Security And SCC

An administrator is troubleshooting an OAuth authentication failure where users receive an error indicating invalid credentials against an HTPasswd provider. Which TWO steps or checks are critical for resolving this issue? (Choose TWO)

An administrator creates a new custom Security Context Constraint (SCC) named restrict-root. After creating the SCC resource, users complain that pods using a ServiceAccount tied to this SCC are still falling back to the restricted-v2 SCC. What is the most likely cause?

Which TWO methods can an administrator use to inspect or troubleshoot Security Context Constraint (SCC) assignments for a specific ServiceAccount in a namespace?

An administrator needs to view the current list of active Security Context Constraints installed in an OpenShift cluster. Which command should be executed?

An administrator is configuring authentication in OpenShift. Which TWO of the following identity provider types are natively supported by the OpenShift OAuth server? (Choose TWO)

You are integrating an external LDAP identity provider. Which secret must be created to store the bind password for the LDAP server?

An administrator is managing service accounts and wants to understand how tokens work in OpenShift 4.14+. Which TWO statements are correct regarding ServiceAccount tokens in this version? (Choose TWO)

An administrator is auditing Security Context Constraints and wants to identify which settings can be controlled within a custom SCC definition. Which THREE fields are valid configuration options inside an SCC resource? (Choose THREE)

Which TWO authentication methods are supported by the OpenShift OAuth server?

A security team requires that a specific ServiceAccount `app-sa` in project `prod` be allowed to run pods that use the `hostNetwork` namespace, while all other ServiceAccounts in `prod` must remain restricted. The administrator creates a new SCC `hostnet-scc` with `allowHostNetwork: true` and binds it only to `app-sa`. A developer then creates a pod using the `default` ServiceAccount with `hostNetwork: true` in its manifest. What is the result?

What happens if a pod does not match any SCC?

An administrator needs to troubleshoot an image pull failure caused by missing credentials. Which TWO locations or methods can be used to associate an image pull secret with a workload in OpenShift? (Choose TWO)

Which TWO of the following are valid ways to secure a route?

A developer deploys an application using a Route that terminates TLS using the Edge termination strategy. The developer wants to ensure that all insecure HTTP traffic to the route is automatically redirected to HTTPS. Where must this setting be configured?

Which THREE parameters are commonly found in the SCC 'spec' section?

When configuring an OAuth identity provider of type HTPasswd, which object type must be created to store the username and hashed password pairs?

An administrator is reviewing why a pod in the `legacy` namespace runs as UID 1000070000 even though the pod manifest does not specify a `runAsUser`. The namespace annotation `openshift.io/sa.scc.uid-range` is `1000070000/10000`. Which SCC behavior explains the observed UID?

Which tool should be used to troubleshoot why an SCC is being rejected for a pod?

An administrator is preparing a custom Security Context Constraint (SCC) that will be granted to a specific ServiceAccount used by a log-forwarding DaemonSet. The DaemonSet pods must be able to mount a hostPath volume at /var/log but must not run as UID 0 and must not use the host network. Which SCC field combination must the administrator set to allow only the hostPath mount while still blocking privileged escalation and host networking?

You need to allow a specific service account to run pods as root. Which command should you use to associate the 'privileged' SCC with the 'default' service account in the 'web-apps' namespace?

A cluster administrator wants to prevent any pod in the `finance` namespace from requesting the `NET_RAW` capability, which is not needed by the applications there. The administrator plans to modify the SCC bound to the namespace's default ServiceAccount. Which SCC field should be used to explicitly drop `NET_RAW`?

An administrator wants to pull container images from a private container registry that requires authentication for a specific deployment. Where must the image pull secret be referenced so that the deployment pods can successfully pull the image?

An administrator is preparing a custom SecurityContextConstraints (SCC) named app-scc to allow pods to run with a specific user ID and to use the host network. Which two fields must be set in the SCC to achieve these requirements? (Choose two.)

A security team wants to ensure that all pods in a new namespace called secure-apps run with a specific SELinux context level. They create a custom SCC named selinux-scc with seLinuxContext: MustRunAs and a specific level. After binding the SCC to the default service account in secure-apps, pods still fail to start with an SELinux relabeling error. What is the most likely cause?

You are configuring an OAuth identity provider using 'htpasswd'. Which secret must contain the file?

Which service account is used by default for pods that do not specify a service account in their manifest?

How do you view the currently active OAuth identity providers in an OpenShift cluster?

Which THREE components are involved in TLS termination for routes?

How can you view the list of all SCCs available in the cluster?

Which THREE of the following are required when configuring an OIDC identity provider?

Where do you define the default image pull secrets for all service accounts in a namespace?

An administrator needs to configure re-encrypt TLS termination on a Route. In addition to the router certificate, what other certificate component must typically be provided in the route configuration?

A developer needs to expose a service via a route with re-encryption. What is required in the Route configuration?

When creating a custom SCC, what is the best practice for assigning it to users?

An application deployed in a secured namespace requires access to the Kubernetes API to query pod statuses. The administrator wants to follow the principle of least privilege. How should the administrator configure the ServiceAccount and RBAC?

An administrator needs to secure a Route with edge termination using a custom TLS certificate and private key. Which section of the Route manifest must contain these certificate details?

An administrator is securing routes in an OpenShift cluster. Which THREE TLS termination types are supported natively by OpenShift Routes? (Choose THREE)

When using OIDC for authentication, what does the 'issuer' field in the configuration represent?

An administrator needs to restrict pod creation based on Pod Security Standards namespaces. Which TWO of the following are valid Pod Security Standard levels defined by Kubernetes and supported in OpenShift? (Choose TWO)

An administrator needs to configure an authentication mechanism where users logging into the OpenShift web console are authenticated via an external corporate directory using LDAP. Which resource object should the administrator configure?

Which TWO security standards are natively tracked in OpenShift?

Which SCC is assigned by default to authenticated users who are not service accounts?

An administrator is reviewing the default Security Context Constraints in OpenShift 4.14+. Which THREE of the following SCCs are built-in and provided out-of-the-box by OpenShift? (Choose THREE)

Which TWO actions are required when configuring an external OpenID Connect (OIDC) identity provider in OpenShift Container Platform?

A cluster administrator needs to grant a Deployment in the production namespace permission to pull images from a private container registry. The image pull secret is named my-registry-secret. Which step must be performed so that pods created by this Deployment can successfully pull the image?

You need to terminate TLS for a route using a custom certificate. Which object must contain the TLS key and certificate?

A cluster administrator wishes to enforce the restricted Pod Security Standard across an entire namespace named auditing-ns. Which label should the administrator apply to the namespace to enforce this policy while generating audit warnings for non-compliant pods?

Which TWO things must be configured to use a Private Image Registry?