Configure VKS Identity and Access Using External Providers and Kubernetes Admin Credentials VCAP-VCF-VKS Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   After configuring VKS to use an external OIDC provider, an administrator wants to verify that the integration is working correctly before rolling it out to all users. Which action should the administrator take?

   • AVerify that the OIDC client secret is stored in a Kubernetes secret.
   • BCheck the OIDC provider's logs for successful token issuance.
   • CAttempt to authenticate to the cluster using a test user from the OIDC provider and run a kubectl command.
   • DReview the VKS configuration file for the OIDC settings.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A VKS administrator needs to provide break-glass access to a cluster in case the external identity provider is unavailable. What is the recommended approach?

   • AUse a service account token for break-glass access.
   • BConfigure a second OIDC provider as a fallback.
   • CCreate a separate Kubernetes admin credential and store it securely.
   • DDisable the identity provider integration.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which protocol is commonly used by VKS to integrate with an external identity provider for user authentication?

   • AOIDC
   • BRADIUS
   • CKerberos
   • DSAML
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company wants to use Azure AD as an external identity provider for VKS. They have configured the OIDC integration. Which additional configuration is required to ensure that Azure AD groups are available for RBAC mapping?

   • AConfigure the OIDC client to request the 'groups' claim.
   • BCreate a service account in Azure AD for VKS.
   • CEnable the 'email' claim in Azure AD.
   • DInstall the Azure AD Kubernetes RBAC plugin.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A VKS administrator needs to provide a contractor with temporary access to a cluster for a one-week project. The contractor does not have an account in the corporate identity provider. The administrator wants to grant the contractor access without creating a permanent identity. What is the most appropriate action?

   • AConfigure a new OIDC client specifically for the contractor.
   • BCreate a temporary Kubernetes admin credential and revoke it after the project.
   • CCreate a new user in the corporate identity provider and assign RBAC roles.
   • DShare the existing cluster-admin kubeconfig with the contractor.
   Reveal Solution Discussion Select an answer first