Exam Bundle

An unapproved service cannot call the protected container while permitted traffic works. This would be relevant evidence for a different failure: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted, usually addressed by Define ingress policies and network segmentation appropriate to application trust boundaries. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.

A modified running container generates a signal even if its original image scan passed. This would be relevant evidence for a different failure: Cloud workload protection monitors only static image scans and misses runtime file modifications, usually addressed by Combine predeployment image checks with appropriate runtime behavioral controls. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.

A pilot records required events with bounded overhead and no unauthorized host modification. This would be relevant evidence for a different failure: An eBPF-based telemetry component requests broad rights without a threat model or resource limit, usually addressed by Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. It does not demonstrate that the current problem at Vantage Travel was resolved. The specific required evidence is: An anomalous child process triggers a workload-linked security event.

Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. That action fits another problem: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. It does not directly remediate the current finding at Northbridge University: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. The relevant corrective control for this case is: Use scoped service accounts and role bindings per namespace and workload.

Add supported runtime behavior monitoring and event correlation for containers or hosts. That action fits another problem: A cloud-native workload has no runtime alert for unexpected process execution after deployment. It does not directly remediate the current finding at Northbridge University: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. The relevant corrective control for this case is: Use scoped service accounts and role bindings per namespace and workload.

Combine predeployment image checks with appropriate runtime behavioral controls. That action fits another problem: Cloud workload protection monitors only static image scans and misses runtime file modifications. It does not directly remediate the current finding at Northbridge University: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. The relevant corrective control for this case is: Use scoped service accounts and role bindings per namespace and workload.

A pilot records required events with bounded overhead and no unauthorized host modification. This would be relevant evidence for a different failure: An eBPF-based telemetry component requests broad rights without a threat model or resource limit, usually addressed by Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. It does not demonstrate that the current problem at Northbridge University was resolved. The specific required evidence is: A pod cannot list protected resources outside its own authorized scope.

A modified running container generates a signal even if its original image scan passed. This would be relevant evidence for a different failure: Cloud workload protection monitors only static image scans and misses runtime file modifications, usually addressed by Combine predeployment image checks with appropriate runtime behavioral controls. It does not demonstrate that the current problem at Northbridge University was resolved. The specific required evidence is: A pod cannot list protected resources outside its own authorized scope.

An anomalous child process triggers a workload-linked security event. This would be relevant evidence for a different failure: A cloud-native workload has no runtime alert for unexpected process execution after deployment, usually addressed by Add supported runtime behavior monitoring and event correlation for containers or hosts. It does not demonstrate that the current problem at Northbridge University was resolved. The specific required evidence is: A pod cannot list protected resources outside its own authorized scope.

Combine predeployment image checks with appropriate runtime behavioral controls. That action fits another problem: Cloud workload protection monitors only static image scans and misses runtime file modifications. It does not directly remediate the current finding at Aspen Digital: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. The relevant corrective control for this case is: Use scoped service accounts and role bindings per namespace and workload.

Define ingress policies and network segmentation appropriate to application trust boundaries. That action fits another problem: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. It does not directly remediate the current finding at Aspen Digital: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. The relevant corrective control for this case is: Use scoped service accounts and role bindings per namespace and workload.

Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. That action fits another problem: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. It does not directly remediate the current finding at Aspen Digital: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. The relevant corrective control for this case is: Use scoped service accounts and role bindings per namespace and workload.

A modified running container generates a signal even if its original image scan passed. This would be relevant evidence for a different failure: Cloud workload protection monitors only static image scans and misses runtime file modifications, usually addressed by Combine predeployment image checks with appropriate runtime behavioral controls. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A pod cannot list protected resources outside its own authorized scope.

An unapproved service cannot call the protected container while permitted traffic works. This would be relevant evidence for a different failure: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted, usually addressed by Define ingress policies and network segmentation appropriate to application trust boundaries. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A pod cannot list protected resources outside its own authorized scope.

A monitored syscall pattern is observed without loading an unreviewed kernel module. This would be relevant evidence for a different failure: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky, usually addressed by Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. It does not demonstrate that the current problem at Aspen Digital was resolved. The specific required evidence is: A pod cannot list protected resources outside its own authorized scope.

Define ingress policies and network segmentation appropriate to application trust boundaries. That action fits another problem: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. It does not directly remediate the current finding at Atlas Scientific: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. The relevant corrective control for this case is: Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions.

