Exam Bundle

A known vulnerable or unsigned image is rejected before it reaches production. This would be relevant evidence for a different failure: Container images are deployed without vulnerability or provenance checks from external registries, usually addressed by Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.

A flagged dependency version stops promotion until the issue is addressed or approved. This would be relevant evidence for a different failure: A software team treats dependencies as trusted and never reviews updates before production promotion, usually addressed by Use dependency and software bill-of-materials checks with approved remediation policies. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.

A failed security regression prevents production promotion while a passing release is auditable. This would be relevant evidence for a different failure: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing, usually addressed by Add staged security, integration, and policy validation gates before high-impact deployment. It does not demonstrate that the current problem at Aster Mutual was resolved. The specific required evidence is: A test policy violation blocks the infrastructure deployment while compliant changes pass.

Use dependency and software bill-of-materials checks with approved remediation policies. That action fits another problem: A software team treats dependencies as trusted and never reviews updates before production promotion. It does not directly remediate the current finding at Horizon Energy Services: Build pipelines store production credentials as plaintext variables visible to all developers. The relevant corrective control for this case is: Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions.

Add infrastructure-as-code static checks and policy gates before applying changes. That action fits another problem: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. It does not directly remediate the current finding at Horizon Energy Services: Build pipelines store production credentials as plaintext variables visible to all developers. The relevant corrective control for this case is: Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions.

Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. That action fits another problem: Container images are deployed without vulnerability or provenance checks from external registries. It does not directly remediate the current finding at Horizon Energy Services: Build pipelines store production credentials as plaintext variables visible to all developers. The relevant corrective control for this case is: Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions.

A test policy violation blocks the infrastructure deployment while compliant changes pass. This would be relevant evidence for a different failure: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline, usually addressed by Add infrastructure-as-code static checks and policy gates before applying changes. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds.

A known vulnerable or unsigned image is rejected before it reaches production. This would be relevant evidence for a different failure: Container images are deployed without vulnerability or provenance checks from external registries, usually addressed by Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds.

A flagged dependency version stops promotion until the issue is addressed or approved. This would be relevant evidence for a different failure: A software team treats dependencies as trusted and never reviews updates before production promotion, usually addressed by Use dependency and software bill-of-materials checks with approved remediation policies. It does not demonstrate that the current problem at Horizon Energy Services was resolved. The specific required evidence is: Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds.

Constrain admission and orchestration RBAC by workload and task with reviewable changes. That action fits another problem: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. It does not directly remediate the current finding at Newbridge Charity: Build pipelines store production credentials as plaintext variables visible to all developers. The relevant corrective control for this case is: Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions.

Add staged security, integration, and policy validation gates before high-impact deployment. That action fits another problem: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. It does not directly remediate the current finding at Newbridge Charity: Build pipelines store production credentials as plaintext variables visible to all developers. The relevant corrective control for this case is: Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions.

Use dependency and software bill-of-materials checks with approved remediation policies. That action fits another problem: A software team treats dependencies as trusted and never reviews updates before production promotion. It does not directly remediate the current finding at Newbridge Charity: Build pipelines store production credentials as plaintext variables visible to all developers. The relevant corrective control for this case is: Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions.

A compromised application pod cannot modify cluster admission controls. This would be relevant evidence for a different failure: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting, usually addressed by Constrain admission and orchestration RBAC by workload and task with reviewable changes. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds.

A flagged dependency version stops promotion until the issue is addressed or approved. This would be relevant evidence for a different failure: A software team treats dependencies as trusted and never reviews updates before production promotion, usually addressed by Use dependency and software bill-of-materials checks with approved remediation policies. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds.

A failed security regression prevents production promotion while a passing release is auditable. This would be relevant evidence for a different failure: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing, usually addressed by Add staged security, integration, and policy validation gates before high-impact deployment. It does not demonstrate that the current problem at Newbridge Charity was resolved. The specific required evidence is: Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds.

Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. That action fits another problem: Build pipelines store production credentials as plaintext variables visible to all developers. It does not directly remediate the current finding at Harbor Point Medical: Container images are deployed without vulnerability or provenance checks from external registries. The relevant corrective control for this case is: Enforce image scanning, signed provenance, and approved registry rules at build or admission gates.

Use dependency and software bill-of-materials checks with approved remediation policies. That action fits another problem: A software team treats dependencies as trusted and never reviews updates before production promotion. It does not directly remediate the current finding at Harbor Point Medical: Container images are deployed without vulnerability or provenance checks from external registries. The relevant corrective control for this case is: Enforce image scanning, signed provenance, and approved registry rules at build or admission gates.

