EX280 Security And SCC Practice Question
Which TWO methods can an administrator use to inspect or troubleshoot Security Context Constraint (SCC) assignments for a specific ServiceAccount in a namespace?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use oc auth can-i create pods --as=system:serviceaccount:<namespace>:<serviceaccount-name> to test permissions.
Administrators can check SCC assignments by evaluating who can bind to the SCC cluster roles using 'oc adm policy' commands or by checking effective SCCs using 'oc auth can-i'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Examine the /etc/origin/master/scc.yaml file on control plane nodes.
Why it's wrong here
SCCs are stored as cluster-scoped API custom resources / built-in resources in etcd, not static flat files on control plane nodes.
- ✓
Use oc auth can-i create pods --as=system:serviceaccount:<namespace>:<serviceaccount-name> to test permissions.
Why this is correct
Checking authorization with '--as' on the service account helps verify its operational context.
- ✗
Inspect the service account's annotations for the kubernetes.io/scc-assignment-override key.
Why it's wrong here
This annotation does not exist.
- ✓
Run oc adm policy who-can use scc restricted-v2 to see which users and service accounts have access to the SCC.
Why this is correct
The 'oc adm policy who-can' command inspects RBAC bindings for SCCs.
- ✗
Check the logs of the kube-apiserver static pod for SCC admission failures.
Why it's wrong here
SCC admission is handled by the SCC admission webhook / plugin, but routine troubleshooting uses CLI policy commands rather than raw API server log parsing.
About these practice questions
This EX280 question is part of Courseiva's 509-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Red Hat exam blueprint
This EX280 practice question is part of Courseiva's free Red Hat certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the EX280 exam.