Security And SCC practice questions

oc get scc --user=alice

Why wrong: The oc get scc command does not accept a --user filter directly as a standard argument.

oc describe user alice --with-scc

Why wrong: The oc describe user command does not include SCC binding summaries.

oc auth can-i use scc --as=alice

Why wrong: oc auth can-i checks a single verb and resource permission, but doesn't list all matching SCCs across the cluster easily.

Set runAsUser.type to RunAsAny and add securityContext.runAsUser: 1000 in the pod spec

Why wrong: RunAsAny allows pods to define their own UID, but if the container image enforces a different default user, it may fail unless overridden in the pod spec.

Configure fsGroup.type to MustRunAs with uid: 1000

Why wrong: fsGroup controls volume ownership and permissions, not the process execution user ID of the container.

Set privileged: true and map the container user via supplementalGroups

Why wrong: Privileged mode disables namespace isolation and is a severe security risk; it does not explicitly enforce a container user ID.

runAsUser.type: RunAsAny

Why wrong: This controls the user ID execution strategy, not host port binding permissions.

allowPrivilegedContainer: true

Why wrong: This field allows containers to run in privileged mode, which is overly permissive just for host port binding.

privileged: true

Why wrong: Setting privileged to true grants unrestricted access, which bypasses all security constraints and exposes the host kernel unnecessarily.

As an annotation on the cluster-scoped Namespace object

Why wrong: Namespaces do not accept image pull secret annotations for workloads directly unless managed via service accounts.

Inside the Route object spec under tls.imagePullSecret

Why wrong: Routes manage ingress traffic and TLS termination, not image pulling.

As an environment variable named IMAGE_PULL_SECRET in the container specification

Why wrong: Container runtime container-pull authentication does not read application environment variables for registry credentials.

pod-security.openshift.io/standard: restricted

Why wrong: The correct label prefix is pod-security.kubernetes.io, not pod-security.openshift.io.

security.openshift.io/scc.enforce: restricted

Why wrong: This is not a valid OpenShift namespace label for Pod Security Standards.

openshift.io/cluster-monitoring: "true"

Why wrong: This label enables cluster monitoring for the namespace, not Pod Security Standards.

Edit the default cluster-wide SCC object directly to set restricted-v2 as priority zero

Why wrong: Cluster-wide default SCC assignments are managed via cluster roles and annotations, not by modifying the core restricted-v2 SCC object directly.

Create a RoleBinding linking the restricted-v2 ClusterRole to the system:authenticated group

Why wrong: SCC permissions are granted using ClusterRoles for sccs, but standard RoleBindings alone do not change the default namespace assignment.

Patch the PodSecurity standards admission configuration in the APIServer resource

Why wrong: Pod Security Standards control admission via labels, but SCCs are managed through OpenShift SCC admission controllers and annotations.

spec.endpoint.tls with base64 encoded string data

Why wrong: spec.endpoint.tls is not a valid field path in OpenShift Route resources.

metadata.annotations containing openshift.io/tls-cert and openshift.io/tls-key

Why wrong: While some ingress controllers use annotations, OpenShift Routes use the explicit spec.tls structure.

status.ingress.tls for automatic cert-manager synchronization

Why wrong: status fields are managed by the cluster controller and are read-only for users.

A Secret named identity-provider in the openshift-authentication namespace

Why wrong: Secrets are used for storing LDAPbind passwords or TLS certificates referenced by the OAuth resource, but not as the primary provider configuration.

An Authentication custom resource named cluster in the kube-system namespace

Why wrong: OpenShift authentication is managed via the operator and the cluster-scoped OAuth resource, not a kube-system Authentication resource.

A ConfigMap named ldap-config in the openshift-config namespace

Why wrong: OAuth identity providers are configured directly in the cluster OAuth resource, not via arbitrary ConfigMaps.

Add a subject entry referencing system:serviceaccount:production:app-sa to the users list inside the restricted SCC definition

Why wrong: Modifying predefined system SCC objects directly is an unsupported anti-pattern and can be overwritten during cluster upgrades.

Annotate the app-sa ServiceAccount with openshift.io/scc.constraint: hostaccess

Why wrong: Service accounts do not use annotations to bind SCCs; they rely on ClusterRoleBindings or RoleBindings targeting the scc cluster roles.

Create a ClusterRoleBinding that binds the system:openshift:scc:restricted cluster role to system:serviceaccount:production:app-sa

Why wrong: The restricted SCC does not allow hostIPC. The correct SCC that permits hostIPC is hostaccess or a custom SCC.

A ServiceAccount with special token annotations

Why wrong: ServiceAccounts are used for pod authentication and RBAC, not for human user HTPasswd login.

