Security And SCC

An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?

An administrator needs to configure a new project so that pods deployed within it run with the restricted-v2 Security Context Constraint by default. Which action should the administrator perform?

Which THREE commands are used to manage service account secrets?

An administrator needs to secure a Route using a custom wildcard certificate. The certificate and private key are stored in a TLS Secret named wildcard-tls-secret in the same namespace as the Route. Which section of the Route manifest should reference this Secret?

A pod fails to start in a restricted namespace because it attempts to bind to a privileged host port (port 80). The administrator wants to create a custom SCC that permits binding to privileged ports only for this specific application workload, without granting full root privileges. Which custom SCC configuration field should be explicitly set?

An administrator is troubleshooting an Ingress routing issue where external clients receive a 503 error when trying to access a secure application through a Route configured with passthrough TLS termination. What is the most likely cause of this issue?

An administrator is troubleshooting an OAuth authentication failure where users receive an error indicating invalid credentials against an HTPasswd provider. Which TWO steps or checks are critical for resolving this issue? (Choose TWO)

An administrator creates a new custom Security Context Constraint (SCC) named restrict-root. After creating the SCC resource, users complain that pods using a ServiceAccount tied to this SCC are still falling back to the restricted-v2 SCC. What is the most likely cause?

Which TWO methods can an administrator use to inspect or troubleshoot Security Context Constraint (SCC) assignments for a specific ServiceAccount in a namespace?

An administrator needs to view the current list of active Security Context Constraints installed in an OpenShift cluster. Which command should be executed?

An administrator is configuring an OAuth identity provider and needs to map claims from an external provider to OpenShift usernames. Which field in the OAuth configuration specifies the claim to use as the username?

An administrator wants to prevent developers from creating pods that run as the root user across the entire cluster. Which OpenShift resource or admission mechanism is best suited to enforce this restriction globally?

You need to update the CA certificate used for the web console. Where is this configured?

An administrator is configuring authentication in OpenShift. Which TWO of the following identity provider types are natively supported by the OpenShift OAuth server? (Choose TWO)

You are integrating an external LDAP identity provider. Which secret must be created to store the bind password for the LDAP server?

Which THREE fields are critical for controlling pod volume access in an SCC?

An administrator is managing service accounts and wants to understand how tokens work in OpenShift 4.14+. Which TWO statements are correct regarding ServiceAccount tokens in this version? (Choose TWO)

An administrator is auditing Security Context Constraints and wants to identify which settings can be controlled within a custom SCC definition. Which THREE fields are valid configuration options inside an SCC resource? (Choose THREE)

Which TWO authentication methods are supported by the OpenShift OAuth server?

A pod requires access to the hostPath volume. Which SCC field must be configured to allow this?

You want to ensure that all pods in a namespace are denied access to the host network. Which policy mechanism is most effective for this?

What happens if a pod does not match any SCC?

An administrator needs to troubleshoot an image pull failure caused by missing credentials. Which TWO locations or methods can be used to associate an image pull secret with a workload in OpenShift? (Choose TWO)

Which TWO of the following are valid ways to secure a route?

A developer deploys an application using a Route that terminates TLS using the Edge termination strategy. The developer wants to ensure that all insecure HTTP traffic to the route is automatically redirected to HTTPS. Where must this setting be configured?

Which THREE parameters are commonly found in the SCC 'spec' section?

When configuring an OAuth identity provider of type HTPasswd, which object type must be created to store the username and hashed password pairs?

Which TWO service accounts have special roles in OpenShift projects regarding SCCs?

Which tool should be used to troubleshoot why an SCC is being rejected for a pod?

You need to allow a specific service account to run pods as root. Which command should you use to associate the 'privileged' SCC with the 'default' service account in the 'web-apps' namespace?

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

Which THREE restrictions or behaviors are enforced by the default restricted-v2 Security Context Constraint in OpenShift Container Platform?

