COA Security and Access Control 1 — Questions and Answers
Question 1: Which OpenStack service handles authentication and authorization?
- Nova
- Neutron
- Keystone (Correct answer)
- Horizon
Correct answer: Keystone
Keystone is the central identity service for OpenStack, responsible for managing user authentication and authorization across all services. It verifies user credentials and determines what resources and actions a user is permitted to access based on their assigned roles and projects.
Question 2: What are OpenStack roles used for?
- Assign floating IPs
- Limit storage usage
- Control user permissions (Correct answer)
- Configure routing tables
Correct answer: Control user permissions
In OpenStack, roles are used to define a set of permissions that can be assigned to users within specific projects (tenants). By assigning roles, administrators can control what actions users are authorized to perform and what resources they can access, implementing granular access control.
Question 3: What is the purpose of security groups in OpenStack?
- Monitor CPU usage
- Provide DNS resolution
- Control network access (Correct answer)
- Schedule instance backups
Correct answer: Control network access
Security groups in OpenStack act as virtual firewalls for instances, controlling inbound and outbound network traffic. They define rules that specify which ports, protocols, and IP addresses are allowed to communicate with an instance, enhancing network security by filtering unwanted connections.
Question 4: How can you prevent unauthorized API access in OpenStack?
- Disable firewall
- Enable root login
- Require Keystone authentication (Correct answer)
- Open all ports
Correct answer: Require Keystone authentication
Keystone is the identity service that authenticates all API requests to OpenStack services. By requiring Keystone authentication, every interaction with the OpenStack API must be accompanied by a valid token issued by Keystone, ensuring that only authorized users or services can access and manipulate cloud resources.
Question 5: Which component is used to assign user roles in OpenStack?
- Horizon
- Neutron
- Keystone (Correct answer)
- Cinder
Correct answer: Keystone
Keystone is OpenStack's identity service, responsible for providing authentication and authorization for all OpenStack components. It manages users, projects (tenants), and roles, making it the central component for assigning and controlling user access and permissions within the cloud environment.
Question 6: What is a project in OpenStack security context?
- A backup container
- A DNS zone
- An isolated group for user access and resources (Correct answer)
- A scheduled snapshot
Correct answer: An isolated group for user access and resources
In OpenStack, a project (also known as a tenant) serves as a fundamental unit for organizing and isolating resources. It provides a secure container where users can deploy and manage their virtual machines, networks, and storage, ensuring that resources and access are segregated from other projects. This isolation is crucial for multi-tenant cloud environments.
COA Security and Access Control 1
Which OpenStack service handles authentication and authorization?