75 of 77 questions · Page 1/2 · User And RBAC Management topic · Answers revealed
Which THREE of the following actions can a user with the default OpenShift 'view' role perform within a project? (Choose THREE)
ConfigMaps are readable by the 'view' role.
Why this answer
The 'view' role permits viewing pods, services, deployments, and configmaps, but restricts secrets.
Which THREE of the following rules must be included in a custom ClusterRole to allow monitoring tools to scrape cluster-wide component metrics securely? (Choose THREE)
Monitoring scrapers need to discover and read services, endpoints, and pods cluster-wide.
Why this answer
Scraping metrics cluster-wide typically requires verbs like 'get' and 'list' on resources such as nodes/metrics, pods, and services or endpoints.
An administrator notices that a namespace has exceeded its object count quota for ConfigMaps. When a developer attempts to create a new ConfigMap, what error response is returned by the API server?
Exceeding a ResourceQuota results in admission rejection with an explanation of the quota violation.
Why this answer
When a ResourceQuota is exceeded, the API server rejects the admission request with a 403 Forbidden or 422 Unprocessable Entity error indicating the quota has been exceeded.
Which command displays all projects that the currently logged-in user has permission to access?
The 'oc projects' command safely lists all accessible projects for the current user.
Why this answer
The 'oc projects' command lists all projects accessible to the current user session.
A developer needs to know if their pod's service account has permissions to create pods in another namespace named 'target-ns'. Which command can the developer run to check this?
This command evaluates the current user's permissions against the target namespace.
Why this answer
The developer can use 'oc auth can-i create pods --namespace=target-ns' to check their own permissions, or specify their service account token if testing externally.
An administrator needs to grant a developer named 'alice' read-only access to all pods specifically within the 'development' namespace. Which command should be used to accomplish this while following the principle of least privilege?
Correct. This binds the view cluster role to user alice in the development namespace via a RoleBinding.
Why this answer
The view ClusterRole provides read-only access to most resource types within a project. Binding it via a RoleBinding in the specific namespace limits access strictly to that namespace.
A cluster administrator wants to grant a group of users read access to all Pod logs across every namespace in the cluster. Which ClusterRole and binding approach should be used?
Accessing logs across namespaces requires permission on the 'pods/log' subresource bound cluster-wide.
Why this answer
Reading pod logs requires permissions on the 'pods/log' subresource. A ClusterRole granting 'get' on 'pods/log' combined with a ClusterRoleBinding achieves this cluster-wide.
An administrator needs to view which users currently possess the 'cluster-admin' cluster role across the OpenShift cluster. Which command is most efficient for displaying this information?
Correct. The cluster-admin ClusterRoleBinding explicitly lists all subjects (users, groups, service accounts) bound to the cluster-admin role.
Why this answer
The 'oc adm policy who-can' command or inspecting the ClusterRoleBinding for cluster-admin reveals which users and service accounts hold the role.
What is the primary function of the 'self-provisioner' cluster role in OpenShift?
By default, authenticated users have this role bound, enabling them to request and create new projects.
Why this answer
The 'self-provisioner' role allows authenticated users to create new projects via the project request API.
A developer reports they cannot deploy applications because their deployment quota is exhausted. Upon inspecting the 'LimitRange' object in the namespace, you notice default limits are set. However, a specific container in their deployment YAML fails validation during creation with an admission webhook error stating 'container exceeds minimum cpu request'. Where must the adjustment be made to allow this specific deployment?
LimitRanges validate individual container resource requests against defined minimums and maximums at admission time.
Why this answer
LimitRanges enforce minimum and maximum resource constraints on containers within a namespace. If a container's request violates these constraints, either the container specs or the LimitRange object itself must be modified.
Which command is used to remove a role binding named 'dev-binding' from a namespace named 'development'?
Deleting the RoleBinding object revokes the permissions granted by that binding.
Why this answer
The 'oc delete rolebinding dev-binding -n development' command removes the role binding object.
Which command is used to create a new cluster role named 'storage-reader' that permits getting and listing PersistentVolumes cluster-wide?
This command correctly provisions a cluster-scoped role for persistent volumes.
Why this answer
The 'oc create clusterrole' command creates a cluster role with specified verbs and resources.
