Exam Bundle

A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role. That observed result would support another specific correction: Separate Pod security standards at admission time from RBAC that governs API requests and object access. The other scenario concerns: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The current Timberline Foods problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

The application starts normally without an unnecessary API token in its container filesystem. That observed result would support another specific correction: Use a minimal service account policy and disable unnecessary automatic API token mounting for the workload. The other scenario concerns: An application runs with the default service account even though it never needs to call the Kubernetes API. The current Timberline Foods problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Timberline Foods problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

Separate Pod security standards at admission time from RBAC that governs API requests and object access. That choice addresses a different foundational issue: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The issue at Silvercrest University is instead: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. It does not establish the required correction; the decisive verification would be: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Silvercrest University is instead: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. It does not establish the required correction; the decisive verification would be: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. That choice addresses a different foundational issue: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The issue at Silvercrest University is instead: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. It does not establish the required correction; the decisive verification would be: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Silvercrest University problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work. That observed result would support another specific correction: Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. The other scenario concerns: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The current Silvercrest University problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

A container inspection shows no broad host filesystem mount and the approved workload remains functional. That observed result would support another specific correction: Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. The other scenario concerns: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The current Silvercrest University problem is: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The evidence required here is: Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material.

Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. That choice addresses a different foundational issue: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The issue at Meadowbrook Finance is instead: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. It does not establish the required correction; the decisive verification would be: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Meadowbrook Finance is instead: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. It does not establish the required correction; the decisive verification would be: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. That choice addresses a different foundational issue: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The issue at Meadowbrook Finance is instead: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. It does not establish the required correction; the decisive verification would be: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work. That observed result would support another specific correction: Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. The other scenario concerns: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The current Meadowbrook Finance problem is: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The evidence required here is: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Meadowbrook Finance problem is: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The evidence required here is: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role. That observed result would support another specific correction: Separate Pod security standards at admission time from RBAC that governs API requests and object access. The other scenario concerns: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The current Meadowbrook Finance problem is: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The evidence required here is: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Harborline Logistics is instead: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. It does not establish the required correction; the decisive verification would be: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Harborline Logistics is instead: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. It does not establish the required correction; the decisive verification would be: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. That choice addresses a different foundational issue: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The issue at Harborline Logistics is instead: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. It does not establish the required correction; the decisive verification would be: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material. That observed result would support another specific correction: Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. The other scenario concerns: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The current Harborline Logistics problem is: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The evidence required here is: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role. That observed result would support another specific correction: Separate Pod security standards at admission time from RBAC that governs API requests and object access. The other scenario concerns: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The current Harborline Logistics problem is: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The evidence required here is: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Audit records identify the actual calling identity and an expired or revoked token no longer authenticates. That observed result would support another specific correction: Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. The other scenario concerns: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The current Harborline Logistics problem is: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The evidence required here is: The application uses the rotated credential after the approved restart or reload and the previous credential stops working.

Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. That choice addresses a different foundational issue: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The issue at Alpine Healthcare is instead: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. It does not establish the required correction; the decisive verification would be: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. That choice addresses a different foundational issue: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The issue at Alpine Healthcare is instead: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. It does not establish the required correction; the decisive verification would be: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Use a minimal service account policy and disable unnecessary automatic API token mounting for the workload. That choice addresses a different foundational issue: An application runs with the default service account even though it never needs to call the Kubernetes API. The issue at Alpine Healthcare is instead: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. It does not establish the required correction; the decisive verification would be: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Alpine Healthcare problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work. That observed result would support another specific correction: Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. The other scenario concerns: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The current Alpine Healthcare problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Alpine Healthcare problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. That choice addresses a different foundational issue: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The issue at Timberline Foods is instead: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. It does not establish the required correction; the decisive verification would be: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. That choice addresses a different foundational issue: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The issue at Timberline Foods is instead: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. It does not establish the required correction; the decisive verification would be: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Use a narrowly justified and reviewed exception process rather than weakening the baseline policy for an entire namespace. That choice addresses a different foundational issue: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The issue at Timberline Foods is instead: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. It does not establish the required correction; the decisive verification would be: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Timberline Foods problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Timberline Foods problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work. That observed result would support another specific correction: Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. The other scenario concerns: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The current Timberline Foods problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.