An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?

Which TWO actions are necessary when migrating from Htpasswd to OIDC?

Which command displays the SCCs currently assigned to a specific service account?

A container needs to run as a specific non-root UID. Which SCC field configuration is needed?

You are configuring an OAuth identity provider using 'htpasswd'. Which secret must contain the file?

A security engineer needs to configure the cluster-wide OAuth identity provider to use an existing LDAP server. The administrator creates an LDAP identity provider object in the cluster OAuth configuration resource (cluster). Which configuration property specifies the attribute mapping to map the LDAP entry's unique identifier to the OpenShift user name?

You are hardening a cluster. Which Pod Security Standard level is the default in OpenShift 4.14 for new projects?

Which service account is used by default for pods that do not specify a service account in their manifest?

You are troubleshooting a TLS certificate issue on a route. Which command shows the current certificate status and details?

How do you view the currently active OAuth identity providers in an OpenShift cluster?

Which THREE components are involved in TLS termination for routes?

How can you view the list of all SCCs available in the cluster?

Which THREE of the following are required when configuring an OIDC identity provider?

Where do you define the default image pull secrets for all service accounts in a namespace?

An administrator needs to configure re-encrypt TLS termination on a Route. In addition to the router certificate, what other certificate component must typically be provided in the route configuration?

Which command checks if a specific service account can use a restricted SCC?

A developer needs to expose a service via a route with re-encryption. What is required in the Route configuration?

When creating a custom SCC, what is the best practice for assigning it to users?

An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?

You have a private image registry that requires credentials. Where should you place the 'imagePullSecret' so that it is automatically injected into all pods created by a specific service account?

An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?

An administrator is securing routes in an OpenShift cluster. Which THREE TLS termination types are supported natively by OpenShift Routes? (Choose THREE)

An administrator needs to ensure that a newly created ServiceAccount automatically receives a long-lived API token when created in OpenShift 4.14+. What is the correct procedure?

When using OIDC for authentication, what does the 'issuer' field in the configuration represent?

A pod fails to start with 'container has runAsNonRoot and image will run as root'. Which SCC field needs to be adjusted in a custom SCC to allow this image to run?

An administrator needs to restrict pod creation based on Pod Security Standards namespaces. Which TWO of the following are valid Pod Security Standard levels defined by Kubernetes and supported in OpenShift? (Choose TWO)

An application pod needs to run with a specific user ID (UID 10005000) that falls outside the restricted-v2 SCC default allocated range for the namespace. The administrator decides to create a custom SCC. Which SCC security context strategy parameter must be adjusted to allow this specific UID?

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

Which TWO security standards are natively tracked in OpenShift?

Which SCC is assigned by default to authenticated users who are not service accounts?

An administrator is reviewing the default Security Context Constraints in OpenShift 4.14+. Which THREE of the following SCCs are built-in and provided out-of-the-box by OpenShift? (Choose THREE)

Which TWO actions are required when configuring an external OpenID Connect (OIDC) identity provider in OpenShift Container Platform?

A developer deploys a custom application pod that requires the hostIPC capability, but the pod creation is rejected by the apiserver. Upon inspecting the cluster SCCs, the administrator determines that the application uses a ServiceAccount named app-sa in the production namespace. How should the administrator grant the restricted SCC privileges safely without compromising cluster security?

Which command removes an SCC from a service account?

A cluster administrator needs to grant a Deployment in the production namespace permission to pull images from a private container registry. The image pull secret is named my-registry-secret. Which step must be performed so that pods created by this Deployment can successfully pull the image?

You need to terminate TLS for a route using a custom certificate. Which object must contain the TLS key and certificate?

A cluster administrator wishes to enforce the restricted Pod Security Standard across an entire namespace named auditing-ns. Which label should the administrator apply to the namespace to enforce this policy while generating audit warnings for non-compliant pods?

Which TWO things must be configured to use a Private Image Registry?