Exam Bundle

An unapproved service cannot call the protected container while permitted traffic works. This would be relevant evidence for a different failure: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted, usually addressed by Define ingress policies and network segmentation appropriate to application trust boundaries. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.

A monitored syscall pattern is observed without loading an unreviewed kernel module. This would be relevant evidence for a different failure: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky, usually addressed by Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.

A pilot records required events with bounded overhead and no unauthorized host modification. This would be relevant evidence for a different failure: An eBPF-based telemetry component requests broad rights without a threat model or resource limit, usually addressed by Validate sensor provenance, kernel compatibility, data sensitivity, and controlled deployment permissions. It does not demonstrate that the current problem at Briarwood Property Group was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.

Add supported runtime behavior monitoring and event correlation for containers or hosts. That action fits another problem: A cloud-native workload has no runtime alert for unexpected process execution after deployment. It does not directly remediate the current finding at Arborstone Tech: Cloud workload protection monitors only static image scans and misses runtime file modifications. The relevant corrective control for this case is: Combine predeployment image checks with appropriate runtime behavioral controls.

Apply least-privilege container runtime security and restrict host mounts and capabilities. That action fits another problem: A workload has root-level container privileges and can access sensitive host paths unnecessarily. It does not directly remediate the current finding at Arborstone Tech: Cloud workload protection monitors only static image scans and misses runtime file modifications. The relevant corrective control for this case is: Combine predeployment image checks with appropriate runtime behavioral controls.

Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. That action fits another problem: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. It does not directly remediate the current finding at Arborstone Tech: Cloud workload protection monitors only static image scans and misses runtime file modifications. The relevant corrective control for this case is: Combine predeployment image checks with appropriate runtime behavioral controls.

An anomalous child process triggers a workload-linked security event. This would be relevant evidence for a different failure: A cloud-native workload has no runtime alert for unexpected process execution after deployment, usually addressed by Add supported runtime behavior monitoring and event correlation for containers or hosts. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.

A monitored syscall pattern is observed without loading an unreviewed kernel module. This would be relevant evidence for a different failure: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky, usually addressed by Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.

A container escape attempt cannot access protected host files and the app still functions. This would be relevant evidence for a different failure: A workload has root-level container privileges and can access sensitive host paths unnecessarily, usually addressed by Apply least-privilege container runtime security and restrict host mounts and capabilities. It does not demonstrate that the current problem at Arborstone Tech was resolved. The specific required evidence is: A modified running container generates a signal even if its original image scan passed.

Apply least-privilege container runtime security and restrict host mounts and capabilities. That action fits another problem: A workload has root-level container privileges and can access sensitive host paths unnecessarily. It does not directly remediate the current finding at Sapphire Data Systems: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. The relevant corrective control for this case is: Define ingress policies and network segmentation appropriate to application trust boundaries.

Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. That action fits another problem: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky. It does not directly remediate the current finding at Sapphire Data Systems: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. The relevant corrective control for this case is: Define ingress policies and network segmentation appropriate to application trust boundaries.

Combine predeployment image checks with appropriate runtime behavioral controls. That action fits another problem: Cloud workload protection monitors only static image scans and misses runtime file modifications. It does not directly remediate the current finding at Sapphire Data Systems: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. The relevant corrective control for this case is: Define ingress policies and network segmentation appropriate to application trust boundaries.

A container escape attempt cannot access protected host files and the app still functions. This would be relevant evidence for a different failure: A workload has root-level container privileges and can access sensitive host paths unnecessarily, usually addressed by Apply least-privilege container runtime security and restrict host mounts and capabilities. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: An unapproved service cannot call the protected container while permitted traffic works.

A modified running container generates a signal even if its original image scan passed. This would be relevant evidence for a different failure: Cloud workload protection monitors only static image scans and misses runtime file modifications, usually addressed by Combine predeployment image checks with appropriate runtime behavioral controls. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: An unapproved service cannot call the protected container while permitted traffic works.

A monitored syscall pattern is observed without loading an unreviewed kernel module. This would be relevant evidence for a different failure: A container security agent needs kernel-event visibility but introducing a new custom kernel module is operationally risky, usually addressed by Evaluate supported eBPF instrumentation with appropriate privileges and verifier protections. It does not demonstrate that the current problem at Sapphire Data Systems was resolved. The specific required evidence is: An unapproved service cannot call the protected container while permitted traffic works.

Apply least-privilege container runtime security and restrict host mounts and capabilities. That action fits another problem: A workload has root-level container privileges and can access sensitive host paths unnecessarily. It does not directly remediate the current finding at Eastport Research Hospital: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. The relevant corrective control for this case is: Define ingress policies and network segmentation appropriate to application trust boundaries.

