EX280 User And RBAC Management Practice Test 6 — 15 Questions

Question 1

Which TWO of the following conditions must be met for a ServiceAccount from 'namespace-a' to successfully access API resources in 'namespace-b'? (Choose TWO)

Accepted Answer

A RoleBinding must exist in 'namespace-b' referencing the ServiceAccount as 'system:serviceaccount:namespace-a:sa-name'.. Option C is correct because Kubernetes RBAC bindings are namespaced: to grant a ServiceAccount from namespace-a permissions in namespace-b, a RoleBinding must be created in namespace-b that references the subject as 'system:serviceaccount:namespace-a:sa-name'. Option E is correct because the RoleBinding only associates the subject with permissions; the actual API verb permissions (get, list, watch, create, etc.) on the target resources must be defined in a Role (namespaced) or ClusterRole that the binding references. Option A is incorrect because LimitRange objects only enforce resource quota defaults/limits on pods and containers and have no bearing on RBAC authorization. Option B is incorrect because Kubernetes RBAC has no 'administrative override annotation' mechanism for namespaces; access is governed solely by Roles/ClusterRoles and their bindings. Option D is incorrect because cluster-admin is not required and would be excessive; a namespaced Role plus RoleBinding in namespace-b is sufficient and follows least privilege.

Answer

The source namespace must disable its LimitRange objects.

Answer

An administrative override annotation must be placed on the target namespace.

Answer

The ServiceAccount must be granted cluster-admin rights cluster-wide.

Question 2

A cluster administrator has created a new ProjectRequest template to ensure that every newly created project automatically includes a predefined LimitRange. Where must this template be configured so that it applies cluster-wide to all new projects?

Accepted Answer

In the cluster resource project.config.openshift.io/cluster under the projectRequestTemplate field. The cluster-wide ProjectRequest template is configured by editing the project.config.openshift.io/cluster resource and setting the projectRequestTemplate field to reference a template in the openshift-config namespace. This is the documented, supported mechanism for customizing what every new project receives.

Answer

In the namespace openshift-config as a ConfigMap named project-request

Answer

In the kube-system namespace as a Secret named default-project-template

Answer

As an annotation on the default ProjectTemplate object in the openshift namespace

Question 3

An administrator is troubleshooting a service account named 'cicd-bot' in the 'ci-cd' namespace that is failing to read pods in the 'production' namespace, despite a RoleBinding existing. Upon inspection, the RoleBinding references a Role (not a ClusterRole) in the 'ci-cd' namespace. Why is the service account failing to access resources in 'production'?

Accepted Answer

Standard Roles are namespace-scoped and cannot grant permissions to resources in another namespace. Roles in OpenShift are namespace-scoped and can only grant permissions to resources within their own namespace. A RoleBinding in the 'ci-cd' namespace referencing a Role in the same namespace cannot grant access to resources in the 'production' namespace. To grant cross-namespace access, a ClusterRole and ClusterRoleBinding (or RoleBinding referencing a ClusterRole) are required.

Answer

Roles cannot reference service accounts as subjects unless they are in the openshift-infra namespace

Answer

Service accounts cannot use RoleBindings, they require ClusterRoleBindings for any authorization

Answer

The service account token has expired and must be manually regenerated using oc adm ca

Question 4

An administrator wants to prevent developers from accidentally deploying containers that request excessive CPU resources in the 'analytics' namespace. Which object should the administrator create in that namespace?

Accepted Answer

LimitRange. A LimitRange constrains per-pod or per-container resource requests and limits within a namespace, which is exactly what prevents a developer from submitting a pod that requests excessive CPU. It can set default, min, and max values for CPU/memory per container or pod, and the API server rejects any pod spec that violates those bounds. This is the correct object for per-object resource guardrails.

Answer

ResourceQuota

Answer

ClusterRoleBinding

Answer

SecurityContextConstraints

Question 5

A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?

Accepted Answer

bob lacks the 'self-provisioner' cluster role, which can be granted via cluster-admin binding. In OpenShift, the ability for authenticated users to create their own projects is controlled by the 'self-provisioner' ClusterRole, bound via the 'self-provisioners' ClusterRoleBinding to the 'system:authenticated' group by default. If an administrator removes or restricts this binding, users like bob lose the ability to run 'oc new-project' even though they can still view existing projects.

