COA Security & Access Management 2

Question 1

Which Keystone token format is the default in modern OpenStack deployments and does not require a persistence backend?

Accepted Answer

Fernet tokens

Answer

Fernet tokens are lightweight, non-persistent tokens that use symmetric encryption and require no database storage.

Question 2

An administrator needs to restrict a user so they can only manage resources within a single project. Which Keystone concept enforces this boundary?

Accepted Answer

Scope

Answer

Token scope in Keystone limits the user's effective permissions to a specific project, domain, or system.

Question 3

Which command lists all role assignments for a specific user across all projects?

Accepted Answer

openstack role assignment list --user <user>

Answer

The 'openstack role assignment list --user <user>' command shows all role assignments for a given user.

Question 4

In OpenStack, what is the purpose of the 'default' domain in Keystone?

Accepted Answer

It is used for backward compatibility with v2 API users and projects

Answer

The default domain provides backward compatibility for OpenStack Identity v2 API clients that are unaware of domains.

Question 5

A security audit requires that all OpenStack API calls be logged with user identity details. Which service should be configured to meet this requirement?

Accepted Answer

Keystone audit middleware (cadf)

Answer

Keystone's CADF (Cloud Audit Data Federation) audit middleware logs all API requests with identity context.

(COA) Certified OpenStack Administrator Exam Practice Test

(COA) Certified OpenStack Administrator Exam Practice Test

COA Security & Access Management 2