When setting up authentication and user provisioning in OpenShift 4, which THREE identity providers are natively supported out-of-the-box by the OAuth server configuration? (Choose THREE)
Correct. OIDC is a natively supported identity provider type in OpenShift.
Why this answer
OpenShift natively supports several identity providers, including HTPasswd, LDAP, OpenID Connect (OIDC), GitHub, and Keystone. Standard RBAC tools do not replace IDP configuration.
Which TWO of the following are valid built-in default project roles in OpenShift that can be assigned to users within a namespace? (Choose TWO)
'admin' is a standard default project-level role granting full management control over a project.
Why this answer
OpenShift provides standard default project roles including 'admin', 'edit', 'view', and 'basic-user'.
An administrator needs to grant read-only access to pods across all namespaces to a specific service account named 'monitor-sa' in the 'monitoring' project. Which RBAC resource configuration is required?
ClusterRoles combined with ClusterRoleBindings provide cluster-wide permissions such as reading pods in all namespaces.
Why this answer
A ClusterRole grants cluster-wide permissions, and a ClusterRoleBinding is required to bind this ClusterRole to a ServiceAccount located in a specific namespace.
You need to ensure that a specific ServiceAccount named 'builder-sa' in the 'cicd' project can use the 'privileged' SecurityContextConstraints. Which command accomplishes this?
This command adds the service account to the 'privileged' SCC's users list, allowing pods using that service account to run with privileged constraints.
Why this answer
Using the 'oc adm policy add-scc-to-user' command with the service account reference grants it access to the specified SCC.
Which default OpenShift cluster role grants full administrative privileges to manage all resources within a specific project when bound via a RoleBinding?
The 'admin' role allows a user to view, modify, and delete most resources within a project.
Why this answer
The 'admin' default ClusterRole grants comprehensive control over most resources in a project, including managing roles and role bindings.
You need to verify whether a particular ServiceAccount in your project has permissions to read Secrets. Which command tests this authorization?
This command evaluates if the specified service account can get secrets.
Why this answer
Using 'oc auth can-i' with the '--as' flag pointing to the service account tests its permissions.
A cluster administrator has created a custom ClusterRole named 'pod-debugger' with permissions to execute commands in pods. They want to ensure that only users in the 'development' group can utilize this role within the 'app-dev' project. How should they configure this?
Referencing a ClusterRole in a namespace-scoped RoleBinding effectively grants those permissions only within that specific namespace.
Why this answer
A RoleBinding created within the 'app-dev' project referencing the 'pod-debugger' ClusterRole and the 'development' group correctly scopes the cluster-wide permissions to that single namespace.
Which command is used to list all users who currently have the 'cluster-admin' role assigned via ClusterRoleBindings?
Inspecting the subjects of the cluster-admin ClusterRoleBinding reveals all users and groups with cluster-admin access.
Why this answer
The 'oc adm policy who-can' command inspects who can perform actions or who is bound to a specific role.
You need to configure a ServiceAccount named 'app-runner' in the 'finance' namespace so that its authentication token does not automatically expire or get automatically generated as a short-lived token (in OCP 4.16+, tokens are bound to service account token volume projection). If you need to create a long-lived API token secret for this ServiceAccount manually, how should you do it?
The 'oc create token' command generates a timed or long-lived token directly for a service account.
Why this answer
In modern OpenShift versions, long-lived tokens are no longer automatically created for ServiceAccounts. To create one, you must create a Secret of type 'kubernetes.io/service-account-token' with an annotation pointing to the service account.
Which THREE of the following components are involved in authenticating a user via an external OAuth identity provider in OpenShift? (Choose THREE)
The built-in OAuth server handles authentication requests and token issuance.
Why this answer
OAuth authentication involves the client/browser, the OpenShift OAuth server, and the external identity provider (such as HTPasswd or OIDC).
You are troubleshooting project requests. A developer runs 'oc new-project test-proj' and receives an error that project requests are disabled or forbidden. Where is the global project request template or configuration managed?
The project configuration resource defines project request behavior and templates cluster-wide.
Why this answer
Project request configurations are managed via the 'Project' cluster operator configuration resource ('cluster' instance of project.config.openshift.io).
