Exam Bundle

A known vulnerable or unsigned image is rejected before it reaches production. This would be relevant evidence for a different failure: Container images are deployed without vulnerability or provenance checks from external registries, usually addressed by Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.

A failed security regression prevents production promotion while a passing release is auditable. This would be relevant evidence for a different failure: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing, usually addressed by Add staged security, integration, and policy validation gates before high-impact deployment. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.

A compromised application pod cannot modify cluster admission controls. This would be relevant evidence for a different failure: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting, usually addressed by Constrain admission and orchestration RBAC by workload and task with reviewable changes. It does not demonstrate that the current problem at Oceanview Payments was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.

Add infrastructure-as-code static checks and policy gates before applying changes. That action fits another problem: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. It does not directly remediate the current finding at Bluewater Technology: A software team treats dependencies as trusted and never reviews updates before production promotion. The relevant corrective control for this case is: Use dependency and software bill-of-materials checks with approved remediation policies.

Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. That action fits another problem: Build pipelines store production credentials as plaintext variables visible to all developers. It does not directly remediate the current finding at Bluewater Technology: A software team treats dependencies as trusted and never reviews updates before production promotion. The relevant corrective control for this case is: Use dependency and software bill-of-materials checks with approved remediation policies.

Constrain admission and orchestration RBAC by workload and task with reviewable changes. That action fits another problem: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. It does not directly remediate the current finding at Bluewater Technology: A software team treats dependencies as trusted and never reviews updates before production promotion. The relevant corrective control for this case is: Use dependency and software bill-of-materials checks with approved remediation policies.

A compromised application pod cannot modify cluster admission controls. This would be relevant evidence for a different failure: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting, usually addressed by Constrain admission and orchestration RBAC by workload and task with reviewable changes. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.

A test policy violation blocks the infrastructure deployment while compliant changes pass. This would be relevant evidence for a different failure: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline, usually addressed by Add infrastructure-as-code static checks and policy gates before applying changes. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.

Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds. This would be relevant evidence for a different failure: Build pipelines store production credentials as plaintext variables visible to all developers, usually addressed by Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. It does not demonstrate that the current problem at Bluewater Technology was resolved. The specific required evidence is: A flagged dependency version stops promotion until the issue is addressed or approved.

Constrain admission and orchestration RBAC by workload and task with reviewable changes. That action fits another problem: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. It does not directly remediate the current finding at Ridgeview Finance: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. The relevant corrective control for this case is: Add staged security, integration, and policy validation gates before high-impact deployment.

Add infrastructure-as-code static checks and policy gates before applying changes. That action fits another problem: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. It does not directly remediate the current finding at Ridgeview Finance: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. The relevant corrective control for this case is: Add staged security, integration, and policy validation gates before high-impact deployment.

Use dependency and software bill-of-materials checks with approved remediation policies. That action fits another problem: A software team treats dependencies as trusted and never reviews updates before production promotion. It does not directly remediate the current finding at Ridgeview Finance: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. The relevant corrective control for this case is: Add staged security, integration, and policy validation gates before high-impact deployment.

A flagged dependency version stops promotion until the issue is addressed or approved. This would be relevant evidence for a different failure: A software team treats dependencies as trusted and never reviews updates before production promotion, usually addressed by Use dependency and software bill-of-materials checks with approved remediation policies. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: A failed security regression prevents production promotion while a passing release is auditable.

A test policy violation blocks the infrastructure deployment while compliant changes pass. This would be relevant evidence for a different failure: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline, usually addressed by Add infrastructure-as-code static checks and policy gates before applying changes. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: A failed security regression prevents production promotion while a passing release is auditable.

A compromised application pod cannot modify cluster admission controls. This would be relevant evidence for a different failure: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting, usually addressed by Constrain admission and orchestration RBAC by workload and task with reviewable changes. It does not demonstrate that the current problem at Ridgeview Finance was resolved. The specific required evidence is: A failed security regression prevents production promotion while a passing release is auditable.

Add infrastructure-as-code static checks and policy gates before applying changes. That action fits another problem: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. It does not directly remediate the current finding at Pinecrest Research: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. The relevant corrective control for this case is: Add staged security, integration, and policy validation gates before high-impact deployment.

Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. That action fits another problem: Container images are deployed without vulnerability or provenance checks from external registries. It does not directly remediate the current finding at Pinecrest Research: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. The relevant corrective control for this case is: Add staged security, integration, and policy validation gates before high-impact deployment.

Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. That action fits another problem: Build pipelines store production credentials as plaintext variables visible to all developers. It does not directly remediate the current finding at Pinecrest Research: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. The relevant corrective control for this case is: Add staged security, integration, and policy validation gates before high-impact deployment.

A known vulnerable or unsigned image is rejected before it reaches production. This would be relevant evidence for a different failure: Container images are deployed without vulnerability or provenance checks from external registries, usually addressed by Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: A failed security regression prevents production promotion while a passing release is auditable.

A test policy violation blocks the infrastructure deployment while compliant changes pass. This would be relevant evidence for a different failure: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline, usually addressed by Add infrastructure-as-code static checks and policy gates before applying changes. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: A failed security regression prevents production promotion while a passing release is auditable.

Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds. This would be relevant evidence for a different failure: Build pipelines store production credentials as plaintext variables visible to all developers, usually addressed by Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. It does not demonstrate that the current problem at Pinecrest Research was resolved. The specific required evidence is: A failed security regression prevents production promotion while a passing release is auditable.

Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. That action fits another problem: Build pipelines store production credentials as plaintext variables visible to all developers. It does not directly remediate the current finding at Summit Logistics: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. The relevant corrective control for this case is: Constrain admission and orchestration RBAC by workload and task with reviewable changes.

Add infrastructure-as-code static checks and policy gates before applying changes. That action fits another problem: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline. It does not directly remediate the current finding at Summit Logistics: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. The relevant corrective control for this case is: Constrain admission and orchestration RBAC by workload and task with reviewable changes.

Add staged security, integration, and policy validation gates before high-impact deployment. That action fits another problem: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing. It does not directly remediate the current finding at Summit Logistics: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. The relevant corrective control for this case is: Constrain admission and orchestration RBAC by workload and task with reviewable changes.

A test policy violation blocks the infrastructure deployment while compliant changes pass. This would be relevant evidence for a different failure: A Terraform deployment grants overly broad cloud identity permissions and has no security review in the pipeline, usually addressed by Add infrastructure-as-code static checks and policy gates before applying changes. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: A compromised application pod cannot modify cluster admission controls.

Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds. This would be relevant evidence for a different failure: Build pipelines store production credentials as plaintext variables visible to all developers, usually addressed by Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: A compromised application pod cannot modify cluster admission controls.

A failed security regression prevents production promotion while a passing release is auditable. This would be relevant evidence for a different failure: A CI/CD pipeline deploys directly to production when unit tests pass, with no security acceptance testing, usually addressed by Add staged security, integration, and policy validation gates before high-impact deployment. It does not demonstrate that the current problem at Summit Logistics was resolved. The specific required evidence is: A compromised application pod cannot modify cluster admission controls.

Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. That action fits another problem: Build pipelines store production credentials as plaintext variables visible to all developers. It does not directly remediate the current finding at Maple Creek Agriculture: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. The relevant corrective control for this case is: Constrain admission and orchestration RBAC by workload and task with reviewable changes.

Use dependency and software bill-of-materials checks with approved remediation policies. That action fits another problem: A software team treats dependencies as trusted and never reviews updates before production promotion. It does not directly remediate the current finding at Maple Creek Agriculture: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. The relevant corrective control for this case is: Constrain admission and orchestration RBAC by workload and task with reviewable changes.

Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. That action fits another problem: Container images are deployed without vulnerability or provenance checks from external registries. It does not directly remediate the current finding at Maple Creek Agriculture: Developers grant Kubernetes admission permissions to every service account to simplify troubleshooting. The relevant corrective control for this case is: Constrain admission and orchestration RBAC by workload and task with reviewable changes.

A flagged dependency version stops promotion until the issue is addressed or approved. This would be relevant evidence for a different failure: A software team treats dependencies as trusted and never reviews updates before production promotion, usually addressed by Use dependency and software bill-of-materials checks with approved remediation policies. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: A compromised application pod cannot modify cluster admission controls.

A known vulnerable or unsigned image is rejected before it reaches production. This would be relevant evidence for a different failure: Container images are deployed without vulnerability or provenance checks from external registries, usually addressed by Enforce image scanning, signed provenance, and approved registry rules at build or admission gates. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: A compromised application pod cannot modify cluster admission controls.

Unprivileged pipeline jobs cannot read production secrets and authorized deployment succeeds. This would be relevant evidence for a different failure: Build pipelines store production credentials as plaintext variables visible to all developers, usually addressed by Use scoped protected secrets with short-lived workload identity and minimal pipeline permissions. It does not demonstrate that the current problem at Maple Creek Agriculture was resolved. The specific required evidence is: A compromised application pod cannot modify cluster admission controls.