COA Security and Access Control 2 — Questions and Answers
Question 1: Which Keystone token format is the default in modern OpenStack deployments and does not require a persistent backend for validation?
- UUID tokens
- PKI tokens
- Fernet tokens (Correct answer)
- SAML tokens
Correct answer: Fernet tokens
Fernet tokens are the default in modern OpenStack; they are encrypted, self-contained, and require no token persistence in the backend.
Question 2: An operator wants to restrict a user so they can only manage resources within a single OpenStack project without accessing any other projects. Which Keystone concept enforces this boundary?
- Domain
- Region
- Scope (Correct answer)
- Endpoint
Correct answer: Scope
Token scope in Keystone restricts what a user can access; a project-scoped token limits actions to that specific project.
Question 3: Which command lists all roles currently assigned to a user within a specific project?
- openstack role list --user <user> --project <project>
- openstack role assignment list --user <user> --project <project> (Correct answer)
- openstack user role list <user> <project>
- openstack project role get --user <user>
Correct answer: openstack role assignment list --user <user> --project <project>
The `openstack role assignment list` command with `--user` and `--project` filters shows role assignments for that user-project combination.
Question 4: In OpenStack, which security group rule direction controls traffic coming INTO a virtual machine instance?
- Egress
- Ingress (Correct answer)
- Inbound
- Upstream
Correct answer: Ingress
Ingress rules control traffic entering the instance; egress rules control traffic leaving the instance.
Question 5: What is the purpose of the `barbican` service in OpenStack?
- Manages virtual machine snapshots
- Provides key management and secrets storage (Correct answer)
- Controls network firewall rules
- Handles object storage encryption
Correct answer: Provides key management and secrets storage
Barbican is OpenStack's Key Manager service, used to securely store secrets such as encryption keys, certificates, and passwords.
Question 6: Which Keystone policy.json rule keyword is used to define a condition that ALWAYS grants access regardless of the requester?
- "@" (Correct answer)
- "!"
- "*"
- "any"
Correct answer: "@"
The `"@"` rule in Keystone policy files means the action is always allowed with no conditions evaluated.
Question 7: An administrator needs to allow SSH access (port 22) to instances in the 'web' security group only from a specific subnet 10.0.1.0/24. Which command achieves this?
- openstack security group rule create web --protocol tcp --dst-port 22 --remote-ip 10.0.1.0/24 (Correct answer)
- openstack security group rule create web --protocol tcp --dst-port 22 --remote-group 10.0.1.0/24
- openstack security group add rule web --port 22 --source 10.0.1.0/24
- openstack security group rule create --ingress --port 22 web
Correct answer: openstack security group rule create web --protocol tcp --dst-port 22 --remote-ip 10.0.1.0/24
The `openstack security group rule create` command with `--protocol`, `--dst-port`, and `--remote-ip` correctly creates an ingress TCP rule from a specific CIDR.
COA Security and Access Control 2
Which Keystone token format is the default in modern OpenStack deployments and does not require a persistent backend for validation?