OpenStack OpenStack Identity (Keystone) 1 — Questions and Answers
Question 1: Which OpenStack service provides Identity, Authentication, and Authorization services?
- Nova
- Glance
- Keystone (Correct answer)
- Barbican
Correct answer: Keystone
Keystone is the OpenStack Identity service that provides authentication, authorization, and service catalog functionality.
Question 2: What is a Keystone 'token' used for?
- Encrypting data stored in Swift containers
- A credential issued after authentication that authorizes API requests to OpenStack services (Correct answer)
- A license key for OpenStack commercial support
- A network access control identifier for Neutron
Correct answer: A credential issued after authentication that authorizes API requests to OpenStack services
A Keystone token is a credential that proves a user's identity and authorizes them to make API calls to OpenStack services.
Question 3: What is a Keystone 'project' (formerly 'tenant') in OpenStack?
- A software development project tracked in Launchpad
- An organizational unit that groups resources and users for isolation and quota management (Correct answer)
- A service endpoint registered in the catalog
- A Keystone policy file defining role permissions
Correct answer: An organizational unit that groups resources and users for isolation and quota management
A Keystone project is an isolated organizational container for grouping resources, users, and quotas in OpenStack.
Question 4: Which Keystone token format is the current default and does not require backend validation for each request?
- UUID token
- PKI token
- Fernet token (Correct answer)
- SAML token
Correct answer: Fernet token
Fernet tokens are the current default in OpenStack Keystone; they are lightweight, encrypted, and stateless (no persistence required).
Question 5: What is a Keystone 'role' used for?
- Defining the geographic region where a service is deployed
- Granting permissions to users by assigning named roles within a project (Correct answer)
- Creating a service endpoint for a new OpenStack component
- Setting resource quotas for a specific project
Correct answer: Granting permissions to users by assigning named roles within a project
Keystone roles are named identifiers (e.g., 'admin', 'member') assigned to users within projects to define their permissions.
Question 6: What is the Keystone service catalog?
- A list of all OpenStack services and their API endpoints published to authenticated users (Correct answer)
- A database of registered cloud providers using OpenStack
- An inventory of VM flavors and images available per region
- A list of Keystone policies in YAML format
Correct answer: A list of all OpenStack services and their API endpoints published to authenticated users
The Keystone service catalog lists all available OpenStack services and their API endpoints, returned to clients upon authentication.
OpenStack OpenStack Identity (Keystone) 1
Which OpenStack service provides Identity, Authentication, and Authorization services?