An administrator needs to prevent developers from consuming more than 10 CPU cores and 40Gi of memory collectively across all pods running in the 'production' namespace. Which object satisfies this requirement?
ResourceQuotas constrain aggregate resource consumption across all pods and objects within a namespace.
Why this answer
A ResourceQuota object sets hard resource consumption limits (such as limits.cpu and limits.memory) enforced per namespace.
Which TWO of the following tasks can a user with the default OpenShift 'admin' role perform within their project? (Choose TWO)
Admins have full CRUD access to application workloads in their namespace.
Why this answer
The 'admin' role permits managing project resources as well as creating and modifying Roles and RoleBindings within the project.
Which THREE of the following objects can be used to enforce resource governance and consumption limits within an OpenShift project? (Choose THREE)
LimitRanges enforce minimum, maximum, and default container resource constraints within a namespace.
Why this answer
Resource quotas, limit ranges, and cluster resource quotas are core mechanisms for managing resource constraints in OpenShift.
An administrator configures an external OIDC identity provider. Users can authenticate, but upon login, OpenShift reports that the user has no permissions because group synchronization fails. Where are OIDC group claims mapped in the OAuth configuration?
The OIDC provider spec supports mapping claims (such as group memberships) to OpenShift groups via the claims.groups field.
Why this answer
In OpenShift OAuth OIDC configuration, group claims are specified under the 'claims.groups' field of the identity provider specification.
You need to configure a ClusterRole that permits reading metrics endpoints across all namespaces but nothing else. Which API groups and resources must be specified in the rules block?
Reading endpoints across the cluster requires apiGroups [''] and resource 'endpoints' with get, list, watch verbs.
Why this answer
To scrape metrics or read endpoints across namespaces, the apiGroups must include '' (core) and metrics (if custom metrics API), but for standard core endpoints, apiGroups: [''], resources: ['endpoints'].
Which built-in OpenShift role provides permissions to view all resources within a project but cannot see secrets or bindings? Wait, let's test: Which default role allows modifying resources in a project while excluding permission to modify RBAC roles and role bindings?
The 'edit' role permits modifying application workloads without granting permission to escalate privileges via RBAC manipulation.
Why this answer
The 'edit' role allows a user to create, modify, and delete most project resources, but prevents them from modifying Roles or RoleBindings.
Which command allows an administrator to delete a user object named 'old-user' from the OpenShift cluster?
Deleting the user resource via 'oc delete user' removes the user from OpenShift.
Why this answer
The 'oc delete user old-user' command removes the user resource from the cluster database.
A cluster administrator wants to restrict a specific group of developers from creating persistent volume claims (PVCs) larger than 50Gi in the 'data-tier' namespace, while still allowing smaller PVCs. How should this be implemented?
LimitRanges support defining maximum and minimum constraints for persistent volume claims within a namespace.
Why this answer
ResourceQuotas can enforce storage request limits (e.g., 'requests.storage') across a namespace. To enforce a maximum size per individual PVC, a ResourceQuota with scope selectors or specific limits can be used, but OpenShift ResourceQuotas can also track max storage per PVC using standard quota objects.
A cluster administrator has created a new ProjectRequest template to ensure that every newly created project automatically includes a predefined LimitRange. Where must this template be configured so that it applies cluster-wide to all new projects?
Correct. OpenShift uses the project.config.openshift.io/cluster resource to reference the template used for project requests.
Why this answer
The project request template must be referenced in the cluster-wide Project configuration object located at the cluster resource named 'project.config.openshift.io/cluster'.
An administrator is troubleshooting a service account named 'cicd-bot' in the 'ci-cd' namespace that is failing to read pods in the 'production' namespace, despite a RoleBinding existing. Upon inspection, the RoleBinding references a Role (not a ClusterRole) in the 'ci-cd' namespace. Why is the service account failing to access resources in 'production'?
Correct. Namespaced Roles only apply to the namespace in which they are created.
Why this answer
A standard Role and RoleBinding are strictly namespace-scoped. A Role in namespace A cannot grant permissions to resources in namespace B. To grant cross-namespace access, a ClusterRole must be used with either a RoleBinding (in the target namespace) or a ClusterRoleBinding.
