User And RBAC Management

Which THREE of the following actions can a user with the default OpenShift 'view' role perform within a project? (Choose THREE)

Which THREE of the following rules must be included in a custom ClusterRole to allow monitoring tools to scrape cluster-wide component metrics securely? (Choose THREE)

An administrator notices that a namespace has exceeded its object count quota for ConfigMaps. When a developer attempts to create a new ConfigMap, what error response is returned by the API server?

Which command displays all projects that the currently logged-in user has permission to access?

A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?

An administrator needs to grant a developer named 'alice' read-only access to all pods specifically within the 'development' namespace. Which command should be used to accomplish this while following the principle of least privilege?

A cluster administrator wants to grant a group of users read access to all Pod logs across every namespace in the cluster. Which ClusterRole and binding approach should be used?

An administrator needs to view which users currently possess the 'cluster-admin' cluster role across the OpenShift cluster. Which command is most efficient for displaying this information?

What is the primary function of the 'self-provisioner' cluster role in OpenShift?

A developer reports they cannot deploy applications because their deployment quota is exhausted. Upon inspecting the 'LimitRange' object in the namespace, you notice default limits are set. However, a specific container in their deployment YAML fails validation during creation with an admission webhook error stating 'container exceeds minimum cpu request'. Where must the adjustment be made to allow this specific deployment?

Which command is used to remove a role binding named 'dev-binding' from a namespace named 'development'?

Which command is used to create a new cluster role named 'storage-reader' that permits getting and listing PersistentVolumes cluster-wide?

When setting up authentication and user provisioning in OpenShift 4, which THREE identity providers are natively supported out-of-the-box by the OAuth server configuration? (Choose THREE)

Which TWO of the following are valid built-in default project roles in OpenShift that can be assigned to users within a namespace? (Choose TWO)

An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?

You need to ensure that a specific ServiceAccount named 'builder-sa' in the 'cicd' project can use the 'privileged' SecurityContextConstraints. Which command accomplishes this?

Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?

You need to verify whether a particular ServiceAccount in your project has permissions to read Secrets. Which command tests this authorization?

A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?

Which command is used to list all users who currently have the 'cluster-admin' role assigned via ClusterRoleBindings?

You need to configure a ServiceAccount named 'app-runner' in the 'finance' namespace so that its authentication token does not automatically expire or get automatically generated as a short-lived token (in OCP 4.16+, tokens are bound to service account token volume projection). If you need to create a long-lived API token secret for this ServiceAccount manually, how should you do it?

Which THREE of the following components are involved in authenticating a user via an external OAuth identity provider in OpenShift? (Choose THREE)

You are troubleshooting project requests. A developer runs 'oc new-project test-proj' and receives an error that project requests are disabled or forbidden. Where is the global project request template or configuration managed?

An administrator needs to prevent developers from consuming more than 10 CPU cores and 40Gi of memory collectively across all pods running in the 'production' namespace. Which object satisfies this requirement?

Which TWO of the following tasks can a user with the default OpenShift 'admin' role perform within their project? (Choose TWO)

Which THREE of the following objects can be used to enforce resource governance and consumption limits within an OpenShift project? (Choose THREE)

An administrator configures an external OIDC identity provider. Users can authenticate, but upon login, OpenShift reports that the user has no permissions because group synchronization fails. Where are OIDC group claims mapped in the OAuth configuration?

You need to configure a ClusterRole that permits reading metrics endpoints across all namespaces but nothing else. Which API groups and resources must be specified in the rules block?

Which built-in OpenShift role provides permissions to view all resources within a project but cannot see secrets or bindings? Wait, let's test: Which default role allows modifying resources in a project while excluding permission to modify RBAC roles and role bindings?

Which command allows an administrator to delete a user object named 'old-user' from the OpenShift cluster?

A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?

A cluster administrator has created a new ProjectRequest template to ensure that every newly created project automatically includes a predefined LimitRange. Where must this template be configured so that it applies cluster-wide to all new projects?

An administrator is troubleshooting a service account named 'cicd-bot' in the 'ci-cd' namespace that is failing to read pods in the 'production' namespace, despite a RoleBinding existing. Upon inspection, the RoleBinding references a Role (not a ClusterRole) in the 'ci-cd' namespace. Why is the service account failing to access resources in 'production'?

An administrator needs to restrict a user group named 'contractors' so they can view pods and services, but cannot view secrets across the 'staging' namespace. Which THREE of the following steps or configurations are valid and necessary to achieve this? (Choose THREE)

A security audit requires identifying all users who have direct cluster-admin privileges assigned via individual user bindings rather than groups. How can an administrator inspect the cluster-admin ClusterRoleBinding subjects?

Which command allows an administrator to view details of a specific project named 'web-app', including its annotations and status?

An administrator is troubleshooting a multi-tenant environment where a project administrator of the 'team-a' namespace attempts to bind the cluster-admin ClusterRole to a user in their namespace using a RoleBinding. What is the expected outcome of this operation?

