EX280 User And RBAC Management — Timed 30 Questions

Question 1

An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?

30 minute time limit — choose an answer to begin.

Accepted Answer

oc describe user alex@example.com. The 'oc describe user <username>' command shows the user object's details, including the list of groups the user belongs to, as synced from the identity provider. This is the correct administrative command to inspect group membership for a specific user.

Answer

oc auth can-i --list --user=alex@example.com

Answer

oc get groups --user=alex@example.com

Answer

oc get identity alex@example.com

Question 2

You need to create a new project named 'secure-store' with a specified display name and description, and assign 'jane' as the project admin using the OpenShift CLI. Which command should you execute?

Accepted Answer

oc new-project secure-store --display-name='Secure Store' --description='Secure storage project'. The `oc new-project` command creates a new project and allows specifying a display name and description via flags. It also automatically switches the current context to the new project. This is the standard CLI method for creating a project with metadata in OpenShift.

Answer

oc create projectsecure secure-store --user=jane

Answer

oc create namespace secure-store --admin=jane

Answer

oc adm project secure-store --set-admin=jane

Question 3

A new user named 'sarah' requires read-only access to all resources within the 'web-frontend' project. Which CLI command creates the appropriate RoleBinding?

Accepted Answer

oc create rolebinding sarah-view --clusterrole=view --user=sarah -n web-frontend. The 'oc adm policy add-role-to-user' command is the standard helper tool to quickly bind roles to users within a project.

Answer

oc set role view sarah -n web-frontend

Answer

oc add-user sarah --role=view -n web-frontend

Question 4

An administrator needs to prevent developers from consuming more than 10 CPU cores and 40Gi of memory collectively across all pods running in the 'production' namespace. Which object satisfies this requirement?

Accepted Answer

ResourceQuota. A ResourceQuota is a namespace-scoped object that enforces aggregate resource consumption limits across all pods in a namespace. By setting hard limits on requests.cpu and requests.memory (or limits.cpu and limits.memory), it prevents the total consumption from exceeding 10 CPU cores and 40Gi of memory collectively. This directly satisfies the requirement to cap collective usage in the 'production' namespace.

Answer

ClusterResourceQuota

Answer

PodDisruptionBudget

Answer

LimitRange

Question 5

Which OpenShift default role allows a user to see the resources in a project but explicitly prevents them from viewing build configurations, build logs, and secrets?

Accepted Answer

basic-user. The 'view' role allows viewing most resources, but OpenShift also includes restricted views or specialized roles. Wait, let's check standard roles: 'view' allows viewing almost everything except some sensitive resources like secrets. However, the 'basic-user' role is often used for self-provisioners. Let's look at the 'view' role vs 'basic-user'.

Answer

cluster-admin

Answer

view

Answer

edit

Question 6

An organization requires that specific projects created by developers automatically receive a default ResourceQuota and LimitRange. How can an administrator achieve this in OpenShift?

Accepted Answer

Define a template in the 'openshift-config' namespace and reference it in the Cluster operator configuration for project requests.. OpenShift uses a project request template stored in the `openshift-config` namespace to define default resources applied to newly created projects. Administrators can edit this template to include ResourceQuota and LimitRange objects, and the Cluster operator configuration references it for project requests. This ensures every developer-created project automatically inherits the specified quotas and limits.

Answer

Configure the cluster-admin settings in the 'cluster' resource config map.

Answer

Write an admission controller webhook daemonset to inject them.

Answer

Use a ClusterRoleBinding with auto-provisioning flags.

Question 7

You need to configure a ClusterRole that permits reading metrics endpoints across all namespaces but nothing else. Which API groups and resources must be specified in the rules block?

Accepted Answer

apiGroups: [''], resources: ['endpoints'], verbs: ['get', 'list', 'watch']. To read metrics endpoints across all namespaces, the ClusterRole must grant access to the 'endpoints' resource in the core API group (empty string), because metrics endpoints are exposed via Endpoints objects. The verbs 'get', 'list', and 'watch' are required to read and monitor those endpoints. This is the minimal rule set that permits reading metrics endpoints without granting broader access.

Answer

apiGroups: [''], resources: ['pods', 'services'], verbs: ['get', 'list']

Answer

apiGroups: ['apps'], resources: ['deployments'], verbs: ['get']

Answer

apiGroups: ['metrics.k8s.io'], resources: ['nodes'], verbs: ['get']

Question 8

A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?

