COA Security and Access Control 3

Question 1

Which OpenStack service is responsible for auditing and tracking API calls for compliance and security investigation purposes?

Accepted Answer

CADF middleware (PyCADF)

Answer

PyCADF (Cloud Audit Data Federation) middleware generates CADF-compliant audit events for OpenStack API calls.

Question 2

A security engineer wants to ensure that all data stored in Swift object storage is encrypted at rest. Which Swift feature handles server-side encryption?

Accepted Answer

Swift encryption middleware

Answer

Swift's encryption middleware encrypts object data and metadata at rest before writing to disk using keys from Barbican.

Question 3

In Keystone, what is a 'domain' primarily used for in multi-tenant environments?

Accepted Answer

An administrative boundary grouping users and projects

Answer

Keystone domains provide administrative boundaries that contain users, groups, and projects, enabling multi-tenant identity management.

Question 4

Which command would a cloud administrator use to create a new Keystone domain named 'engineering'?

Accepted Answer

openstack domain create engineering

Answer

The `openstack domain create <name>` command creates a new Keystone domain.

Question 5

What is the risk of using 'admin' as a role name in legacy OpenStack policy files with the 'is_admin_project' option disabled?

Accepted Answer

Users with admin role in any project gain cloud-wide administrative privileges

Answer

Without `is_admin_project` enforcement, having the 'admin' role in any project may grant cloud-wide admin access due to legacy policy rules.

(COA) Certified OpenStack Administrator Exam Practice Test

(COA) Certified OpenStack Administrator Exam Practice Test

COA Security and Access Control 3