COA Security and Access Control 2

Question 1

Which Keystone token format is the default in modern OpenStack deployments and does not require a persistent backend for validation?

Accepted Answer

Fernet tokens

Answer

Fernet tokens are the default in modern OpenStack; they are encrypted, self-contained, and require no token persistence in the backend.

Question 2

An operator wants to restrict a user so they can only manage resources within a single OpenStack project without accessing any other projects. Which Keystone concept enforces this boundary?

Accepted Answer

Scope

Answer

Token scope in Keystone restricts what a user can access; a project-scoped token limits actions to that specific project.

Question 3

Which command lists all roles currently assigned to a user within a specific project?

Accepted Answer

openstack role assignment list --user --project

Answer

The `openstack role assignment list` command with `--user` and `--project` filters shows role assignments for that user-project combination.

Question 4

In OpenStack, which security group rule direction controls traffic coming INTO a virtual machine instance?

Accepted Answer

Ingress

Answer

Ingress rules control traffic entering the instance; egress rules control traffic leaving the instance.

Question 5

What is the purpose of the `barbican` service in OpenStack?

Accepted Answer

Provides key management and secrets storage

Answer

Barbican is OpenStack's Key Manager service, used to securely store secrets such as encryption keys, certificates, and passwords.

(COA) Certified OpenStack Administrator Exam Practice Test

(COA) Certified OpenStack Administrator Exam Practice Test

COA Security and Access Control 2