Answer

bob needs an explicit RoleBinding for the 'admin' role in the default namespace

Answer

bob's user object is missing the 'project-creator' annotation

Answer

bob must be added to the cluster-admin group in the oauth configuration

Question 6

An administrator is configuring a ResourceQuota named 'quota-dev' in the 'development' namespace. Which TWO of the following resource types can be directly tracked and limited by this ResourceQuota? (Choose TWO)

Accepted Answer

persistentvolumeclaims. Option A (persistentvolumeclaims) is correct because Kubernetes ResourceQuota objects support the persistentvolumeclaims field, which limits the number of PVCs that can exist in the namespace, as well as requests.storage to cap total storage requested. Option C (pods) is correct because ResourceQuota natively supports the pods field, allowing the administrator to limit the total number of Pods created in the 'development' namespace. Options B (clusterroles), D (namespaces), and E (nodes) are incorrect because they are cluster-scoped resources, not namespaced resources; ResourceQuota only applies to namespaced objects within the namespace where the quota is defined, so it cannot track or limit ClusterRoles, Namespaces, or Nodes.

Answer

clusterroles

Answer

namespaces

Answer

nodes

Question 7

An administrator needs to provision a new user named 'sarah' using the HTPasswd identity provider. After updating the htpasswd file and secret, Sarah logs in successfully. What command should the administrator run to verify that OpenShift has successfully created the corresponding User object for Sarah?

Accepted Answer

oc get user sarah. When an HTPasswd identity provider authenticates a user for the first time, OpenShift automatically creates a User object whose name matches the username supplied in the htpasswd file. The correct command to confirm this is `oc get user sarah`, which queries the cluster-scoped User resource. This verifies that the identity provider successfully mapped the login to a User object.

Answer

oc get account sarah

Answer

oc get identity htp:sarah

Answer

oc describe htpasswd-user sarah

Question 8

An administrator needs to restrict a user group named 'contractors' so they can view pods and services, but cannot view secrets across the 'staging' namespace. Which THREE of the following steps or configurations are valid and necessary to achieve this? (Choose THREE)

Accepted Answer

Create a custom Role in the staging namespace that explicitly includes rules for verbs get, list, watch on resources pods and services. Option B is correct because a namespaced Role must explicitly grant the desired permissions, and listing resources pods and services with verbs get, list, watch provides exactly the read-only access required in the staging namespace. Option C is correct because a RoleBinding in the staging namespace binds that Role to the contractors group, scoping the permissions to only that namespace. Option E is correct because RBAC is additive and deny-by-default, so simply not including secrets in the Role's resources list ensures the group cannot view secrets. Option A is incorrect because ClusterRoleBinding grants cluster-wide permissions and RBAC has no exclusion filter mechanism. Option D is incorrect because there is no negative weight annotation concept in Kubernetes RBAC, and cluster-admin would grant full access.

Answer

Create a ClusterRoleBinding referencing the view ClusterRole and set an exclusion filter for secrets

Answer

Assign the cluster-admin ClusterRole to the contractors group with a negative weight annotation

Question 9

When setting up authentication and user provisioning in OpenShift 4, which THREE identity providers are natively supported out-of-the-box by the OAuth server configuration? (Choose THREE)

Accepted Answer

OpenID Connect (OIDC). OpenShift 4's OAuth server natively supports several identity providers configured through the OAuth custom resource, and OpenID Connect (OIDC) (A) is one of them, allowing integration with any OIDC-compliant provider such as Keycloak or Okta via the oidc identity provider type. HTPasswd (C) is also natively supported, using a secret containing an htpasswd-formatted file (created with htpasswd -c -B -b) to authenticate users against a static user list. LDAP (E) is natively supported as well, with the ldap identity provider type supporting direct binds, search-and-bind, and URL-based configurations against directory servers. The unmarked options do not belong because there is no 'Local Linux /etc/passwd direct sync daemon' identity provider (B) in OpenShift, and there is no 'Active Directory Domain Services native kernel module' identity provider (D); AD is integrated indirectly via LDAP or OIDC, not through a kernel module.

Answer

Local Linux /etc/passwd direct sync daemon

Answer

Active Directory Domain Services native kernel module

Question 10

An OpenShift administrator must give the user 'dana' permission to list and watch pods and services across every project in the cluster, but nothing else. The administrator decides to create a new ClusterRole named 'ns-reader' containing only those rules and bind it to dana. Which command correctly creates this ClusterRole?

Accepted Answer

oc create clusterrole ns-reader --verb=list,watch --resource=pods,services. The task requires a new cluster-scoped ClusterRole with only list and watch on pods and services. The oc create clusterrole subcommand is the direct imperative way to author that object from the CLI, producing a ClusterRole that can later be bound cluster-wide. Creating a namespaced Role, binding the broad view role, or using add-cluster-role-to-user all fail to produce the narrowly scoped ClusterRole described.

Answer

oc adm policy add-cluster-role-to-user ns-reader dana --verb=list,watch --resource=pods,services

Answer

oc create role ns-reader --verb=list,watch --resource=pods,services -n default

Answer

oc create clusterrolebinding ns-reader --clusterrole=view --user=dana

Question 11

A platform administrator is auditing RBAC in the 'payments' namespace. They notice that the group 'contractors' can list and get secrets in that namespace, but the administrators never created a RoleBinding or ClusterRoleBinding granting those permissions. Which mechanism most likely granted this access?