An administrator needs to restrict a user group named 'contractors' so they can view pods and services, but cannot view secrets across the 'staging' namespace. Which THREE of the following steps or configurations are valid and necessary to achieve this? (Choose THREE)
Correct. A custom Role defines the exact API permissions permitted within the namespace.
Why this answer
To implement custom restrictions when predefined roles are too broad, an administrator must create a custom Role with explicit rules (allowing pods and services, denying or omitting secrets), and bind it to the contractors group via a RoleBinding in the staging namespace.
A security audit requires identifying all users who have direct cluster-admin privileges assigned via individual user bindings rather than groups. How can an administrator inspect the cluster-admin ClusterRoleBinding subjects?
This command prints all subjects bound to the cluster-admin cluster role, allowing filtering for kind: User.
Why this answer
Inspecting the 'cluster-admin' ClusterRoleBinding object using jsonpath or yaml output displays all subjects (users, groups, service accounts).
Which command allows an administrator to view details of a specific project named 'web-app', including its annotations and status?
Describing a project resource outputs its full status, labels, annotations, and associated namespace details.
Why this answer
The 'oc describe project web-app' command displays detailed information about the project resource.
An administrator is troubleshooting a multi-tenant environment where a project administrator of the 'team-a' namespace attempts to bind the cluster-admin ClusterRole to a user in their namespace using a RoleBinding. What is the expected outcome of this operation?
Using a RoleBinding to reference the cluster-admin ClusterRole grants full administrative permissions within that specific namespace only.
Why this answer
A RoleBinding can reference a ClusterRole, which grants the permissions of that ClusterRole scoped to that namespace. However, binding cluster-admin via a RoleBinding grants full admin privileges *within that namespace*, not cluster-wide.
You need to assign the 'cluster-reader' ClusterRole to an LDAP group named 'ldap-auditors' across the entire cluster. Which command accomplishes this?
This command creates a ClusterRoleBinding associating the cluster-reader role with the specified LDAP group.
Why this answer
The 'oc adm policy add-cluster-role-to-group' command correctly binds a cluster role to a group cluster-wide.
You need to assign a custom ClusterRole named 'operator-viewer' to all authenticated users cluster-wide. Which command accomplishes this?
Binding the role to the 'system:authenticated' group via a ClusterRoleBinding applies it to all logged-in users cluster-wide.
Why this answer
The 'oc adm policy add-cluster-role-to-group' command binding to the 'system:authenticated' group achieves this.
You need to create a Role that allows reading and writing ConfigMaps and Secrets only within the 'database' project. Which API groups and resource types should be included in the rules?
The core API group handles ConfigMaps and Secrets, and these verbs cover full read/write access.
Why this answer
ConfigMaps and Secrets belong to the core API group ('') and their resource names are 'configmaps' and 'secrets'.
You need to create a new project named 'secure-store' with a specified display name and description, and assign 'jane' as the project admin using the OpenShift CLI. Which command should you execute?
The 'oc new-project' command provisions a project with optional display name and description flags.
Why this answer
The 'oc new-project' command creates a project and automatically assigns the creator as admin. To assign a specific user post-creation or manage project requests, specific commands are used, but 'oc adm new-project' does not exist; instead, 'oc adm create-project-request' or standard project requests are handled via 'oc new-project'. Alternatively, creating a Namespace and a RoleBinding is standard, but OpenShift provides the 'oc new-project' helper.
A system administrator needs to revoke the 'admin' role from user 'bob' in the 'finance' project without deleting the project or affecting other users. Which command should be used?
This command removes the binding associating the 'admin' role with user 'bob' in the 'finance' namespace.
Why this answer
The 'oc adm policy remove-role-from-user' command removes a specific role from a user within a given namespace.
A cluster administrator notices that a user 'bob' is unable to create new projects using the 'oc new-project' command, even though bob can view existing projects. What is the root cause and standard remediation?
Correct. Project self-provisioning requires the self-provisioner cluster role to be bound to the user or authenticated group.
Why this answer
In OpenShift, self-provisioning of projects is controlled by a ClusterRoleBinding that binds the 'self-provisioner' ClusterRole to the 'system:authenticated:oauth' group. If this is removed or restricted, users cannot create projects.
Which command is used to switch the active project context to a namespace named 'staging' in the OpenShift CLI?
Running 'oc project <namespace>' sets the current namespace context for subsequent 'oc' commands.
