Exam Bundle

An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history. That observation would verify another scenario: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. The corrective step for that other scenario is: Deliver essential audit trails to protected central storage with retention locks and separately controlled access. But Timberline Foods is evaluating: A Kubernetes workload mounts a host filesystem and runs as privileged although its application only reads a configuration secret. The necessary outcome is: The approved pod starts without host mounts and a privileged test manifest is rejected by policy.

The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions. That observation would verify another scenario: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The corrective step for that other scenario is: Document shared-responsibility boundaries for the chosen cloud service model and assign customer controls explicitly. But Timberline Foods is evaluating: A Kubernetes workload mounts a host filesystem and runs as privileged although its application only reads a configuration secret. The necessary outcome is: The approved pod starts without host mounts and a privileged test manifest is rejected by policy.

The compromised principal is disabled or constrained and the review identifies all affected authorized resources. That observation would verify another scenario: A cloud incident reviewer sees a suspicious credential used from an unusual location but lacks an inventory of what resources the token can access. The corrective step for that other scenario is: Map the credential to its active principal, granted roles, recent use and revocation path before scoped containment. But Timberline Foods is evaluating: A Kubernetes workload mounts a host filesystem and runs as privileged although its application only reads a configuration secret. The necessary outcome is: The approved pod starts without host mounts and a privileged test manifest is rejected by policy.

Build from a supported minimal image, scan dependencies and sign or attest the released artifact. This is an appropriate control for a different issue: A container image used in production is based on an unsupported runtime and includes unnecessary debugging packages. The Juniper Media finding instead concerns: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. It does not demonstrate the required correction. The decisive test remains: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

Restrict management ingress to approved access paths and enable auditable privileged authentication. This is an appropriate control for a different issue: A cloud virtual machine hosts an external service but also exposes SSH administration to the entire internet. The Juniper Media finding instead concerns: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. It does not demonstrate the required correction. The decisive test remains: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

Map the credential to its active principal, granted roles, recent use and revocation path before scoped containment. This is an appropriate control for a different issue: A cloud incident reviewer sees a suspicious credential used from an unusual location but lacks an inventory of what resources the token can access. The Juniper Media finding instead concerns: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. It does not demonstrate the required correction. The decisive test remains: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

An anonymous test cannot list or read confidential objects and sanctioned public assets remain accessible through reviewed policy. That observation would verify another scenario: A cloud object storage container allows anonymous listing because it was created with a public access template. The corrective step for that other scenario is: Enforce private access by default, explicit policy review and organization-level public-exposure guardrails. But Juniper Media is evaluating: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. The necessary outcome is: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

The public service remains available while arbitrary external clients cannot reach the administrative port. That observation would verify another scenario: A cloud virtual machine hosts an external service but also exposes SSH administration to the entire internet. The corrective step for that other scenario is: Restrict management ingress to approved access paths and enable auditable privileged authentication. But Juniper Media is evaluating: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. The necessary outcome is: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

The compromised principal is disabled or constrained and the review identifies all affected authorized resources. That observation would verify another scenario: A cloud incident reviewer sees a suspicious credential used from an unusual location but lacks an inventory of what resources the token can access. The corrective step for that other scenario is: Map the credential to its active principal, granted roles, recent use and revocation path before scoped containment. But Juniper Media is evaluating: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. The necessary outcome is: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

Build from a supported minimal image, scan dependencies and sign or attest the released artifact. This is an appropriate control for a different issue: A container image used in production is based on an unsupported runtime and includes unnecessary debugging packages. The Meadowbrook Finance finding instead concerns: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. It does not demonstrate the required correction. The decisive test remains: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

Map the credential to its active principal, granted roles, recent use and revocation path before scoped containment. This is an appropriate control for a different issue: A cloud incident reviewer sees a suspicious credential used from an unusual location but lacks an inventory of what resources the token can access. The Meadowbrook Finance finding instead concerns: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. It does not demonstrate the required correction. The decisive test remains: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

Apply data-classification and residency requirements to storage, backups, replicas and logging paths. This is an appropriate control for a different issue: A cloud application serves customer records in several regions without checking where regulated personal information may legally reside. The Meadowbrook Finance finding instead concerns: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. It does not demonstrate the required correction. The decisive test remains: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions. That observation would verify another scenario: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The corrective step for that other scenario is: Document shared-responsibility boundaries for the chosen cloud service model and assign customer controls explicitly. But Meadowbrook Finance is evaluating: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. The necessary outcome is: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

Data-flow evidence confirms approved regions for primary data and disaster-recovery copies. That observation would verify another scenario: A cloud application serves customer records in several regions without checking where regulated personal information may legally reside. The corrective step for that other scenario is: Apply data-classification and residency requirements to storage, backups, replicas and logging paths. But Meadowbrook Finance is evaluating: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. The necessary outcome is: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

The deployed image contains the intended patched runtime and its provenance verifies against the approved build pipeline. That observation would verify another scenario: A container image used in production is based on an unsupported runtime and includes unnecessary debugging packages. The corrective step for that other scenario is: Build from a supported minimal image, scan dependencies and sign or attest the released artifact. But Meadowbrook Finance is evaluating: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. The necessary outcome is: The function runs using scoped access without plaintext secrets in its deployment package or diagnostic logs.