You need to assign the 'cluster-reader' ClusterRole to an LDAP group named 'ldap-auditors' across the entire cluster. Which command accomplishes this?

You need to assign a custom ClusterRole named 'operator-viewer' to all authenticated users cluster-wide. Which command accomplishes this?

You need to create a Role that allows reading and writing ConfigMaps and Secrets only within the 'database' project. Which API groups and resource types should be included in the rules?

You need to create a new project named 'secure-store' with a specified display name and description, and assign 'jane' as the project admin using the OpenShift CLI. Which command should you execute?

A system administrator needs to revoke the 'admin' role from user 'bob' in the 'finance' project without deleting the project or affecting other users. Which command should be used?

A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?

Which command is used to switch the active project context to a namespace named 'staging' in the OpenShift CLI?

Which command displays the current user identity and cluster context information for the logged-in OpenShift CLI session?

An administrator creates a new project request template that includes a custom RoleBinding. However, when users create new projects, the RoleBinding fails to bind because it references a ClusterRole that does not exist in the template namespace. How are ClusterRoles referenced in project templates resolved?

Which THREE of the following commands are valid OpenShift CLI commands for managing user policies and role assignments? (Choose THREE)

Which TWO of the following conditions must be met for a ServiceAccount from 'namespace-a' to successfully access API resources in 'namespace-b'? (Choose TWO)

An OpenShift cluster integrates with an LDAP server where user attribute names differ from default settings (e.g., mail instead of preferredUsername). Where are these LDAP attribute mappings configured?

Which TWO of the following statements regarding OpenShift Projects and Namespaces are correct? (Choose TWO)

An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?

An administrator needs to ensure that no pod in the 'secure-zone' namespace can run with root privileges or use host networking. Which mechanism natively enforces this across all pods in the namespace?

Which command allows an administrator to view all currently configured SecurityContextConstraints in an OpenShift cluster?

An OpenShift administrator needs to restrict developers so they cannot delete any PersistentVolumeClaims in the 'finance-prod' namespace, even though they have the 'admin' role. How can this override be achieved?

Which TWO of the following mechanisms can prevent developers from exhausting cluster memory resources through unbounded pod creation in a namespace? (Choose TWO)

An administrator configures an OAuth provider with user mapping method 'lookup'. What does this mapping method do when a user authenticates for the first time?

You are configuring an OAuth identity provider in OpenShift using the HTPasswdPasswordIdentityProvider method. Where must the generated htpasswd user credentials file be stored so the cluster authentication operator can read it?

Which TWO of the following actions occur when a user is deleted from an OpenShift cluster using 'oc delete user <username>'? (Choose TWO)

An administrator needs to provision a new user named 'sarah' using the HTPasswd identity provider. After updating the htpasswd file and secret, Sarah logs in successfully. What command should the administrator run to verify that OpenShift has successfully created the corresponding User object for Sarah?

A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?

Which command creates a new user identity mapping using the HTPasswd provider if configured, or views user details? Let's focus on user management: Which command lists all registered user objects in the OpenShift cluster?

Which THREE of the following fields are required when defining a custom Role or ClusterRole resource YAML? (Choose THREE)

You need to inspect the resource quota consumption and current usage status for a project named 'analytics'. Which command should you run?

Which THREE of the following are valid parameters that can be specified in a LimitRange object specification? (Choose THREE)

An administrator configures a LimitRange with a max CPU limit of 2 cores and max memory limit of 4Gi. A developer submits a pod specification where a container requests 3 cores of CPU. How does the OpenShift API server handle this request during admission?

You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?

An organization requires that specific projects created by developers automatically receive a default ResourceQuota and LimitRange. How can an administrator achieve this in OpenShift?

An administrator wants to prevent non-admin users from creating any new projects in the OpenShift cluster. How can this be accomplished?

Which THREE of the following are valid identity provider types supported natively in OpenShift Container Platform? (Choose THREE)

An administrator wants to prevent developers from accidentally deploying containers that request excessive CPU resources in the 'analytics' namespace. Which object should the administrator create in that namespace?

Which TWO of the following steps are required when configuring an HTPasswd identity provider in OpenShift? (Choose TWO)

An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?

Which TWO of the following methods can an administrator use to inspect existing RoleBindings within a project named 'app-namespace'? (Choose TWO)

Which TWO of the following characteristics apply to OpenShift SecurityContextConstraints (SCCs)? (Choose TWO)

An administrator needs to configure resource requests and limits such that any pod created without explicit CPU requests in the 'web-tier' namespace automatically gets assigned a default CPU request of 200m and a default CPU limit of 500m. Which object achieves this?

An administrator is configuring a ResourceQuota named 'quota-dev' in the 'development' namespace. Which TWO of the following resource types can be directly tracked and limited by this ResourceQuota? (Choose TWO)

Which TWO of the following commands can an administrator use to verify the identity and permissions of the currently logged-in user? (Choose TWO)