Add staged security, integration, and policy validation gates before high-impact deployment. That action fits another problem: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. It does not directly remediate the current finding at Harbor Point Medical: Container images are deployed without vulnerability or provenance checks from external registries. The relevant corrective control for this case is: Enforce image scanning, signed provenance, and approved registry rules at build or admission gates.

A flagged dependency version stops promotion until the issue is addressed or approved. This would be relevant evidence for a different failure: A software team treats dependencies as trusted and never reviews updates before production promotion, usually addressed by Use dependency and software bill-of-materials checks with approved remediation policies. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: A known vulnerable or unsigned image is rejected before it reaches production.

A failed security regression prevents production promotion while a passing release is auditable. This would be relevant evidence for a different failure: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing, usually addressed by Add staged security, integration, and policy validation gates before high-impact deployment. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: A known vulnerable or unsigned image is rejected before it reaches production.

Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds. This would be relevant evidence for a different failure: Build pipelines store production credentials as plaintext variables visible to all developers, usually addressed by Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. It does not demonstrate that the current problem at Harbor Point Medical was resolved. The specific required evidence is: A known vulnerable or unsigned image is rejected before it reaches production.

Constrain admission and orchestration RBAC by workload and task with reviewable changes. That action fits another problem: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. It does not directly remediate the current finding at Clearbrook University: Container images are deployed without vulnerability or provenance checks from external registries. The relevant corrective control for this case is: Enforce image scanning, signed provenance, and approved registry rules at build or admission gates.

Add staged security, integration, and policy validation gates before high-impact deployment. That action fits another problem: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. It does not directly remediate the current finding at Clearbrook University: Container images are deployed without vulnerability or provenance checks from external registries. The relevant corrective control for this case is: Enforce image scanning, signed provenance, and approved registry rules at build or admission gates.

Add infrastructure-as-code static checks and policy gates before applying changes. That action fits another problem: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. It does not directly remediate the current finding at Clearbrook University: Container images are deployed without vulnerability or provenance checks from external registries. The relevant corrective control for this case is: Enforce image scanning, signed provenance, and approved registry rules at build or admission gates.

A test policy violation blocks the infrastructure deployment while compliant changes pass. This would be relevant evidence for a different failure: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline, usually addressed by Add infrastructure-as-code static checks and policy gates before applying changes. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: A known vulnerable or unsigned image is rejected before it reaches production.

A compromised application pod cannot modify cluster admission controls. This would be relevant evidence for a different failure: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting, usually addressed by Constrain admission and orchestration RBAC by workload and task with reviewable changes. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: A known vulnerable or unsigned image is rejected before it reaches production.

A failed security regression prevents production promotion while a passing release is auditable. This would be relevant evidence for a different failure: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing, usually addressed by Add staged security, integration, and policy validation gates before high-impact deployment. It does not demonstrate that the current problem at Clearbrook University was resolved. The specific required evidence is: A known vulnerable or unsigned image is rejected before it reaches production.

Add staged security, integration, and policy validation gates before high-impact deployment. That action fits another problem: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. It does not directly remediate the current finding at Oceanview Payments: A software team treats dependencies as trusted and never reviews updates before production promotion. The relevant corrective control for this case is: Use dependency and software bill-of-materials checks with approved remediation policies.

Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. That action fits another problem: Container images are deployed without vulnerability or provenance checks from external registries. It does not directly remediate the current finding at Oceanview Payments: A software team treats dependencies as trusted and never reviews updates before production promotion. The relevant corrective control for this case is: Use dependency and software bill-of-materials checks with approved remediation policies.

Constrain admission and orchestration RBAC by workload and task with reviewable changes. That action fits another problem: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. It does not directly remediate the current finding at Oceanview Payments: A software team treats dependencies as trusted and never reviews updates before production promotion. The relevant corrective control for this case is: Use dependency and software bill-of-materials checks with approved remediation policies.

A known vulnerable or unsigned image is rejected before it reaches production. This would be relevant evidence for a different failure: Container images are deployed without vulnerability or provenance checks from external registries, usually addressed by Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.

A failed security regression prevents production promotion while a passing release is auditable. This would be relevant evidence for a different failure: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing, usually addressed by Add staged security, integration, and policy validation gates before high-impact deployment. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.

A compromised application pod cannot modify cluster admission controls. This would be relevant evidence for a different failure: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting, usually addressed by Constrain admission and orchestration RBAC by workload and task with reviewable changes. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.