Map the credential to its active principal, granted roles, recent use and revocation path before scoped containment. This is an appropriate control for a different issue: A cloud incident reviewer sees a suspicious credential used from an unusual location but lacks an inventory of what resources the token can access. The Eastshore Energy finding instead concerns: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. It does not demonstrate the required correction. The decisive test remains: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

Deliver essential audit trails to protected central storage with retention locks and separately controlled access. This is an appropriate control for a different issue: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. The Eastshore Energy finding instead concerns: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. It does not demonstrate the required correction. The decisive test remains: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

Restrict management ingress to approved access paths and enable auditable privileged authentication. This is an appropriate control for a different issue: A cloud virtual machine hosts an external service but also exposes SSH administration to the entire internet. The Eastshore Energy finding instead concerns: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. It does not demonstrate the required correction. The decisive test remains: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

Data-flow evidence confirms approved regions for primary data and disaster-recovery copies. That observation would verify another scenario: A cloud application serves customer records in several regions without checking where regulated personal information may legally reside. The corrective step for that other scenario is: Apply data-classification and residency requirements to storage, backups, replicas and logging paths. But Eastshore Energy is evaluating: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The necessary outcome is: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history. That observation would verify another scenario: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. The corrective step for that other scenario is: Deliver essential audit trails to protected central storage with retention locks and separately controlled access. But Eastshore Energy is evaluating: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The necessary outcome is: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

An anonymous test cannot list or read confidential objects and sanctioned public assets remain accessible through reviewed policy. That observation would verify another scenario: A cloud object storage container allows anonymous listing because it was created with a public access template. The corrective step for that other scenario is: Enforce private access by default, explicit policy review and organization-level public-exposure guardrails. But Eastshore Energy is evaluating: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The necessary outcome is: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

Build from a supported minimal image, scan dependencies and sign or attest the released artifact. This is an appropriate control for a different issue: A container image used in production is based on an unsupported runtime and includes unnecessary debugging packages. The Alpine Healthcare finding instead concerns: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. It does not demonstrate the required correction. The decisive test remains: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

Assign a least-privilege workload role or managed identity for the specific queue and logging actions. This is an appropriate control for a different issue: A cloud workload uses a powerful tenant administrator identity simply to read one queue and write one log stream. The Alpine Healthcare finding instead concerns: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. It does not demonstrate the required correction. The decisive test remains: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

Apply data-classification and residency requirements to storage, backups, replicas and logging paths. This is an appropriate control for a different issue: A cloud application serves customer records in several regions without checking where regulated personal information may legally reside. The Alpine Healthcare finding instead concerns: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. It does not demonstrate the required correction. The decisive test remains: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

The compromised principal is disabled or constrained and the review identifies all affected authorized resources. That observation would verify another scenario: A cloud incident reviewer sees a suspicious credential used from an unusual location but lacks an inventory of what resources the token can access. The corrective step for that other scenario is: Map the credential to its active principal, granted roles, recent use and revocation path before scoped containment. But Alpine Healthcare is evaluating: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The necessary outcome is: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

Data-flow evidence confirms approved regions for primary data and disaster-recovery copies. That observation would verify another scenario: A cloud application serves customer records in several regions without checking where regulated personal information may legally reside. The corrective step for that other scenario is: Apply data-classification and residency requirements to storage, backups, replicas and logging paths. But Alpine Healthcare is evaluating: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The necessary outcome is: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history. That observation would verify another scenario: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. The corrective step for that other scenario is: Deliver essential audit trails to protected central storage with retention locks and separately controlled access. But Alpine Healthcare is evaluating: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The necessary outcome is: The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions.

Use a platform-managed identity and approved secret management, then rotate the exposed credential. This is an appropriate control for a different issue: A serverless function stores a long-lived cloud API secret inside its source archive and runtime logs. The Brookside Manufacturing finding instead concerns: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. It does not demonstrate the required correction. The decisive test remains: An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history.

Build from a supported minimal image, scan dependencies and sign or attest the released artifact. This is an appropriate control for a different issue: A container image used in production is based on an unsupported runtime and includes unnecessary debugging packages. The Brookside Manufacturing finding instead concerns: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. It does not demonstrate the required correction. The decisive test remains: An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history.

Document shared-responsibility boundaries for the chosen cloud service model and assign customer controls explicitly. This is an appropriate control for a different issue: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The Brookside Manufacturing finding instead concerns: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. It does not demonstrate the required correction. The decisive test remains: An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history.

An anonymous test cannot list or read confidential objects and sanctioned public assets remain accessible through reviewed policy. That observation would verify another scenario: A cloud object storage container allows anonymous listing because it was created with a public access template. The corrective step for that other scenario is: Enforce private access by default, explicit policy review and organization-level public-exposure guardrails. But Brookside Manufacturing is evaluating: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. The necessary outcome is: An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history.

The approved pod starts without host mounts and a privileged test manifest is rejected by policy. That observation would verify another scenario: A Kubernetes workload mounts a host filesystem and runs as privileged although its application only reads a configuration secret. The corrective step for that other scenario is: Apply admission and workload-security policies that deny excess privilege and grant only the specific secret access. But Brookside Manufacturing is evaluating: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. The necessary outcome is: An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history.

The reviewed matrix identifies which team owns application identity, data access and cloud infrastructure security decisions. That observation would verify another scenario: A security team assumes the cloud provider is responsible for protecting every customer-created user account and API authorization rule. The corrective step for that other scenario is: Document shared-responsibility boundaries for the chosen cloud service model and assign customer controls explicitly. But Brookside Manufacturing is evaluating: An enterprise enables cloud audit logs but sends them to storage that the same application identity can delete. The necessary outcome is: An application-role test cannot delete the retained logs and security reviewers can reconstruct a change history.