Exam Bundle

The partner sees only the allowed age band rather than full date would demonstrate the separate action Generalize precise dates into approved age ranges, which addresses “A birth date should be coarsened to an age band to reduce identification risk.” It does not verify the requirement “Authorized internal reidentification is necessary for customer service support” following Use controlled reversible tokenization with a restricted mapping vault.

Matching source IDs yield consistent digests without a published mapping table pertains to a different control (Use a suitable cryptographic one-way keyed hash with secret management) and a different need (A nonreversible representation is required for equality matching without a secret table). It cannot establish that Use controlled reversible tokenization with a restricted mapping vault met the stated goal.

This signal belongs to the adjacent case “The same customer should map consistently across datasets without revealing the original ID,” whose remedy is Use controlled keyed tokenization or HMAC pseudonymization. The observed result for the present requirement is Only the trusted service role can resolve tokens to the original identifier.

This action solves a different issue: “A scheduled job must use a managed identity or service principal instead of an employee's token.” Its normal signal is The job continues successfully after the employee account is disabled. Here the requested behavior is “A notebook currently stores a database password in plaintext source code,” so that signal is not sufficient.

This action solves a different issue: “A secret was accidentally printed in notebook output during debugging.” Its normal signal is A new run logs no credential value and old secret no longer authenticates. Here the requested behavior is “A notebook currently stores a database password in plaintext source code,” so that signal is not sufficient.

The alternative Grant supported use permissions while withholding secret-management rights has a distinct purpose—A developer needs to test access without gaining permission to read the underlying secret. It would not establish the required outcome (A notebook currently stores a database password in plaintext source code); the necessary verification concerns Source code and deployment manifests no longer contain the secret.

This signal belongs to the adjacent case “A developer needs to test access without gaining permission to read the underlying secret,” whose remedy is Grant supported use permissions while withholding secret-management rights. The observed result for the present requirement is Source code and deployment manifests no longer contain the secret.

This signal belongs to the adjacent case “A scheduled job must use a managed identity or service principal instead of an employee's token,” whose remedy is Configure the job's supported service-principal identity and least privileges. The observed result for the present requirement is Source code and deployment manifests no longer contain the secret.

This signal belongs to the adjacent case “The remote database credentials rotate periodically,” whose remedy is Update the secured secret reference or governed connection on rotation. The observed result for the present requirement is Source code and deployment manifests no longer contain the secret.

Configure the job's supported service-principal identity and least privileges belongs to the separate case “A scheduled job must use a managed identity or service principal instead of an employee's token,” where The job continues successfully after the employee account is disabled would be expected. That differs from the condition in this stem: “A secret was accidentally printed in notebook output during debugging.”

Update the secured secret reference or governed connection on rotation belongs to the separate case “The remote database credentials rotate periodically,” where The job authenticates with the new credential and rejects old credentials would be expected. That differs from the condition in this stem: “A secret was accidentally printed in notebook output during debugging.”

This action solves a different issue: “A developer needs to test access without gaining permission to read the underlying secret.” Its normal signal is Developer can run the permitted job but cannot list protected secret values. Here the requested behavior is “A secret was accidentally printed in notebook output during debugging,” so that signal is not sufficient.

The job authenticates with the new credential and rejects old credentials pertains to a different control (Update the secured secret reference or governed connection on rotation) and a different need (The remote database credentials rotate periodically). It cannot establish that Remove the output, rotate the exposed credential and prevent logging secrets met the stated goal.

This signal belongs to the adjacent case “A scheduled job must use a managed identity or service principal instead of an employee's token,” whose remedy is Configure the job's supported service-principal identity and least privileges. The observed result for the present requirement is A new run logs no credential value and old secret no longer authenticates.

This signal belongs to the adjacent case “A developer needs to test access without gaining permission to read the underlying secret,” whose remedy is Grant supported use permissions while withholding secret-management rights. The observed result for the present requirement is A new run logs no credential value and old secret no longer authenticates.

Move the password to a secured secret scope or governed connection belongs to the separate case “A notebook currently stores a database password in plaintext source code,” where Source code and deployment manifests no longer contain the secret would be expected. That differs from the condition in this stem: “A scheduled job must use a managed identity or service principal instead of an employee's token.”

This action solves a different issue: “A developer needs to test access without gaining permission to read the underlying secret.” Its normal signal is Developer can run the permitted job but cannot list protected secret values. Here the requested behavior is “A scheduled job must use a managed identity or service principal instead of an employee's token,” so that signal is not sufficient.