Why this answer
The 'oc project' command switches the active namespace context.
Which command displays the current user identity and cluster context information for the logged-in OpenShift CLI session?
'oc whoami' returns the username of the currently logged-in user.
Why this answer
The 'oc whoami' command outputs the username of the currently authenticated CLI session.
An administrator creates a new project request template that includes a custom RoleBinding. However, when users create new projects, the RoleBinding fails to bind because it references a ClusterRole that does not exist in the template namespace. How are ClusterRoles referenced in project templates resolved?
Since RoleBindings point to ClusterRoles by name, the referenced ClusterRole must already exist in the cluster before project creation instantiates the template.
Why this answer
ClusterRoles are cluster-scoped resources, so any RoleBinding inside a project request template can reference an existing ClusterRole (like 'admin', 'edit', or custom ClusterRoles) because ClusterRoles exist cluster-wide. Wait, if the error states the cluster role does not exist, what could be the issue? The ClusterRole must exist cluster-wide. If it does, the RoleBinding binds successfully.
If the question implies a custom ClusterRole must be created first before the template can reference it, that is the correct operational dependency.
Which THREE of the following commands are valid OpenShift CLI commands for managing user policies and role assignments? (Choose THREE)
This command binds a role to a user within a project namespace.
Why this answer
Policy management commands in OpenShift include 'oc adm policy add-role-to-user', 'oc adm policy remove-role-from-user', and 'oc adm policy add-cluster-role-to-group'.
Which TWO of the following conditions must be met for a ServiceAccount from 'namespace-a' to successfully access API resources in 'namespace-b'? (Choose TWO)
The RoleBinding in the target namespace must explicitly target the service account using its full service account name format.
Why this answer
Cross-namespace access requires a RoleBinding in target 'namespace-b' granting permissions to the ServiceAccount from 'namespace-a', and the ServiceAccount must have permission to target that namespace.
An OpenShift cluster integrates with an LDAP server where user attribute names differ from default settings (e.g., mail instead of preferredUsername). Where are these LDAP attribute mappings configured?
The attributes block in the LDAP IDP configuration maps LDAP directory attributes to OpenShift user record fields.
Why this answer
LDAP identity provider configuration in the cluster OAuth resource includes an 'mappingMethod' and attribute mapping fields (like id, preferredUsername, name, email).
Which TWO of the following statements regarding OpenShift Projects and Namespaces are correct? (Choose TWO)
Projects and namespaces are inter-operable; every project is backed by a Kubernetes namespace.
Why this answer
Projects are supersets of Kubernetes namespaces with additional OpenShift-specific annotations and access control templates, and they map 1:1 to namespaces.
An OpenShift cluster uses an external identity provider (IdP). A user named 'alex@example.com' has successfully logged in via the web console. You need to verify which groups this user belongs to from the command line as an administrator. Which command provides this information?
Describing the user resource reveals their UID, identities, and associated group memberships.
Why this answer
The 'oc describe user alex@example.com' command displays the user object details, including identities and groups associated with the user.
An administrator needs to ensure that no pod in the 'secure-zone' namespace can run with root privileges or use host networking. Which mechanism natively enforces this across all pods in the namespace?
SCCs enforce constraints on runAsUser, hostNetwork, capabilities, and privileged flags.
Why this answer
SecurityContextConstraints (SCCs) control pod security attributes. By assigning a restrictive SCC (like 'restricted') to the service accounts in the namespace, root execution and host networking are prevented.
Which command allows an administrator to view all currently configured SecurityContextConstraints in an OpenShift cluster?
SecurityContextConstraints (or 'scc' for short) is a cluster-scoped resource listable via 'oc get scc'.
Why this answer
The 'oc get scc' command lists all SecurityContextConstraints available in the cluster.
An OpenShift administrator needs to restrict developers so they cannot delete any PersistentVolumeClaims in the 'finance-prod' namespace, even though they have the 'admin' role. How can this override be achieved?
Because RBAC is purely additive, you cannot deny an action if a user holds a role ('admin') that grants it; you must replace the role with a restricted custom role.
