Exam Bundle

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Brookside Manufacturing problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Brookside Manufacturing problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object. That observed result would support another specific correction: Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. The other scenario concerns: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The current Brookside Manufacturing problem is: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The evidence required here is: The application performs its work but a test process cannot exercise unneeded privileged capabilities.

Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. That choice addresses a different foundational issue: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The issue at Silvercrest University is instead: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. It does not establish the required correction; the decisive verification would be: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. That choice addresses a different foundational issue: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The issue at Silvercrest University is instead: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. It does not establish the required correction; the decisive verification would be: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. That choice addresses a different foundational issue: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The issue at Silvercrest University is instead: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. It does not establish the required correction; the decisive verification would be: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable. That observed result would support another specific correction: Use provenance validation, image scanning, and approved registry controls before deploying workload artifacts. The other scenario concerns: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The current Silvercrest University problem is: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The evidence required here is: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Silvercrest University problem is: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The evidence required here is: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Silvercrest University problem is: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The evidence required here is: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. That choice addresses a different foundational issue: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The issue at Highland Education is instead: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. It does not establish the required correction; the decisive verification would be: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. That choice addresses a different foundational issue: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The issue at Highland Education is instead: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. It does not establish the required correction; the decisive verification would be: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

Use a minimal service account policy and disable unnecessary automatic API token mounting for the workload. That choice addresses a different foundational issue: An application runs with the default service account even though it never needs to call the Kubernetes API. The issue at Highland Education is instead: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. It does not establish the required correction; the decisive verification would be: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role. That observed result would support another specific correction: Separate Pod security standards at admission time from RBAC that governs API requests and object access. The other scenario concerns: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The current Highland Education problem is: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The evidence required here is: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

Audit records identify the actual calling identity and an expired or revoked token no longer authenticates. That observed result would support another specific correction: Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. The other scenario concerns: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The current Highland Education problem is: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The evidence required here is: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Highland Education problem is: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The evidence required here is: A container inspection shows no broad host filesystem mount and the approved workload remains functional.

Separate Pod security standards at admission time from RBAC that governs API requests and object access. That choice addresses a different foundational issue: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The issue at Harborline Logistics is instead: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. It does not establish the required correction; the decisive verification would be: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

Create a least-privilege Role and namespaced binding permitting only the required read operations. That choice addresses a different foundational issue: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The issue at Harborline Logistics is instead: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. It does not establish the required correction; the decisive verification would be: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. That choice addresses a different foundational issue: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The issue at Harborline Logistics is instead: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. It does not establish the required correction; the decisive verification would be: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material. That observed result would support another specific correction: Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. The other scenario concerns: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The current Harborline Logistics problem is: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The evidence required here is: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

A container inspection shows no broad host filesystem mount and the approved workload remains functional. That observed result would support another specific correction: Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. The other scenario concerns: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The current Harborline Logistics problem is: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The evidence required here is: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable. That observed result would support another specific correction: Use provenance validation, image scanning, and approved registry controls before deploying workload artifacts. The other scenario concerns: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The current Harborline Logistics problem is: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The evidence required here is: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Maplewood Schools is instead: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. It does not establish the required correction; the decisive verification would be: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. That choice addresses a different foundational issue: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The issue at Maplewood Schools is instead: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. It does not establish the required correction; the decisive verification would be: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. That choice addresses a different foundational issue: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The issue at Maplewood Schools is instead: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. It does not establish the required correction; the decisive verification would be: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

The application starts normally without an unnecessary API token in its container filesystem. That observed result would support another specific correction: Use a minimal service account policy and disable unnecessary automatic API token mounting for the workload. The other scenario concerns: An application runs with the default service account even though it never needs to call the Kubernetes API. The current Maplewood Schools problem is: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The evidence required here is: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object. That observed result would support another specific correction: Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. The other scenario concerns: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The current Maplewood Schools problem is: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The evidence required here is: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work. That observed result would support another specific correction: Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. The other scenario concerns: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The current Maplewood Schools problem is: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The evidence required here is: A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed.

Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. That choice addresses a different foundational issue: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The issue at Timberline Foods is instead: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. It does not establish the required correction; the decisive verification would be: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. That choice addresses a different foundational issue: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The issue at Timberline Foods is instead: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. It does not establish the required correction; the decisive verification would be: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. That choice addresses a different foundational issue: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The issue at Timberline Foods is instead: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. It does not establish the required correction; the decisive verification would be: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role. That observed result would support another specific correction: Separate Pod security standards at admission time from RBAC that governs API requests and object access. The other scenario concerns: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The current Timberline Foods problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

The application starts normally without an unnecessary API token in its container filesystem. That observed result would support another specific correction: Use a minimal service account policy and disable unnecessary automatic API token mounting for the workload. The other scenario concerns: An application runs with the default service account even though it never needs to call the Kubernetes API. The current Timberline Foods problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Timberline Foods problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.