COA Security and Access Control 3 — Questions and Answers
Question 1: Which OpenStack service is responsible for auditing and tracking API calls for compliance and security investigation purposes?
- Ceilometer
- Panko
- CADF middleware (PyCADF) (Correct answer)
- Congress
Correct answer: CADF middleware (PyCADF)
PyCADF (Cloud Audit Data Federation) middleware generates CADF-compliant audit events for OpenStack API calls.
Question 2: A security engineer wants to ensure that all data stored in Swift object storage is encrypted at rest. Which Swift feature handles server-side encryption?
- Swift ACLs
- Swift encryption middleware (Correct answer)
- Swift CORS policy
- Swift rate limiting
Correct answer: Swift encryption middleware
Swift's encryption middleware encrypts object data and metadata at rest before writing to disk using keys from Barbican.
Question 3: In Keystone, what is a 'domain' primarily used for in multi-tenant environments?
- A DNS zone for instances
- An administrative boundary grouping users and projects (Correct answer)
- A network segment for traffic isolation
- A geographic region for resource placement
Correct answer: An administrative boundary grouping users and projects
Keystone domains provide administrative boundaries that contain users, groups, and projects, enabling multi-tenant identity management.
Question 4: Which command would a cloud administrator use to create a new Keystone domain named 'engineering'?
- openstack domain add engineering
- openstack domain create engineering (Correct answer)
- openstack project domain-create --name engineering
- keystone-manage domain-setup engineering
Correct answer: openstack domain create engineering
The `openstack domain create <name>` command creates a new Keystone domain.
Question 5: What is the risk of using 'admin' as a role name in legacy OpenStack policy files with the 'is_admin_project' option disabled?
- Users with admin role in any project gain cloud-wide administrative privileges (Correct answer)
- The admin role becomes invisible to other projects
- Service tokens are rejected by the identity API
- Fernet token rotation stops working
Correct answer: Users with admin role in any project gain cloud-wide administrative privileges
Without `is_admin_project` enforcement, having the 'admin' role in any project may grant cloud-wide admin access due to legacy policy rules.
Question 6: Which Nova feature allows an administrator to isolate specific compute hosts so that only designated tenants can schedule instances on them?
- Host aggregates with metadata filters (Correct answer)
- Availability zones only
- Security groups per host
- Nova cells v2 partitioning
Correct answer: Host aggregates with metadata filters
Host aggregates with AggregateInstanceExtraSpecsFilter allow administrators to restrict instance scheduling to specific hosts based on tenant metadata.
Question 7: An operator discovers that a Keystone service account token has been compromised. What is the FASTEST way to immediately invalidate all tokens for that user?
- Delete and recreate the service account
- Rotate the Fernet keys using keystone-manage fernet_rotate
- Revoke the user's tokens with openstack user set --disable (Correct answer)
- Wait for the token TTL to expire naturally
Correct answer: Revoke the user's tokens with openstack user set --disable
Disabling the user with `openstack user set --disable` immediately prevents new authentications and causes existing tokens to be rejected at validation.
COA Security and Access Control 3
Which OpenStack service is responsible for auditing and tracking API calls for compliance and security investigation purposes?