Add supported runtime behavior monitoring and event correlation for containers or hosts. That action fits another problem: A cloud-native workload has no runtime alert for unexpected process execution after deployment. It does not directly remediate the current finding at Eastport Research Hospital: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. The relevant corrective control for this case is: Define ingress policies and network segmentation appropriate to application trust boundaries.

Use scoped service accounts and role bindings per namespace and workload. That action fits another problem: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges. It does not directly remediate the current finding at Eastport Research Hospital: A container orchestrator leaves external ingress and internal service-to-service traffic unrestricted. The relevant corrective control for this case is: Define ingress policies and network segmentation appropriate to application trust boundaries.

A pod cannot list protected resources outside its own authorized scope. This would be relevant evidence for a different failure: A Kubernetes service account is reused by every namespace, granting workloads unnecessary API privileges, usually addressed by Use scoped service accounts and role bindings per namespace and workload. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: An unapproved service cannot call the protected container while permitted traffic works.

A container escape attempt cannot access protected host files and the app still functions. This would be relevant evidence for a different failure: A workload has root-level container privileges and can access sensitive host paths unnecessarily, usually addressed by Apply least-privilege container runtime security and restrict host mounts and capabilities. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: An unapproved service cannot call the protected container while permitted traffic works.

An anomalous child process triggers a workload-linked security event. This would be relevant evidence for a different failure: A cloud-native workload has no runtime alert for unexpected process execution after deployment, usually addressed by Add supported runtime behavior monitoring and event correlation for containers or hosts. It does not demonstrate that the current problem at Eastport Research Hospital was resolved. The specific required evidence is: An unapproved service cannot call the protected container while permitted traffic works.

Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. That action fits another problem: Container images are deployed without vulnerability or provenance checks from external registries. It does not directly remediate the current finding at Frostline Distribution: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. The relevant corrective control for this case is: Add infrastructure-as-code static checks and policy gates before applying changes.

Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. That action fits another problem: Build pipelines store production credentials as plaintext variables visible to all developers. It does not directly remediate the current finding at Frostline Distribution: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. The relevant corrective control for this case is: Add infrastructure-as-code static checks and policy gates before applying changes.

Constrain admission and orchestration RBAC by workload and task with reviewable changes. That action fits another problem: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. It does not directly remediate the current finding at Frostline Distribution: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. The relevant corrective control for this case is: Add infrastructure-as-code static checks and policy gates before applying changes.

A known vulnerable or unsigned image is rejected before it reaches production. This would be relevant evidence for a different failure: Container images are deployed without vulnerability or provenance checks from external registries, usually addressed by Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.

A compromised application pod cannot modify cluster admission controls. This would be relevant evidence for a different failure: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting, usually addressed by Constrain admission and orchestration RBAC by workload and task with reviewable changes. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.

Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds. This would be relevant evidence for a different failure: Build pipelines store production credentials as plaintext variables visible to all developers, usually addressed by Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. It does not demonstrate that the current problem at Frostline Distribution was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.

Add staged security, integration, and policy validation gates before high-impact deployment. That action fits another problem: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. It does not directly remediate the current finding at Aster Mutual: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. The relevant corrective control for this case is: Add infrastructure-as-code static checks and policy gates before applying changes.

Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. That action fits another problem: Container images are deployed without vulnerability or provenance checks from external registries. It does not directly remediate the current finding at Aster Mutual: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. The relevant corrective control for this case is: Add infrastructure-as-code static checks and policy gates before applying changes.

Use dependency and software bill-of-materials checks with approved remediation policies. That action fits another problem: A software team treats dependencies as trusted and never reviews updates before production promotion. It does not directly remediate the current finding at Aster Mutual: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. The relevant corrective control for this case is: Add infrastructure-as-code static checks and policy gates before applying changes.

A known vulnerable or unsigned image is rejected before it reaches production. This would be relevant evidence for a different failure: Container images are deployed without vulnerability or provenance checks from external registries, usually addressed by Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.

A flagged dependency version stops promotion until the issue is addressed or approved. This would be relevant evidence for a different failure: A software team treats dependencies as trusted and never reviews updates before production promotion, usually addressed by Use dependency and software bill-of-materials checks with approved remediation policies. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.

A failed security regression prevents production promotion while a passing release is auditable. This would be relevant evidence for a different failure: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing, usually addressed by Add staged security, integration, and policy validation gates before high-impact deployment. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.