Exam Bundle

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Brookside Manufacturing problem is: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The evidence required here is: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

Audit records identify the actual calling identity and an expired or revoked token no longer authenticates. That observed result would support another specific correction: Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. The other scenario concerns: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The current Brookside Manufacturing problem is: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The evidence required here is: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material. That observed result would support another specific correction: Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. The other scenario concerns: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The current Brookside Manufacturing problem is: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The evidence required here is: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. That choice addresses a different foundational issue: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The issue at Juniper Media is instead: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. It does not establish the required correction; the decisive verification would be: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. That choice addresses a different foundational issue: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The issue at Juniper Media is instead: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. It does not establish the required correction; the decisive verification would be: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. That choice addresses a different foundational issue: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The issue at Juniper Media is instead: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. It does not establish the required correction; the decisive verification would be: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable. That observed result would support another specific correction: Use a narrowly justified and reviewed exception process rather than weakening the baseline policy for an entire namespace. The other scenario concerns: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The current Juniper Media problem is: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The evidence required here is: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Juniper Media problem is: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The evidence required here is: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

The application uses the rotated credential after the approved restart or reload and the previous credential stops working. That observed result would support another specific correction: Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. The other scenario concerns: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The current Juniper Media problem is: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The evidence required here is: The robot reads the intended Pods but fails an attempt to modify cluster-wide resources.

Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. That choice addresses a different foundational issue: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The issue at Highland Education is instead: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. It does not establish the required correction; the decisive verification would be: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Highland Education is instead: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. It does not establish the required correction; the decisive verification would be: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Highland Education is instead: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. It does not establish the required correction; the decisive verification would be: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

The robot reads the intended Pods but fails an attempt to modify cluster-wide resources. That observed result would support another specific correction: Create a least-privilege Role and namespaced binding permitting only the required read operations. The other scenario concerns: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The current Highland Education problem is: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The evidence required here is: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable. That observed result would support another specific correction: Use a narrowly justified and reviewed exception process rather than weakening the baseline policy for an entire namespace. The other scenario concerns: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The current Highland Education problem is: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The evidence required here is: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Highland Education problem is: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The evidence required here is: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. That choice addresses a different foundational issue: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The issue at Eastshore Energy is instead: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. It does not establish the required correction; the decisive verification would be: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Use provenance validation, image scanning, and approved registry controls before deploying workload artifacts. That choice addresses a different foundational issue: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The issue at Eastshore Energy is instead: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. It does not establish the required correction; the decisive verification would be: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Eastshore Energy is instead: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. It does not establish the required correction; the decisive verification would be: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

The robot reads the intended Pods but fails an attempt to modify cluster-wide resources. That observed result would support another specific correction: Create a least-privilege Role and namespaced binding permitting only the required read operations. The other scenario concerns: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The current Eastshore Energy problem is: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The evidence required here is: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Eastshore Energy problem is: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The evidence required here is: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Audit records identify the actual calling identity and an expired or revoked token no longer authenticates. That observed result would support another specific correction: Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. The other scenario concerns: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The current Eastshore Energy problem is: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The evidence required here is: An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object.

Use a narrowly justified and reviewed exception process rather than weakening the baseline policy for an entire namespace. That choice addresses a different foundational issue: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The issue at Maplewood Schools is instead: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. It does not establish the required correction; the decisive verification would be: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. That choice addresses a different foundational issue: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The issue at Maplewood Schools is instead: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. It does not establish the required correction; the decisive verification would be: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Use provenance validation, image scanning, and approved registry controls before deploying workload artifacts. That choice addresses a different foundational issue: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The issue at Maplewood Schools is instead: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. It does not establish the required correction; the decisive verification would be: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Maplewood Schools problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable. That observed result would support another specific correction: Use provenance validation, image scanning, and approved registry controls before deploying workload artifacts. The other scenario concerns: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The current Maplewood Schools problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Maplewood Schools problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Brookside Manufacturing is instead: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. It does not establish the required correction; the decisive verification would be: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. That choice addresses a different foundational issue: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The issue at Brookside Manufacturing is instead: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. It does not establish the required correction; the decisive verification would be: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Create a least-privilege Role and namespaced binding permitting only the required read operations. That choice addresses a different foundational issue: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The issue at Brookside Manufacturing is instead: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. It does not establish the required correction; the decisive verification would be: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Brookside Manufacturing problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Brookside Manufacturing problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object. That observed result would support another specific correction: Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. The other scenario concerns: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The current Brookside Manufacturing problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.