Combine predeployment image checks with appropriate runtime behavioral controls. That action fits another problem: Cloud workload protection monitors only static image scans and misses runtime file modifications. It does not directly remediate the current finding at Atlas Scientific: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. The relevant corrective control for this case is: Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions.

Use scoped service accounts and role bindings per namespace and workload. That action fits another problem: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. It does not directly remediate the current finding at Atlas Scientific: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. The relevant corrective control for this case is: Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions.

An unapproved service cannot call the protected container while permitted traffic works. This would be relevant evidence for a different failure: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted, usually addressed by Define ingress policies and network segmentation appropriate to application trust boundaries. It does not demonstrate that the current problem at Atlas Scientific was resolved. The specific required evidence is: A pilot records required events with bounded overhead and no unauthorized host modification.

A pod cannot list protected resources outside its own authorized scope. This would be relevant evidence for a different failure: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges, usually addressed by Use scoped service accounts and role bindings per namespace and workload. It does not demonstrate that the current problem at Atlas Scientific was resolved. The specific required evidence is: A pilot records required events with bounded overhead and no unauthorized host modification.

A modified running container generates a signal even if its original image scan passed. This would be relevant evidence for a different failure: Cloud workload protection monitors only static image scans and misses runtime file modifications, usually addressed by Combine predeployment image checks with appropriate runtime behavioral controls. It does not demonstrate that the current problem at Atlas Scientific was resolved. The specific required evidence is: A pilot records required events with bounded overhead and no unauthorized host modification.

Define ingress policies and network segmentation appropriate to application trust boundaries. That action fits another problem: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. It does not directly remediate the current finding at Orion Network Services: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. The relevant corrective control for this case is: Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions.

Apply least-privilege container runtime security and restrict host mounts and capabilities. That action fits another problem: A workload has root-level container privileges and can access sensitive host paths unnecessarily. It does not directly remediate the current finding at Orion Network Services: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. The relevant corrective control for this case is: Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions.

Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. That action fits another problem: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. It does not directly remediate the current finding at Orion Network Services: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. The relevant corrective control for this case is: Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions.

A container escape attempt cannot access protected host files and the app still functions. This would be relevant evidence for a different failure: A workload has root-level container privileges and can access sensitive host paths unnecessarily, usually addressed by Apply least-privilege container runtime security and restrict host mounts and capabilities. It does not demonstrate that the current problem at Orion Network Services was resolved. The specific required evidence is: A pilot records required events with bounded overhead and no unauthorized host modification.

An unapproved service cannot call the protected container while permitted traffic works. This would be relevant evidence for a different failure: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted, usually addressed by Define ingress policies and network segmentation appropriate to application trust boundaries. It does not demonstrate that the current problem at Orion Network Services was resolved. The specific required evidence is: A pilot records required events with bounded overhead and no unauthorized host modification.

A monitored syscall pattern is observed without loading an unreviewed kernel module. This would be relevant evidence for a different failure: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky, usually addressed by Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. It does not demonstrate that the current problem at Orion Network Services was resolved. The specific required evidence is: A pilot records required events with bounded overhead and no unauthorized host modification.

Define ingress policies and network segmentation appropriate to application trust boundaries. That action fits another problem: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. It does not directly remediate the current finding at Briarwood Property Group: Cloud workload protection monitors only static image scans and misses runtime file modifications. The relevant corrective control for this case is: Combine predeployment image checks with appropriate runtime behavioral controls.

Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. That action fits another problem: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. It does not directly remediate the current finding at Briarwood Property Group: Cloud workload protection monitors only static image scans and misses runtime file modifications. The relevant corrective control for this case is: Combine predeployment image checks with appropriate runtime behavioral controls.

Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. That action fits another problem: An eBPF-based telemetry component requests broad rights without a threat model or resource limit. It does not directly remediate the current finding at Briarwood Property Group: Cloud workload protection monitors only static image scans and misses runtime file modifications. The relevant corrective control for this case is: Combine predeployment image checks with appropriate runtime behavioral controls.

An unapproved service cannot call the protected container while permitted traffic works. This would be relevant evidence for a different failure: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted, usually addressed by Define ingress policies and network segmentation appropriate to application trust boundaries. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.

A monitored syscall pattern is observed without loading an unreviewed kernel module. This would be relevant evidence for a different failure: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky, usually addressed by Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.

A pilot records required events with bounded overhead and no unauthorized host modification. This would be relevant evidence for a different failure: An eBPF-based telemetry component requests broad rights without a threat model or resource limit, usually addressed by Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.