Exam Bundle

An unapproved service cannot call the protected container while permitted traffic works. This would be relevant evidence for a different failure: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted, usually addressed by Define ingress policies and network segmentation appropriate to application trust boundaries. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: A monitored syscall pattern is observed without loading an unreviewed kernel module.

A container escape attempt cannot access protected host files and the app still functions. This would be relevant evidence for a different failure: A workload has root-level container privileges and can access sensitive host paths unnecessarily, usually addressed by Apply least-privilege container runtime security and restrict host mounts and capabilities. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: A monitored syscall pattern is observed without loading an unreviewed kernel module.

An anomalous child process triggers a workload-linked security event. This would be relevant evidence for a different failure: A cloud-native workload has no runtime alert for unexpected process execution after deployment, usually addressed by Add supported runtime behavior monitoring and event correlation for containers or hosts. It does not demonstrate that the current problem at Elmwood Manufacturing was resolved. The specific required evidence is: A monitored syscall pattern is observed without loading an unreviewed kernel module.

Use scoped service accounts and role bindings per namespace and workload. That action fits another problem: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. It does not directly remediate the current finding at Linden Manufacturing: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. The relevant corrective control for this case is: Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections.

Add supported runtime behavior monitoring and event correlation for containers or hosts. That action fits another problem: A cloud-native workload has no runtime alert for unexpected process execution after deployment. It does not directly remediate the current finding at Linden Manufacturing: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. The relevant corrective control for this case is: Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections.

Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. That action fits another problem: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. It does not directly remediate the current finding at Linden Manufacturing: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. The relevant corrective control for this case is: Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections.

A pilot records required events with bounded overhead and no unauthorized host modification. This would be relevant evidence for a different failure: An eBPF-based telemetry component requests broad rights without a threat model or resource limit, usually addressed by Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A monitored syscall pattern is observed without loading an unreviewed kernel module.

An anomalous child process triggers a workload-linked security event. This would be relevant evidence for a different failure: A cloud-native workload has no runtime alert for unexpected process execution after deployment, usually addressed by Add supported runtime behavior monitoring and event correlation for containers or hosts. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A monitored syscall pattern is observed without loading an unreviewed kernel module.

A pod cannot list protected resources outside its own authorized scope. This would be relevant evidence for a different failure: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges, usually addressed by Use scoped service accounts and role bindings per namespace and workload. It does not demonstrate that the current problem at Linden Manufacturing was resolved. The specific required evidence is: A monitored syscall pattern is observed without loading an unreviewed kernel module.

Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. That action fits another problem: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. It does not directly remediate the current finding at Harbor Retail: A workload has root-level container privileges and can access sensitive host paths unnecessarily. The relevant corrective control for this case is: Apply least-privilege container runtime security and restrict host mounts and capabilities.

Add supported runtime behavior monitoring and event correlation for containers or hosts. That action fits another problem: A cloud-native workload has no runtime alert for unexpected process execution after deployment. It does not directly remediate the current finding at Harbor Retail: A workload has root-level container privileges and can access sensitive host paths unnecessarily. The relevant corrective control for this case is: Apply least-privilege container runtime security and restrict host mounts and capabilities.

Use scoped service accounts and role bindings per namespace and workload. That action fits another problem: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. It does not directly remediate the current finding at Harbor Retail: A workload has root-level container privileges and can access sensitive host paths unnecessarily. The relevant corrective control for this case is: Apply least-privilege container runtime security and restrict host mounts and capabilities.

An anomalous child process triggers a workload-linked security event. This would be relevant evidence for a different failure: A cloud-native workload has no runtime alert for unexpected process execution after deployment, usually addressed by Add supported runtime behavior monitoring and event correlation for containers or hosts. It does not demonstrate that the current problem at Harbor Retail was resolved. The specific required evidence is: A container escape attempt cannot access protected host files and the app still functions.

A monitored syscall pattern is observed without loading an unreviewed kernel module. This would be relevant evidence for a different failure: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky, usually addressed by Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. It does not demonstrate that the current problem at Harbor Retail was resolved. The specific required evidence is: A container escape attempt cannot access protected host files and the app still functions.

A pod cannot list protected resources outside its own authorized scope. This would be relevant evidence for a different failure: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges, usually addressed by Use scoped service accounts and role bindings per namespace and workload. It does not demonstrate that the current problem at Harbor Retail was resolved. The specific required evidence is: A container escape attempt cannot access protected host files and the app still functions.

Use scoped service accounts and role bindings per namespace and workload. That action fits another problem: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. It does not directly remediate the current finding at Evermere Health: A workload has root-level container privileges and can access sensitive host paths unnecessarily. The relevant corrective control for this case is: Apply least-privilege container runtime security and restrict host mounts and capabilities.