Accepted Answer

A ClusterRoleBinding to a default cluster role such as 'view' or 'edit' grants the group access across all namespaces, including 'payments'.. Because ClusterRoleBindings are cluster-scoped, binding a group to an aggregated role such as 'view' or 'edit' gives that group the role's rules in every namespace. Auditing only namespace-scoped RoleBindings will miss this, which is why the group can read secrets in 'payments' without any local binding. Checking cluster-scoped bindings is essential during RBAC audits.

Answer

The ServiceAccount of the kube-controller-manager reconciles missing RoleBindings by copying them from the 'default' namespace.

Answer

A RoleBinding was automatically created by the OpenShift OAuth server when the group first authenticated.

Answer

The 'system:authenticated' group is implicitly bound to 'cluster-admin' in every namespace for convenience.

Question 12

An administrator wants members of the LDAP-backed group 'cn=auditors,ou=groups,dc=corp' to have read-only access to every project in the cluster, including future ones, without granting them any write capability. Which action achieves this?

Accepted Answer

Create a ClusterRoleBinding that binds the group to the 'view' ClusterRole.. A ClusterRoleBinding to the 'view' ClusterRole is the correct mechanism because it applies cluster-wide and automatically covers namespaces created later. It grants only read verbs, satisfying the no-write constraint, and binding a group means all LDAP members inherit the access without per-user configuration.

Answer

Create a ClusterRoleBinding that binds the group to the 'edit' ClusterRole.

Answer

Create a RoleBinding in each namespace that binds the group to the 'view' ClusterRole.

Answer

Create a ClusterRoleBinding that binds the group to the 'cluster-admin' ClusterRole.

Question 13

A user reports that 'oc get pods -n analytics' returns a Forbidden error, but 'oc get pods -n analytics --as=system:admin' succeeds. The administrator confirms the user is a member of the LDAP group 'data-team' and that a ClusterRoleBinding grants 'view' to that group. What should the administrator check first to explain the discrepancy?

Accepted Answer

Whether the identity provider is sending group membership in the OAuth token, since missing group claims would prevent the ClusterRoleBinding from matching.. RBAC matches group subjects using the groups carried in the user's OAuth token. If the LDAP identity provider does not map group membership into group claims, the user is authenticated but lacks the 'data-team' group, so the ClusterRoleBinding never applies. Inspecting the identity provider's group mapping and the token's groups resolves the discrepancy.

Answer

Whether the 'view' ClusterRole has been extended with an aggregationRule that removes get and list from pods.

Answer

Whether the 'analytics' namespace has a ResourceQuota that blocks read operations for non-admin users.

Answer

Whether the user authenticated to OpenShift via the 'kube:admin' identity rather than the LDAP identity provider.

Question 14

An administrator is preparing to grant a ServiceAccount named 'reporter-sa' in the 'monitoring' namespace read-only access to pods and services across all namespaces in the cluster. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Ensure the ServiceAccount subject in the binding specifies the name 'reporter-sa' and the namespace 'monitoring'.. Cluster-wide read access for a ServiceAccount is achieved with a ClusterRoleBinding to the 'view' ClusterRole, with the subject identifying both the ServiceAccount name and its namespace. Together these two actions grant the required permissions across all namespaces while keeping the account read-only and avoiding per-namespace maintenance.

Answer

Assign the 'cluster-admin' ClusterRole to 'reporter-sa' to guarantee visibility into all namespaces.

Answer

Add the 'reporter-sa' ServiceAccount to the 'system:authenticated' group to inherit read access.

Answer

Create a RoleBinding in each namespace that binds the 'view' ClusterRole to 'reporter-sa'.

Question 15

An administrator must allow the ServiceAccount 'report-sa' in the 'metrics' namespace to list nodes cluster-wide, but must not grant any other cluster-level access. Which command accomplishes this?

Accepted Answer

oc create clusterrole node-lister --verb=list --resource=nodes, then oc adm policy add-cluster-role-to-user node-lister -z report-sa -n metrics. Only a custom ClusterRole containing the single list verb on nodes, bound with a ClusterRoleBinding to the service account, satisfies the constraint. Built-in read-oriented roles like 'cluster-reader' are too broad, and no default node-lister role exists. The 'oc adm policy add-cluster-role-to-user' command with the '-z' flag correctly targets the service account.

Answer

oc adm policy add-cluster-role-to-user cluster-reader -z report-sa -n metrics

Answer

oc adm policy add-cluster-role-to-user node-viewer -z report-sa -n metrics

Answer

oc adm policy add-cluster-role-to-user system:node-reader -z report-sa -n metrics