Accepted Answer

Add 'system:serviceaccount:app-ns:app-sa' to the 'users' list inside the 'restricted-custom' SCC object.. SCCs are associated with subjects through the `users`, `groups`, and `serviceAccounts` fields inside the SCC object itself, or via RBAC by granting the `use` verb on the SCC resource. Adding the fully-qualified ServiceAccount name `system:serviceaccount:app-ns:app-sa` to the SCC's `users` list directly authorizes that SA to use the SCC. This is the explicit, object-level association the question asks for.

Answer

Create a RoleBinding in 'app-ns' linking 'app-sa' to a ClusterRole that permits 'use' on the 'restricted-custom' SCC.

Answer

Add an annotation to the 'app-sa' ServiceAccount object referencing the SCC name.

Answer

Create a ProjectRequest template that injects the SCC into the namespace.

Question 9

Which command is used to list all users who currently have the 'cluster-admin' role assigned via ClusterRoleBindings?

Accepted Answer

oc get clusterrolebindings cluster-admin -o jsonpath='{.subjects}'. The command 'oc get clusterrolebindings cluster-admin -o jsonpath='{.subjects}'' retrieves the subjects (users, groups, service accounts) associated with the cluster-admin ClusterRoleBinding, effectively listing all users who have the cluster-admin role via that binding.

Answer

oc get users --role=cluster-admin

Answer

oc adm who-is cluster-admin

Answer

oc describe clusterrole cluster-admin

Question 10

Which command displays all projects that the currently logged-in user has permission to access?

Accepted Answer

oc projects. The 'oc projects' command lists all projects that the currently logged-in user has permission to access. It queries the OpenShift API for projects visible to the user and displays them, allowing quick switching between projects. This is a standard command for developers and administrators to see their available namespaces.

Answer

oc list accessible-namespaces

Answer

oc auth list-projects

Answer

oc get projects

Question 11

Which command creates a new user identity mapping using the HTPasswd provider if configured, or views user details? Let's focus on user management: Which command lists all registered user objects in the OpenShift cluster?

Accepted Answer

oc get users. In OpenShift, user objects are cluster-scoped resources representing authenticated identities, and they are listed with 'oc get users'. Each user object maps to one or more identity objects (from providers like HTPasswd, LDAP, or OIDC), but the user resource itself is what 'oc get users' returns. This is the canonical command for auditing who has authenticated to the cluster.

Answer

oc get identities

Answer

oc get accounts

Answer

oc get subjects

Question 12

You need to configure a ServiceAccount named 'app-runner' in the 'finance' namespace so that its authentication token does not automatically expire or get automatically generated as a short-lived token (in OCP 4.16+, tokens are bound to service account token volume projection). If you need to create a long-lived API token secret for this ServiceAccount manually, how should you do it?

Accepted Answer

oc create token app-runner -n finance --duration=8760h. In OpenShift 4.16+, service account tokens are no longer auto-generated as long-lived secrets; instead, bound tokens are projected into pods with a default expiry. To create a long-lived API token manually, the supported method is `oc create token -n --duration=`, which requests a token with the specified duration (e.g., 8760h for one year). This command uses the TokenRequest API to issue a token that remains valid for the requested period, bypassing the default short-lived projection.

Answer

Edit the service account YAML to set 'automountServiceAccountToken: true'.

Answer

oc create secret generic my-token --type=kubernetes.io/service-account-token -n finance

Answer

oc adm create-token app-runner --permanent

Question 13

An administrator is troubleshooting a multi-tenant environment where a project administrator of the 'team-a' namespace attempts to bind the cluster-admin ClusterRole to a user in their namespace using a RoleBinding. What is the expected outcome of this operation?

Accepted Answer

The operation succeeds, and the user receives admin privileges restricted solely to the 'team-a' namespace.. A RoleBinding can reference a ClusterRole, and when it does, the permissions defined in that ClusterRole are granted only within the namespace where the RoleBinding exists. Therefore, binding the cluster-admin ClusterRole via a RoleBinding in the 'team-a' namespace gives the user admin privileges solely in 'team-a', not cluster-wide. This is a standard Kubernetes RBAC pattern that allows namespace-scoped reuse of ClusterRoles.

Answer

The API server rejects the request because RoleBindings cannot reference ClusterRoles.

Answer

The operation succeeds, but the authorization webhook automatically strips dangerous privileges like secret reading.

Answer

The operation succeeds, and the user receives cluster-admin privileges across the entire cluster.

Question 14

You need to inspect the resource quota consumption and current usage status for a project named 'analytics'. Which command should you run?