Combine predeployment image checks with appropriate runtime behavioral controls. That action fits another problem: Cloud workload protection monitors only static image scans and misses runtime file modifications. It does not directly remediate the current finding at Evermere Health: A workload has root-level container privileges and can access sensitive host paths unnecessarily. The relevant corrective control for this case is: Apply least-privilege container runtime security and restrict host mounts and capabilities.

Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. That action fits another problem: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. It does not directly remediate the current finding at Evermere Health: A workload has root-level container privileges and can access sensitive host paths unnecessarily. The relevant corrective control for this case is: Apply least-privilege container runtime security and restrict host mounts and capabilities.

A pilot records required events with bounded overhead and no unauthorized host modification. This would be relevant evidence for a different failure: An eBPF-based telemetry component requests broad rights without a threat model or resource limit, usually addressed by Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: A container escape attempt cannot access protected host files and the app still functions.

A pod cannot list protected resources outside its own authorized scope. This would be relevant evidence for a different failure: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges, usually addressed by Use scoped service accounts and role bindings per namespace and workload. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: A container escape attempt cannot access protected host files and the app still functions.

A modified running container generates a signal even if its original image scan passed. This would be relevant evidence for a different failure: Cloud workload protection monitors only static image scans and misses runtime file modifications, usually addressed by Combine predeployment image checks with appropriate runtime behavioral controls. It does not demonstrate that the current problem at Evermere Health was resolved. The specific required evidence is: A container escape attempt cannot access protected host files and the app still functions.

Use scoped service accounts and role bindings per namespace and workload. That action fits another problem: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. It does not directly remediate the current finding at Cedar City Utilities: A cloud-native workload has no runtime alert for unexpected process execution after deployment. The relevant corrective control for this case is: Add supported runtime behavior monitoring and event correlation for containers or hosts.

Apply least-privilege container runtime security and restrict host mounts and capabilities. That action fits another problem: A workload has root-level container privileges and can access sensitive host paths unnecessarily. It does not directly remediate the current finding at Cedar City Utilities: A cloud-native workload has no runtime alert for unexpected process execution after deployment. The relevant corrective control for this case is: Add supported runtime behavior monitoring and event correlation for containers or hosts.

Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. That action fits another problem: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. It does not directly remediate the current finding at Cedar City Utilities: A cloud-native workload has no runtime alert for unexpected process execution after deployment. The relevant corrective control for this case is: Add supported runtime behavior monitoring and event correlation for containers or hosts.

A pod cannot list protected resources outside its own authorized scope. This would be relevant evidence for a different failure: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges, usually addressed by Use scoped service accounts and role bindings per namespace and workload. It does not demonstrate that the current problem at Cedar City Utilities was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.

A pilot records required events with bounded overhead and no unauthorized host modification. This would be relevant evidence for a different failure: An eBPF-based telemetry component requests broad rights without a threat model or resource limit, usually addressed by Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. It does not demonstrate that the current problem at Cedar City Utilities was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.

A container escape attempt cannot access protected host files and the app still functions. This would be relevant evidence for a different failure: A workload has root-level container privileges and can access sensitive host paths unnecessarily, usually addressed by Apply least-privilege container runtime security and restrict host mounts and capabilities. It does not demonstrate that the current problem at Cedar City Utilities was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.

Define ingress policies and network segmentation appropriate to application trust boundaries. That action fits another problem: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. It does not directly remediate the current finding at Vantage Travel: A cloud-native workload has no runtime alert for unexpected process execution after deployment. The relevant corrective control for this case is: Add supported runtime behavior monitoring and event correlation for containers or hosts.

Combine predeployment image checks with appropriate runtime behavioral controls. That action fits another problem: Cloud workload protection monitors only static image scans and misses runtime file modifications. It does not directly remediate the current finding at Vantage Travel: A cloud-native workload has no runtime alert for unexpected process execution after deployment. The relevant corrective control for this case is: Add supported runtime behavior monitoring and event correlation for containers or hosts.

Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. That action fits another problem: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. It does not directly remediate the current finding at Vantage Travel: A cloud-native workload has no runtime alert for unexpected process execution after deployment. The relevant corrective control for this case is: Add supported runtime behavior monitoring and event correlation for containers or hosts.

An unapproved service cannot call the protected container while permitted traffic works. This would be relevant evidence for a different failure: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted, usually addressed by Define ingress policies and network segmentation appropriate to application trust boundaries. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.

A modified running container generates a signal even if its original image scan passed. This would be relevant evidence for a different failure: Cloud workload protection monitors only static image scans and misses runtime file modifications, usually addressed by Combine predeployment image checks with appropriate runtime behavioral controls. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.

A pilot records required events with bounded overhead and no unauthorized host modification. This would be relevant evidence for a different failure: An eBPF-based telemetry component requests broad rights without a threat model or resource limit, usually addressed by Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.