COA Security & Access Management 3 — Questions and Answers
Question 1: Which Nova policy action controls whether a user can list all instances across all tenants (not just their own)?
- os_compute_api:servers:index
- os_compute_api:servers:detail:get_all_tenants (Correct answer)
- os_compute_api:servers:show
- os_compute_api:os-admin-actions:admin
Correct answer: os_compute_api:servers:detail:get_all_tenants
The 'get_all_tenants' policy governs whether a user can retrieve server listings belonging to all projects.
Question 2: An operator wants to enforce that only specific CIDR ranges can be used in security group rules. Which OpenStack feature can enforce network-level access policies?
- Nova hypervisor filters
- Neutron RBAC policies (Correct answer)
- Neutron port security
- Nova host aggregates
Correct answer: Neutron RBAC policies
Neutron RBAC (Role-Based Access Control) policies control which projects can access shared networks and resources.
Question 3: In Barbican, what is a 'Secret Container' used for?
- Encrypting volumes with a single key
- Grouping related secrets such as a certificate, private key, and intermediates together (Correct answer)
- Isolating secrets between projects
- Wrapping secrets with a master key
Correct answer: Grouping related secrets such as a certificate, private key, and intermediates together
A Barbican secret container logically groups related secrets (e.g., TLS cert + private key + CA chain) under a single reference.
Question 4: Which mechanism does Keystone use to federate identity with an external SAML-based Identity Provider?
- OAuth 2.0 tokens
- Keystone-to-Keystone trust delegation
- Federated identity mapping rules (Correct answer)
- LDAP group sync
Correct answer: Federated identity mapping rules
Keystone federation uses mapping rules to translate assertions from external IdPs into local Keystone groups and roles.
Question 5: A project has a security group rule allowing all TCP traffic from 0.0.0.0/0. Which command removes only that specific rule?
- openstack security group delete --rule <rule-id>
- openstack security group rule delete <rule-id> (Correct answer)
- openstack security group rule remove <sg-id> <rule-id>
- neutron security-group-rule-delete <rule-id>
Correct answer: openstack security group rule delete <rule-id>
The 'openstack security group rule delete <rule-id>' command removes a specific security group rule by its ID.
Question 6: What does the 'admin' role in OpenStack grant by default, and why is it considered risky?
- Read-only access to all services; risky because it exposes configuration data
- Full administrative access across all services system-wide; risky because it bypasses project-level isolation (Correct answer)
- Access to Nova only; risky because compute changes affect all users
- Access to Keystone only; risky because identity changes are irreversible
Correct answer: Full administrative access across all services system-wide; risky because it bypasses project-level isolation
The admin role provides cross-project, system-wide privileges to all services, making it a high-value target for privilege escalation.
Question 7: Which Keystone feature allows a user to delegate a subset of their own permissions to another user or service without sharing credentials?
- Impersonation tokens
- Trust delegation (Correct answer)
- Application credentials
- Service tokens
Correct answer: Trust delegation
Keystone trusts allow a trustor to delegate a subset of roles to a trustee, enabling secure permission delegation.
COA Security & Access Management 3
Which Nova policy action controls whether a user can list all instances across all tenants (not just their own)?