20+ practice questions focused on Security And SCC — one of the most tested topics on the Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) (EX280) exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security And SCC PracticeAn administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?
Explanation: Setting runAsUser.type to MustRunAs with uid: 1000 in the uidRange forces the container to run as UID 1000, matching the ownership of the target directory. MustRunAs requires the pod to specify a runAsUser that falls within the configured range, ensuring consistent UID assignment. RunAsAny would allow any UID, which does not guarantee UID 1000 and could still cause permission failures.
A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?
Explanation: The allowHostPorts field in a Security Context Constraint controls whether pods can bind to privileged ports (below 1024) on the host. Setting allowHostPorts: true permits the workload to bind to port 80 without granting root-level privileges or privileged container access. This is the minimal, targeted permission that satisfies the requirement while keeping the SCC otherwise restrictive.
An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?
Explanation: The label pod-security.kubernetes.io/enforce: restricted is the correct namespace label to enforce the restricted Pod Security Standard. When applied, the Pod Security Admission controller blocks any pod that violates the restricted policy. To also log violations, you would add pod-security.kubernetes.io/audit: restricted and pod-security.kubernetes.io/warn: restricted, but the enforce label is the one that actively prevents non-compliant pods from being created. This label is part of the upstream Kubernetes Pod Security Admission (PSA) feature, which OpenShift 4.11+ uses alongside Security Context Constraints (SCCs).
An administrator needs to configure a new project so that pods deployed within it run with the restricted-v2 Security Context Constraint by default. Which action should the administrator perform?
Explanation: OpenShift determines which SCC applies to a pod by first checking the namespace annotation security.openshift.io/scc. When set, the SCC admission plugin restricts pods in that namespace to the named SCC (restricted-v2), overriding the default assignment logic. This is the supported, non-destructive way to pin a namespace to a specific SCC without altering cluster-wide defaults.
A developer deploys a custom application pod that requires the hostIPC capability, but the pod creation is rejected by the apiserver. Upon inspecting the cluster SCCs, the administrator determines that the application uses a ServiceAccount named app-sa in the production namespace. How should the administrator grant the restricted SCC privileges safely without compromising cluster security?
Explanation: The correct approach is to create a RoleBinding in the production namespace that references the system:openshift:scc:hostaccess ClusterRole and the app-sa ServiceAccount. This grants the ServiceAccount permission to use the hostaccess SCC, which allows hostIPC. The hostaccess SCC is a predefined ClusterRole that provides access to the hostaccess SCC, and binding it via RoleBinding ensures the grant is namespace-scoped and follows least privilege. This method is the standard OpenShift way to grant SCC access to a ServiceAccount without modifying the SCC itself.
+15 more Security And SCC questions available
Practice all Security And SCC questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security And SCC. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security And SCC questions on the EX280 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security And SCC is tested as part of the Red Hat Certified OpenShift Administrator (EX280, OpenShift Container Platform 4.14+) (EX280) blueprint. Practicing with targeted Security And SCC questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free EX280 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security And SCC is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security And SCC practice session with instant scoring and detailed explanations.
Start Security And SCC Practice →