Why this answer
RBAC in Kubernetes/OpenShift is strictly additive. To deny a specific action like deletion while granting admin, a custom role and binding cannot deny by default unless using specialized admission webhooks or custom authorization webhooks. Wait, Kubernetes RBAC does not support explicit denies.
However, you can create a custom role without delete verbs and bind that, but if they have 'admin', they keep admin unless you remove it. To truly restrict specific verbs when using built-in roles, you cannot override unless you modify the role or use a custom authorization webhook/admission control. Let's check alternative mechanisms: Exclusion is handled by custom RBAC roles instead of 'admin', or using admission webhooks.
Since standard RBAC is additive, a user cannot have 'admin' and simultaneously be denied a subset via RBAC alone without replacing the role. Let's frame the question around replacing 'admin' with a custom role that omits delete verbs.
Which TWO of the following mechanisms can prevent developers from exhausting cluster memory resources through unbounded pod creation in a namespace? (Choose TWO)
LimitRanges ensure containers receive sensible default memory limits if omitted.
Why this answer
ResourceQuotas and LimitRanges prevent unbounded consumption by setting hard aggregate limits and container request/limit defaults.
An administrator configures an OAuth provider with user mapping method 'lookup'. What does this mapping method do when a user authenticates for the first time?
The 'lookup' method expects an existing identity-to-user mapping and will not auto-create user accounts.
Why this answer
The 'lookup' mapping method requires that both an Identity and a User object already exist and be linked; if not, authentication fails. (In contrast to 'add', which creates them).
You are configuring an OAuth identity provider in OpenShift using the HTPasswdPasswordIdentityProvider method. Where must the generated htpasswd user credentials file be stored so the cluster authentication operator can read it?
The HTPasswd secret containing the password file must reside in the 'openshift-config' namespace for the cluster-authentication-operator to mount it.
Why this answer
HTPasswd identity providers require the password file to be stored as a Secret in the 'openshift-config' namespace.
Which TWO of the following actions occur when a user is deleted from an OpenShift cluster using 'oc delete user <username>'? (Choose TWO)
The user object record is deleted from etcd.
Why this answer
Deleting a User object removes the user entity, but existing RBAC bindings referencing that username remain until cleaned up, and their active OAuth tokens are revoked.
An administrator needs to provision a new user named 'sarah' using the HTPasswd identity provider. After updating the htpasswd file and secret, Sarah logs in successfully. What command should the administrator run to verify that OpenShift has successfully created the corresponding User object for Sarah?
Correct. The 'oc get user' command queries the API for the automatically generated User resource.
Why this answer
When an identity provider successfully authenticates a user, OpenShift automatically creates a corresponding User object. You can verify this with 'oc get user sarah'.
A cluster has a custom SCC (SecurityContextConstraints) named 'restricted-custom'. You need to grant a specific ServiceAccount named 'app-sa' in namespace 'app-ns' permission to use this SCC. How is this association correctly established?
SCCs explicitly list authorized users, groups, and service accounts in their specification fields to grant access.
Why this answer
SCCs are cluster-scoped resources that grant permissions by referencing either users, groups, or service accounts directly within the SCC's 'users' or 'groups' lists, or by binding a ClusterRole/Role that allows the 'use' verb on the specific SCC resource.
Which command creates a new user identity mapping using the HTPasswd provider if configured, or views user details? Let's focus on user management: Which command lists all registered user objects in the OpenShift cluster?
'oc get users' retrieves the list of user resources recognized by the OpenShift master.
Why this answer
The 'oc get users' command lists all internal User objects created in the cluster.
Which THREE of the following fields are required when defining a custom Role or ClusterRole resource YAML? (Choose THREE)
Every Kubernetes resource manifest requires apiVersion.
Why this answer
A Role or ClusterRole YAML requires 'apiVersion', 'kind', 'metadata' (with name), and 'rules' (with API groups, resources, and verbs).
You need to inspect the resource quota consumption and current usage status for a project named 'analytics'. Which command should you run?
'oc get quota' lists the resource quotas and their hard limits and current usage in the specified namespace.
Why this answer
The 'oc describe quota' or 'oc get quota' command displays current resource consumption against defined limits.
Which THREE of the following are valid parameters that can be specified in a LimitRange object specification? (Choose THREE)
Defines the maximum allowed resource limit for a container or PVC.