Update the secured secret reference or governed connection on rotation belongs to the separate case “The remote database credentials rotate periodically,” where The job authenticates with the new credential and rejects old credentials would be expected. That differs from the condition in this stem: “A scheduled job must use a managed identity or service principal instead of an employee's token.”

This signal belongs to the adjacent case “A developer needs to test access without gaining permission to read the underlying secret,” whose remedy is Grant supported use permissions while withholding secret-management rights. The observed result for the present requirement is The job continues successfully after the employee account is disabled.

Source code and deployment manifests no longer contain the secret would demonstrate the separate action Move the password to a secured secret scope or governed connection, which addresses “A notebook currently stores a database password in plaintext source code.” It does not verify the requirement “A scheduled job must use a managed identity or service principal instead of an employee's token” following Configure the job's supported service-principal identity and least privileges.

A new run logs no credential value and old secret no longer authenticates pertains to a different control (Remove the output, rotate the exposed credential and prevent logging secrets) and a different need (A secret was accidentally printed in notebook output during debugging). It cannot establish that Configure the job's supported service-principal identity and least privileges met the stated goal.

Grant supported use permissions while withholding secret-management rights belongs to the separate case “A developer needs to test access without gaining permission to read the underlying secret,” where Developer can run the permitted job but cannot list protected secret values would be expected. That differs from the condition in this stem: “The remote database credentials rotate periodically.”

The alternative Configure the job's supported service-principal identity and least privileges has a distinct purpose—A scheduled job must use a managed identity or service principal instead of an employee's token. It would not establish the required outcome (The remote database credentials rotate periodically); the necessary verification concerns The job authenticates with the new credential and rejects old credentials.

This action solves a different issue: “A secret was accidentally printed in notebook output during debugging.” Its normal signal is A new run logs no credential value and old secret no longer authenticates. Here the requested behavior is “The remote database credentials rotate periodically,” so that signal is not sufficient.

A new run logs no credential value and old secret no longer authenticates would demonstrate the separate action Remove the output, rotate the exposed credential and prevent logging secrets, which addresses “A secret was accidentally printed in notebook output during debugging.” It does not verify the requirement “The remote database credentials rotate periodically” following Update the secured secret reference or governed connection on rotation.

That observation is a valid indicator for “A developer needs to test access without gaining permission to read the underlying secret” when using Grant supported use permissions while withholding secret-management rights. The scenario instead tests “The remote database credentials rotate periodically”; the relevant result is The job authenticates with the new credential and rejects old credentials.

This signal belongs to the adjacent case “A notebook currently stores a database password in plaintext source code,” whose remedy is Move the password to a secured secret scope or governed connection. The observed result for the present requirement is The job authenticates with the new credential and rejects old credentials.

Remove the output, rotate the exposed credential and prevent logging secrets belongs to the separate case “A secret was accidentally printed in notebook output during debugging,” where A new run logs no credential value and old secret no longer authenticates would be expected. That differs from the condition in this stem: “A developer needs to test access without gaining permission to read the underlying secret.”

Update the secured secret reference or governed connection on rotation is appropriate when “The remote database credentials rotate periodically”; it would be verified by The job authenticates with the new credential and rejects old credentials. It does not directly satisfy “A developer needs to test access without gaining permission to read the underlying secret,” whose relevant acceptance evidence is Developer can run the permitted job but cannot list protected secret values.

Move the password to a secured secret scope or governed connection is appropriate when “A notebook currently stores a database password in plaintext source code”; it would be verified by Source code and deployment manifests no longer contain the secret. It does not directly satisfy “A developer needs to test access without gaining permission to read the underlying secret,” whose relevant acceptance evidence is Developer can run the permitted job but cannot list protected secret values.

That observation is a valid indicator for “A secret was accidentally printed in notebook output during debugging” when using Remove the output, rotate the exposed credential and prevent logging secrets. The scenario instead tests “A developer needs to test access without gaining permission to read the underlying secret”; the relevant result is Developer can run the permitted job but cannot list protected secret values.

This signal belongs to the adjacent case “A notebook currently stores a database password in plaintext source code,” whose remedy is Move the password to a secured secret scope or governed connection. The observed result for the present requirement is Developer can run the permitted job but cannot list protected secret values.

That observation is a valid indicator for “A scheduled job must use a managed identity or service principal instead of an employee's token” when using Configure the job's supported service-principal identity and least privileges. The scenario instead tests “A developer needs to test access without gaining permission to read the underlying secret”; the relevant result is Developer can run the permitted job but cannot list protected secret values.