COA Security & Access Management 2 — Questions and Answers
Question 1: Which Keystone token format is the default in modern OpenStack deployments and does not require a persistence backend?
- UUID tokens
- PKI tokens
- Fernet tokens (Correct answer)
- PKIZ tokens
Correct answer: Fernet tokens
Fernet tokens are lightweight, non-persistent tokens that use symmetric encryption and require no database storage.
Question 2: An administrator needs to restrict a user so they can only manage resources within a single project. Which Keystone concept enforces this boundary?
- Domain
- Group
- Scope (Correct answer)
- Region
Correct answer: Scope
Token scope in Keystone limits the user's effective permissions to a specific project, domain, or system.
Question 3: Which command lists all role assignments for a specific user across all projects?
- openstack role list --user <user>
- openstack role assignment list --user <user> (Correct answer)
- openstack user role list <user>
- openstack assignment show --user <user>
Correct answer: openstack role assignment list --user <user>
The 'openstack role assignment list --user <user>' command shows all role assignments for a given user.
Question 4: In OpenStack, what is the purpose of the 'default' domain in Keystone?
- It stores service accounts only
- It is used for backward compatibility with v2 API users and projects (Correct answer)
- It is a read-only domain created at install
- It holds global roles that apply across all domains
Correct answer: It is used for backward compatibility with v2 API users and projects
The default domain provides backward compatibility for OpenStack Identity v2 API clients that are unaware of domains.
Question 5: A security audit requires that all OpenStack API calls be logged with user identity details. Which service should be configured to meet this requirement?
- Nova audit middleware
- Keystone audit middleware (cadf) (Correct answer)
- Neutron security logs
- Ceilometer event pipeline
Correct answer: Keystone audit middleware (cadf)
Keystone's CADF (Cloud Audit Data Federation) audit middleware logs all API requests with identity context.
Question 6: Which command would you use to prevent a compromised user's existing tokens from being used?
- openstack user disable <user> (Correct answer)
- openstack token revoke <token>
- openstack user delete <user>
- openstack role remove --user <user>
Correct answer: openstack user disable <user>
Disabling a user in Keystone invalidates all of their existing tokens immediately.
Question 7: What is the function of the Keystone credential store?
- Stores hashed user passwords
- Stores EC2-style access key pairs and other user credentials (Correct answer)
- Stores TLS certificates for services
- Stores Barbican encryption keys
Correct answer: Stores EC2-style access key pairs and other user credentials
Keystone's credential store holds EC2-compatible access/secret key pairs and similar per-user credentials.
COA Security & Access Management 2
Which Keystone token format is the default in modern OpenStack deployments and does not require a persistence backend?