Why this answer
LimitRanges support 'max', 'min', 'default', 'defaultRequest', and 'maxLimitRequestRatio' for resource types like Pod, Container, and PersistentVolumeClaim.
An administrator configures a LimitRange with a max CPU limit of 2 cores and max memory limit of 4Gi. A developer submits a pod specification where a container requests 3 cores of CPU. How does the OpenShift API server handle this request during admission?
LimitRanges enforce maximum boundaries during admission control, causing rejection if exceeded.
Why this answer
The API server rejects the pod creation request immediately because the container resource limit exceeds the maximum allowed by the LimitRange.
You need to inspect the effective permissions of a service account named 'cicd-bot' in the 'ci-cd' namespace to see if it can list deployments. Which command should you run?
This command correctly evaluates whether the specified service account possesses permission to list deployments in the given namespace.
Why this answer
The 'oc auth can-i' command with the '--as' flag allows testing permissions as another user or service account.
An organization requires that specific projects created by developers automatically receive a default ResourceQuota and LimitRange. How can an administrator achieve this in OpenShift?
The project request template defines objects like ResourceQuotas and LimitRanges that get automatically created in every new project.
Why this answer
Template-based project requests via the Project CR allow specifying an administrative template that is instantiated whenever a user creates a new project.
An administrator wants to prevent non-admin users from creating any new projects in the OpenShift cluster. How can this be accomplished?
Removing or modifying this binding stops regular authenticated users from executing project requests.
Why this answer
Removing the 'self-provisioner' cluster role binding from the 'system:authenticated' group prevents regular users from self-provisioning new projects.
Which THREE of the following are valid identity provider types supported natively in OpenShift Container Platform? (Choose THREE)
OpenID Connect (OIDC) is a supported identity provider type.
Why this answer
OpenShift supports multiple identity providers including HTPasswd, LDAP, OpenID Connect (OIDC), GitHub, and Keystone.
An administrator wants to prevent developers from accidentally deploying containers that request excessive CPU resources in the 'analytics' namespace. Which object should the administrator create in that namespace?
Correct. A LimitRange can enforce minimum and maximum constraints on resource requests and limits for individual containers or pods.
Why this answer
A LimitRange object restricts resource consumption (requests and limits) down to a per-pod or per-container basis within a specific namespace.
Which TWO of the following steps are required when configuring an HTPasswd identity provider in OpenShift? (Choose TWO)
The authentication operator requires the password file to be stored as a Secret in 'openshift-config'.
Why this answer
Configuring HTPasswd requires creating a Secret containing the htpasswd file in the 'openshift-config' namespace and referencing that Secret in the cluster OAuth configuration resource.
An administrator configured an LDAP identity provider in OpenShift, but users report authentication failures. Upon checking the cluster logs, you find errors indicating that the bind DN password secret is missing or incorrect. Where must this bind password be stored?
OAuth configuration references a Secret containing the bindPassword located in the 'openshift-config' namespace.
Why this answer
LDAP identity provider bind passwords must be stored as a Secret in the 'openshift-config' namespace.
Which TWO of the following methods can an administrator use to inspect existing RoleBindings within a project named 'app-namespace'? (Choose TWO)
This command details all RoleBindings and their bound subjects and roles in the namespace.
Why this answer
RoleBindings can be inspected using 'oc get rolebindings -n app-namespace' or 'oc describe rolebindings -n app-namespace'.
Which TWO of the following characteristics apply to OpenShift SecurityContextConstraints (SCCs)? (Choose TWO)
SCC admission controllers can mutate pod security contexts to ensure compliance with assigned SCC rules.
Why this answer
SCCs are cluster-scoped resources that dictate what security context fields a pod can specify, and they are evaluated based on user/group/serviceaccount associations or priority when pods are created.
An administrator needs to configure resource requests and limits such that any pod created without explicit CPU requests in the 'web-tier' namespace automatically gets assigned a default CPU request of 200m and a default CPU limit of 500m. Which object achieves this?
LimitRanges support 'default' (limits) and 'defaultRequest' (requests) fields to automatically populate omitted container specifications.
Why this answer
A LimitRange object defines default resource requests and limits applied to containers that do not specify them.
Ready to test yourself?
Try a timed practice session using only User And RBAC Management questions.