EX280 User And RBAC Management Practice Test 5 — 15 Questions

Question 1

Which THREE of the following actions can a user with the default OpenShift 'view' role perform within a project? (Choose THREE)

Accepted Answer

View ConfigMaps. The 'view' role permits viewing pods, services, deployments, and configmaps, but restricts secrets.

Answer

Delete PersistentVolumeClaims

Answer

Modify RoleBindings within the project

Question 2

Which TWO of the following mechanisms can prevent developers from exhausting cluster memory resources through unbounded pod creation in a namespace? (Choose TWO)

Accepted Answer

Configuring a LimitRange with default container memory limits.. ResourceQuotas and LimitRanges prevent unbounded consumption by setting hard aggregate limits and container request/limit defaults.

Answer

Enabling Cluster Autscaler node group scaling limits.

Answer

Applying a ClusterRole restricting memory API verbs.

Answer

Creating an egress firewall blocking memory-intensive external APIs.

Question 3

Which THREE of the following rules must be included in a custom ClusterRole to allow monitoring tools to scrape cluster-wide component metrics securely? (Choose THREE)

Accepted Answer

apiGroups: [''], resources: ['services', 'endpoints', 'pods'], verbs: ['get', 'list', 'watch']. Scraping metrics cluster-wide typically requires verbs like 'get' and 'list' on resources such as nodes/metrics, pods, and services or endpoints.

Answer

apiGroups: ['rbac.authorization.k8s.io'], resources: ['clusterroles'], verbs: ['*']

Answer

apiGroups: ['apps'], resources: ['deployments'], verbs: ['delete']

Question 4

Which TWO of the following commands can an administrator use to verify the identity and permissions of the currently logged-in user? (Choose TWO)

Accepted Answer

oc whoami. The 'oc whoami' and 'oc auth can-i' commands check user identity and permissions.

Answer

oc get user --current

Answer

oc adm who-can-i

Answer

oc describe authentication

Question 5

Which THREE of the following are valid parameters that can be specified in a LimitRange object specification? (Choose THREE)

Accepted Answer

max. LimitRanges support 'max', 'min', 'default', 'defaultRequest', and 'maxLimitRequestRatio' for resource types like Pod, Container, and PersistentVolumeClaim.

Answer

replicas

Answer

clusterWideAccess

Question 6

Which TWO of the following actions occur when a user is deleted from an OpenShift cluster using 'oc delete user <username>'? (Choose TWO)

Accepted Answer

The User resource object is removed from the cluster database.. Deleting a User object removes the user entity, but existing RBAC bindings referencing that username remain until cleaned up, and their active OAuth tokens are revoked.

Answer

External identity provider records are automatically deleted from LDAP or OIDC servers.

Answer

All namespaces owned or created by the user are permanently deleted.

Answer

All RoleBindings and ClusterRoleBindings referencing the user are automatically deleted.

Question 7

Which TWO of the following tasks can a user with the default OpenShift 'admin' role perform within their project? (Choose TWO)

Accepted Answer

Create, modify, and delete workloads and services within the project.. The 'admin' role permits managing project resources as well as creating and modifying Roles and RoleBindings within the project.

Answer

Modify cluster-wide ClusterRoles and ClusterRoleBindings.

Answer

Create new projects cluster-wide without restrictions.

Answer

Modify global SecurityContextConstraints.

Question 8

Which TWO of the following conditions must be met for a ServiceAccount from 'namespace-a' to successfully access API resources in 'namespace-b'? (Choose TWO)

Accepted Answer

A RoleBinding must exist in 'namespace-b' referencing the ServiceAccount as 'system:serviceaccount:namespace-a:sa-name'.. Cross-namespace access requires a RoleBinding in target 'namespace-b' granting permissions to the ServiceAccount from 'namespace-a', and the ServiceAccount must have permission to target that namespace.

Answer

The source namespace must disable its LimitRange objects.

Answer

An administrative override annotation must be placed on the target namespace.

Answer

The ServiceAccount must be granted cluster-admin rights cluster-wide.