A ConfigMap containing plain-text user credentials

Why wrong: Passwords must never be stored in plain text inside ConfigMaps; sensitive data requires a Secret.

A custom resource of kind HTPasswdProvider in the openshift-config namespace

Why wrong: HTPasswd is configured inline within the cluster OAuth resource referencing a Secret, not as a standalone custom resource kind.

A base64 encoded kubeconfig file for the ingress operator

Why wrong: Kubeconfig files are used for cluster API authentication, not route TLS termination.

An identity provider public key for JSON Web Token validation

Why wrong: JWT validation is handled by the API server and OAuth server, not the ingress router.

A client certificate for mutual TLS authentication against the OAuth server

Why wrong: OAuth uses separate token mechanisms; route re-encryption focuses on backend pod trust.

Disabling the ServiceAccount controller in the cluster operator configuration

Why wrong: Disabling the ServiceAccount controller would break core cluster functionality.

Adding a cluster-wide ValidatingWebhookConfiguration that intercepts Route creations

Why wrong: Routes deal with ingress traffic, not pod security contexts or user IDs.

Creating a global ConfigMap in the openshift-config namespace named root-blocker

Why wrong: ConfigMaps do not enforce admission control rules.

The Route manifest is missing the spec.tls.destinationCACertificate field

Why wrong: Destination CA certificates are used for re-encrypt routes, not passthrough routes.

The default Ingress controller wildcard certificate has expired

Why wrong: Passthrough routes do not use the router's default certificate because the router does not terminate TLS.

The Route object lacks an annotation specifying openshift.io/router.router-credentials

Why wrong: This annotation does not exist in OpenShift routing configurations.

Patch the default cluster authentication profile to revert to automountServiceAccountToken globally

Why wrong: automountServiceAccountToken controls whether the token is mounted into pods, not whether a long-lived secret is generated.

Add the annotation serviceaccounts.openshift.io/want-token: "true" to the ServiceAccount metadata

Why wrong: OpenShift does not use this specific annotation to generate legacy tokens automatically.

Execute the oc create token command and store the output in a ConfigMap

Why wrong: While oc create token generates short-lived tokens, it does not create a persistent Secret object automatically.

Bind the cluster-admin ClusterRole to the default ServiceAccount in the namespace using a ClusterRoleBinding

Why wrong: Binding cluster-admin grants full administrator access across the entire cluster, violating the principle of least privilege completely.

Annotate the default ServiceAccount with rbac.authorization.k8s.io/authtype: reader

Why wrong: Service accounts do not use RBAC auth-type annotations to grant permissions.

Grant the system:openshift:scc:restricted ClusterRole to the ServiceAccount using a RoleBinding

Why wrong: SCC cluster roles govern pod security constraints, not Kubernetes API RBAC permissions for querying resources like pods.

metadata.annotations['oauth.openshift.io/username-claim']

Why wrong: OAuth provider settings are configured in the spec of the cluster OAuth resource, not via metadata annotations.

spec.identityProviders.providerConfig.userField

Why wrong: This is not the correct path structure for OpenShift OAuth identity provider configuration.

status.providerStatus.usernameMapping

Why wrong: Status fields are read-only and maintained by operators.

oc get securityconstraints

Why wrong: securityconstraints is not a valid resource name; the correct resource shorthand is scc.

oc adm policy list-constraints

Why wrong: While oc adm policy has various subcommands, listing SCCs is done directly via standard resource retrieval with oc get scc.

oc describe clustersecurity

Why wrong: clustersecurity is not a valid OpenShift CLI command.

Proxy

Why wrong: Proxy is not a supported route TLS termination type in OpenShift.

FullMesh

Why wrong: FullMesh is a networking topology term, not an OpenShift route TLS termination type.

Defining the secret inside the cluster Ingress controller custom resource spec

Why wrong: Ingress controllers handle external traffic routing, not internal image pulling credentials.

Placing the pull secret in the global openshift-config ConfigMap

Why wrong: Global cluster image registries and pull secrets are managed via global cluster configurations like image.config.openshift.io, not arbitrary ConfigMaps.

Annotating the Namespace with openshift.io/image-pull-secret-ref

Why wrong: Namespaces do not support this specific annotation for automated image pulling.

CustomDatabaseProvider

Why wrong: OpenShift does not include a built-in CustomDatabaseProvider identity provider type.

LocalFileAuthService

Why wrong: LocalFileAuthService is not a valid OpenShift identity provider keyword.

ActiveDirectoryNativeProtocol

Why wrong: This is a fictitious identity provider type name.