COA Security & Access Management 3

Question 1

Which Nova policy action controls whether a user can list all instances across all tenants (not just their own)?

Accepted Answer

os_compute_api:servers:detail:get_all_tenants

Answer

The 'get_all_tenants' policy governs whether a user can retrieve server listings belonging to all projects.

Question 2

An operator wants to enforce that only specific CIDR ranges can be used in security group rules. Which OpenStack feature can enforce network-level access policies?

Accepted Answer

Neutron RBAC policies

Answer

Neutron RBAC (Role-Based Access Control) policies control which projects can access shared networks and resources.

Question 3

In Barbican, what is a 'Secret Container' used for?

Accepted Answer

Grouping related secrets such as a certificate, private key, and intermediates together

Answer

A Barbican secret container logically groups related secrets (e.g., TLS cert + private key + CA chain) under a single reference.

Question 4

Which mechanism does Keystone use to federate identity with an external SAML-based Identity Provider?

Accepted Answer

Federated identity mapping rules

Answer

Keystone federation uses mapping rules to translate assertions from external IdPs into local Keystone groups and roles.

Question 5

A project has a security group rule allowing all TCP traffic from 0.0.0.0/0. Which command removes only that specific rule?

Accepted Answer

openstack security group rule delete <rule-id>

Answer

The 'openstack security group rule delete <rule-id>' command removes a specific security group rule by its ID.

(COA) Certified OpenStack Administrator Exam Practice Test

(COA) Certified OpenStack Administrator Exam Practice Test

COA Security & Access Management 3