Question 9

An administrator needs to grant a developer named 'alice' read-only access to all pods specifically within the 'development' namespace. Which command should be used to accomplish this while following the principle of least privilege?

Accepted Answer

oc create rolebinding alice-view --clusterrole=view --user=alice -n development. The view ClusterRole provides read-only access to most resource types within a project. Binding it via a RoleBinding in the specific namespace limits access strictly to that namespace.

Answer

oc create role alice-view --verb=get,list,watch --resource=pods --user=alice -n development

Answer

oc adm policy add-cluster-role-to-user cluster-admin alice

Answer

oc create clusterrolebinding alice-view --clusterrole=view --user=alice

Question 10

Which THREE of the following components are involved in authenticating a user via an external OAuth identity provider in OpenShift? (Choose THREE)

Accepted Answer

OpenShift OAuth Server. OAuth authentication involves the client/browser, the OpenShift OAuth server, and the external identity provider (such as HTPasswd or OIDC).

Answer

Kubelet node agent

Answer

Cluster Storage Operator

Question 11

A cluster administrator has created a new ProjectRequest template to ensure that every newly created project automatically includes a predefined LimitRange. Where must this template be configured so that it applies cluster-wide to all new projects?

Accepted Answer

In the cluster resource project.config.openshift.io/cluster under the projectRequestTemplate field. The project request template must be referenced in the cluster-wide Project configuration object located at the cluster resource named 'project.config.openshift.io/cluster'.

Answer

In the namespace openshift-config as a ConfigMap named project-request

Answer

In the kube-system namespace as a Secret named default-project-template

Answer

As an annotation on the default ProjectTemplate object in the openshift namespace

Question 12

An administrator is troubleshooting a service account named 'cicd-bot' in the 'ci-cd' namespace that is failing to read pods in the 'production' namespace, despite a RoleBinding existing. Upon inspection, the RoleBinding references a Role (not a ClusterRole) in the 'ci-cd' namespace. Why is the service account failing to access resources in 'production'?

Accepted Answer

Standard Roles are namespace-scoped and cannot grant permissions to resources in another namespace. A standard Role and RoleBinding are strictly namespace-scoped. A Role in namespace A cannot grant permissions to resources in namespace B. To grant cross-namespace access, a ClusterRole must be used with either a RoleBinding (in the target namespace) or a ClusterRoleBinding.

Answer

Roles cannot reference service accounts as subjects unless they are in the openshift-infra namespace

Answer

Service accounts cannot use RoleBindings, they require ClusterRoleBindings for any authorization

Answer

The service account token has expired and must be manually regenerated using oc adm ca

Question 13

An administrator wants to prevent developers from accidentally deploying containers that request excessive CPU resources in the 'analytics' namespace. Which object should the administrator create in that namespace?

Accepted Answer

LimitRange. A LimitRange object restricts resource consumption (requests and limits) down to a per-pod or per-container basis within a specific namespace.

Answer

ResourceQuota

Answer

ClusterRoleBinding

Answer

SecurityContextConstraints

Question 14

An administrator needs to view which users currently possess the 'cluster-admin' cluster role across the OpenShift cluster. Which command is most efficient for displaying this information?

Accepted Answer

oc describe clusterrolebinding cluster-admin. The 'oc adm policy who-can' command or inspecting the ClusterRoleBinding for cluster-admin reveals which users and service accounts hold the role.

Answer

oc auth can-i --list --all-namespaces

Answer

oc get clusterroles cluster-admin -o jsonpath='{.subjects}'

Answer

oc get users --selector=role=cluster-admin

Question 15

A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?

Accepted Answer

bob lacks the 'self-provisioner' cluster role, which can be granted via cluster-admin binding. In OpenShift, self-provisioning of projects is controlled by a ClusterRoleBinding that binds the 'self-provisioner' ClusterRole to the 'system:authenticated:oauth' group. If this is removed or restricted, users cannot create projects.

Answer

bob needs an explicit RoleBinding for the 'admin' role in the default namespace

Answer

bob's user object is missing the 'project-creator' annotation

Answer

bob must be added to the cluster-admin group in the oauth configuration