as=system:serviceaccount::. `oc auth can-i get secrets --as=system:serviceaccount::` submits a SubjectAccessReview to the API server impersonating the named service account, returning the effective allow/deny decision for the `get` verb on `secrets`. This is the only command among the options that actually evaluates RBAC rather than merely displaying configuration. It works regardless of whether the permission comes from a RoleBinding, ClusterRoleBinding, or an aggregated role.

Answer

oc describe rolebinding --serviceaccount=<serviceaccount-name>

Answer

oc check secrets --serviceaccount=<serviceaccount-name>

Answer

oc adm verify-sa <serviceaccount-name>

Question 13

Which command allows an administrator to view details of a specific project named 'web-app', including its annotations and status?

Accepted Answer

oc describe project web-app. The `oc describe project web-app` command is correct because `oc describe` is the standard OpenShift/Kubernetes subcommand for retrieving detailed, human-readable information about a resource, including its annotations, status, labels, and related events. For a Project resource, this output aggregates metadata such as the project's display name, description, status phase (Active/Terminating), and any annotations. It is the only option that uses a valid `oc` verb (`describe`) to produce the verbose, multi-section output the question requires.

Answer

oc inspect project web-app

Answer

oc show project web-app

Answer

oc get project web-app --details

Question 14

You need to assign a custom ClusterRole named 'operator-viewer' to all authenticated users cluster-wide. Which command accomplishes this?

Accepted Answer

oc adm policy add-cluster-role-to-group operator-viewer system:authenticated. The command `oc adm policy add-cluster-role-to-group operator-viewer system:authenticated` correctly binds the custom ClusterRole `operator-viewer` to the `system:authenticated` group, which includes all authenticated users cluster-wide. This is the standard OpenShift way to grant a cluster role to a group, and `system:authenticated` is the built-in group automatically assigned to any user who has successfully authenticated. The `add-cluster-role-to-group` subcommand creates a ClusterRoleBinding, ensuring the role applies across all projects and namespaces.

Answer

oc adm policy add-cluster-role-to-user operator-viewer --all-users

Answer

oc set role operator-viewer --cluster --to-all

Answer

oc create clusterrolebinding all-users --clusterrole=operator-viewer --user=system:everyone

Question 15

Which command is used to remove a role binding named 'dev-binding' from a namespace named 'development'?

Accepted Answer

oc delete rolebinding dev-binding -n development. RoleBindings are standard Kubernetes/OpenShift resources, so they are removed with the generic 'oc delete' verb followed by the resource type and name. The command 'oc delete rolebinding dev-binding -n development' deletes the named RoleBinding from the development namespace, immediately revoking the permissions it granted. There is no dedicated 'revoke', 'drop', or 'remove' verb for rolebindings in oc.

Answer

oc revoke rolebinding dev-binding -n development

Answer

oc drop rolebinding dev-binding -n development

Answer

oc remove rolebinding dev-binding -n development