Accepted Answer

oc get quota -n analytics. `oc get quota -n analytics` lists the ResourceQuota objects in the namespace along with their current usage, because the ResourceQuota status subresource exposes `used` and `hard` fields that `oc get` renders in the USED column. This is the canonical, low-friction way to check quota consumption for a project. It requires no special subcommand and works with the standard OpenShift CLI.

Answer

oc describe project analytics --quotas

Answer

oc adm top quota -n analytics

Answer

oc status quota -n analytics

Question 15

Which built-in OpenShift role provides permissions to view all resources within a project but cannot see secrets or bindings? Wait, let's test: Which default role allows modifying resources in a project while excluding permission to modify RBAC roles and role bindings?

Accepted Answer

edit. The 'edit' ClusterRole grants read/write access to most resources in a project — including creating and modifying workloads, services, and configmaps — but deliberately excludes the ability to modify Roles, RoleBindings, or the project's own resource. This makes it the correct answer for 'modify resources but not RBAC.'

Answer

view

Answer

cluster-admin

Answer

admin

Question 16

You are troubleshooting project requests. A developer runs 'oc new-project test-proj' and receives an error that project requests are disabled or forbidden. Where is the global project request template or configuration managed?

Accepted Answer

In the cluster-scoped 'project.config.openshift.io/cluster' resource. The global project request configuration in OpenShift is managed through the cluster-scoped custom resource 'project.config.openshift.io/cluster'. This resource controls the project request template and other project-related settings. When a developer runs 'oc new-project', the cluster uses this configuration to determine whether project requests are enabled and how they are processed. Modifying or inspecting this resource is the correct way to troubleshoot errors about disabled project requests.

Answer

In the 'kube-system' namespace as a Secret

Answer

In the 'openshift-config' namespace as a ConfigMap named 'project-request'

Answer

In the OAuth configuration file on master nodes

Question 17

Which command displays the current user identity and cluster context information for the logged-in OpenShift CLI session?

Accepted Answer

oc whoami. The `oc whoami` command is the correct answer because it displays the current user identity for the logged-in OpenShift CLI session. It returns the username that the CLI is authenticated as, which is essential for verifying permissions and troubleshooting access issues. This command is a direct counterpart to the `whoami` command in Linux, adapted for OpenShift's authentication context.

Answer

oc current-user

Answer

oc get identity --current

Answer

oc auth status

Question 18

An administrator configures an external OIDC identity provider. Users can authenticate, but upon login, OpenShift reports that the user has no permissions because group synchronization fails. Where are OIDC group claims mapped in the OAuth configuration?

Accepted Answer

In the 'claims.groups' section of the OIDC identity provider CR. In OpenShift, when configuring an OIDC identity provider, the group claims are mapped in the 'claims.groups' field of the OIDC identity provider CR. This tells OpenShift which claim in the OIDC ID token contains the user's group memberships, enabling group synchronization.

Answer

In the cluster RoleBinding configuration file

Answer

In a separate GroupSync CR managed by the LDAP operator

Answer

Inside the kube-apiserver static pod manifest

Question 19

An administrator notices that a namespace has exceeded its object count quota for ConfigMaps. When a developer attempts to create a new ConfigMap, what error response is returned by the API server?

Accepted Answer

HTTP 403 Forbidden with a message stating the resource quota has been exceeded. When a namespace exceeds its object count quota for ConfigMaps, the API server rejects the create request with HTTP 403 Forbidden and a message indicating the resource quota has been exceeded. ResourceQuota admission control enforces this at admission time, so the object is never persisted. The error is a quota violation, not an authentication or timeout issue.

Answer

HTTP 401 Unauthorized forcing the user to re-authenticate

Answer

HTTP 200 OK, but the ConfigMap is placed in a pending state until quota frees up

Answer

HTTP 504 Gateway Timeout because the controller manager is blocked

Question 20

An administrator configures a LimitRange with a max CPU limit of 2 cores and max memory limit of 4Gi. A developer submits a pod specification where a container requests 3 cores of CPU. How does the OpenShift API server handle this request during admission?

Accepted Answer

The API server rejects the pod creation because the container's CPU request violates the LimitRange maximum constraint.. LimitRange constraints are enforced by the LimitRanger admission controller during pod creation. When a container's CPU request exceeds the LimitRange's max CPU limit, the admission controller rejects the pod immediately with a validation error, and the pod is never persisted to etcd. The API server does not silently cap or throttle the value — it refuses the request outright.

Answer

The API server throttles the container CPU usage at runtime to 2 cores automatically.

Answer

The pod enters a CrashLoopBackOff state while waiting for resource allocation.

Answer

The API server accepts the pod and caps the container spec value to 2 cores.