How should I use these Security And SCC practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

Can I practise just Security And SCC questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Security And SCC domain.

EX280 · topic practice

Security And SCC practice questions

This domain covers OpenShift security primitives: SCCs, service accounts, RBAC, identity providers, secrets, and TLS-secured Routes. On EX280 you perform hands-on tasks with oc and YAML manifests, such as creating SCCs, binding roles, configuring htpasswd or OIDC identity providers, and applying certificates to Routes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Editorial oversight:Johnson Ajibi· MSc IT Security, IEEE Senior Member

20 questionsDomain: Security And SCC

Practice 10 questions Browse domain →

What the exam tests

What to know about Security And SCC

Be able to create SCCs, bind them to ServiceAccounts with oc adm policy, configure OAuth identity providers, and secure Routes with custom TLS certificates. The critical thing is attaching SCCs and pull secrets to the correct ServiceAccount, not to users or Deployments directly.

Creating and applying custom SCCs, then binding them to ServiceAccounts via oc adm policy add-scc-to-user

Configuring identity providers such as htpasswd or OIDC in the OAuth custom resource

Securing Routes with edge, passthrough, or reencrypt TLS termination and custom certificates

Managing Secrets for image pull credentials and referencing them in ServiceAccounts or Pod specs

Watch out for

Common Security And SCC exam traps

▸Binding a custom SCC directly to a user instead of to the ServiceAccount the pod actually runs as
▸Placing TLS certificate and key in the wrong Route field, such as spec.tls instead of the correct termination stanza
▸Forgetting that OIDC requires issuer URL, client ID, and client secret, and omitting the required claims or secret reference

Practice set

Security And SCC questions

20 questions · select your answer, then reveal the explanation

Question 1hardmultiple choice

Read the full Security And SCC explanation →

An administrator has created a custom SCC named restricted-custom. During testing, pods using this SCC still fail because they are assigned the non-root UID range automatically, but the application container requires writing to a specific directory owned by UID 1000. How should the administrator configure the SCC to ensure the container runs consistently as UID 1000?

Trap 1: Set runAsUser.type to RunAsAny and add securityContext.runAsUser:…

RunAsAny allows pods to define their own UID, but if the container image enforces a different default user, it may fail unless overridden in the pod spec.

Trap 2: Configure fsGroup.type to MustRunAs with uid: 1000

fsGroup controls volume ownership and permissions, not the process execution user ID of the container.

Trap 3: Set privileged: true and map the container user via…

Privileged mode disables namespace isolation and is a severe security risk; it does not explicitly enforce a container user ID.

Study all Security And SCC common traps →

A
Set runAsUser.type to RunAsAny and add securityContext.runAsUser: 1000 in the pod spec
Why it fails: RunAsAny allows pods to define their own UID, but if the container image enforces a different default user, it may fail unless overridden in the pod spec.
B
Configure fsGroup.type to MustRunAs with uid: 1000
Why it fails: fsGroup controls volume ownership and permissions, not the process execution user ID of the container.
C
Set privileged: true and map the container user via supplementalGroups
Why it fails: Privileged mode disables namespace isolation and is a severe security risk; it does not explicitly enforce a container user ID.
D
Set runAsUser.type to MustRunAs and specify uid: 1000 in the uidRange
Setting runAsUser.type to MustRunAs with the appropriate UID ensures the container always runs as the specified user ID.

Security And SCC practice questions

What to know about Security And SCC

Common Security And SCC exam traps

Security And SCC questions

An administrator is auditing Pod Security Standards compliance across several namespaces in an OpenShift cluster. Which namespace label must be applied to enforce the restricted Pod Security standard while logging violations?

An administrator needs to configure a new project so that pods deployed within it run with the restricted-v2 Security Context Constraint by default. Which action should the administrator perform?

An administrator wants to prevent developers from creating pods that run as the root user across the entire cluster. Which OpenShift resource or admission mechanism is best suited to enforce this restriction globally?

An administrator is troubleshooting an Ingress routing issue where external clients receive a 503 error when trying to access a secure application through a Route configured with passthrough TLS termination. What is the most likely cause of this issue?

An administrator needs to ensure that a newly created ServiceAccount automatically receives a long-lived API token when created in OpenShift 4.14+. What is the correct procedure?

An auditor requests a report of all security context constraints currently assigned to a specific user named alice in the cluster. Which OpenShift CLI command should the administrator run?

An administrator is configuring an OAuth identity provider and needs to map claims from an external provider to OpenShift usernames. Which field in the OAuth configuration specifies the claim to use as the username?

An application pod needs to run with a specific user ID (UID 10005000) that falls outside the restricted-v2 SCC default allocated range for the namespace. The administrator decides to create a custom SCC. Which SCC security context strategy parameter must be adjusted to allow this specific UID?

An administrator needs to secure a Route using a custom wildcard certificate. The certificate and private key are stored in a TLS Secret named wildcard-tls-secret in the same namespace as the Route. Which section of the Route manifest should reference this Secret?

Which command checks if a specific service account can use a restricted SCC?

Which THREE restrictions or behaviors are enforced by the default restricted-v2 Security Context Constraint in OpenShift Container Platform?

A pod fails to start with 'container has runAsNonRoot and image will run as root'. Which SCC field needs to be adjusted in a custom SCC to allow this image to run?

You have a private image registry that requires credentials. Where should you place the 'imagePullSecret' so that it is automatically injected into all pods created by a specific service account?

You want to ensure that all pods in a namespace are denied access to the host network. Which policy mechanism is most effective for this?

You are hardening a cluster. Which Pod Security Standard level is the default in OpenShift 4.14 for new projects?

A pod requires access to the hostPath volume. Which SCC field must be configured to allow this?

Track your progress over time

Start a Security And SCC only practice session

Related EX280 topic practice pages

User And RBAC Management practice questions

Troubleshooting And Diagnostics practice questions

Networking And Network Policies practice questions

Cluster Installation And Management practice questions

Security And SCC practice questions

Storage And Persistent Volumes practice questions

Application Deployment And Lifecycle practice questions

EX280 fundamentals practice questions

EX280 scenario practice questions

EX280 troubleshooting practice questions

Frequently asked questions

Track your progress

Study resources

Exam traps to avoid