Exam Bundle

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Timberline Foods problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Timberline Foods problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work. That observed result would support another specific correction: Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. The other scenario concerns: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The current Timberline Foods problem is: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The evidence required here is: The admission or delivery pipeline rejects an unapproved image while a signed and reviewed build is deployable.

Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. That choice addresses a different foundational issue: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The issue at Juniper Media is instead: A workload requires read-only source files but mounts its entire container root filesystem writable. It does not establish the required correction; the decisive verification would be: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Juniper Media is instead: A workload requires read-only source files but mounts its entire container root filesystem writable. It does not establish the required correction; the decisive verification would be: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

Create a least-privilege Role and namespaced binding permitting only the required read operations. That choice addresses a different foundational issue: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The issue at Juniper Media is instead: A workload requires read-only source files but mounts its entire container root filesystem writable. It does not establish the required correction; the decisive verification would be: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

The application uses the rotated credential after the approved restart or reload and the previous credential stops working. That observed result would support another specific correction: Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. The other scenario concerns: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The current Juniper Media problem is: A workload requires read-only source files but mounts its entire container root filesystem writable. The evidence required here is: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Juniper Media problem is: A workload requires read-only source files but mounts its entire container root filesystem writable. The evidence required here is: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object. That observed result would support another specific correction: Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. The other scenario concerns: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The current Juniper Media problem is: A workload requires read-only source files but mounts its entire container root filesystem writable. The evidence required here is: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

Separate Pod security standards at admission time from RBAC that governs API requests and object access. That choice addresses a different foundational issue: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The issue at Meadowbrook Finance is instead: A workload requires read-only source files but mounts its entire container root filesystem writable. It does not establish the required correction; the decisive verification would be: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

Use provenance validation, image scanning, and approved registry controls before deploying workload artifacts. That choice addresses a different foundational issue: A team labels an untrusted internet image as safe solely because it was pulled from a popular public registry. The issue at Meadowbrook Finance is instead: A workload requires read-only source files but mounts its entire container root filesystem writable. It does not establish the required correction; the decisive verification would be: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. That choice addresses a different foundational issue: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The issue at Meadowbrook Finance is instead: A workload requires read-only source files but mounts its entire container root filesystem writable. It does not establish the required correction; the decisive verification would be: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Meadowbrook Finance problem is: A workload requires read-only source files but mounts its entire container root filesystem writable. The evidence required here is: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Meadowbrook Finance problem is: A workload requires read-only source files but mounts its entire container root filesystem writable. The evidence required here is: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Meadowbrook Finance problem is: A workload requires read-only source files but mounts its entire container root filesystem writable. The evidence required here is: The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem.

Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. That choice addresses a different foundational issue: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The issue at Eastshore Energy is instead: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. It does not establish the required correction; the decisive verification would be: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Eastshore Energy is instead: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. It does not establish the required correction; the decisive verification would be: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. That choice addresses a different foundational issue: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The issue at Eastshore Energy is instead: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. It does not establish the required correction; the decisive verification would be: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work. That observed result would support another specific correction: Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. The other scenario concerns: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The current Eastshore Energy problem is: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The evidence required here is: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

The app runs with its intended writable scratch area but cannot modify the rest of the container filesystem. That observed result would support another specific correction: Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. The other scenario concerns: A workload requires read-only source files but mounts its entire container root filesystem writable. The current Eastshore Energy problem is: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The evidence required here is: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material. That observed result would support another specific correction: Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. The other scenario concerns: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The current Eastshore Energy problem is: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The evidence required here is: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. That choice addresses a different foundational issue: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The issue at Alpine Healthcare is instead: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. It does not establish the required correction; the decisive verification would be: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. That choice addresses a different foundational issue: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The issue at Alpine Healthcare is instead: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. It does not establish the required correction; the decisive verification would be: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. That choice addresses a different foundational issue: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The issue at Alpine Healthcare is instead: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. It does not establish the required correction; the decisive verification would be: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

A container inspection shows no broad host filesystem mount and the approved workload remains functional. That observed result would support another specific correction: Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. The other scenario concerns: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The current Alpine Healthcare problem is: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The evidence required here is: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work. That observed result would support another specific correction: Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. The other scenario concerns: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The current Alpine Healthcare problem is: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The evidence required here is: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Alpine Healthcare problem is: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The evidence required here is: A test denies a privileged Pod configuration while a separate authorization test restricts API reads by role.

Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. That choice addresses a different foundational issue: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The issue at Brookside Manufacturing is instead: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. It does not establish the required correction; the decisive verification would be: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

Separate Pod security standards at admission time from RBAC that governs API requests and object access. That choice addresses a different foundational issue: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The issue at Brookside Manufacturing is instead: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. It does not establish the required correction; the decisive verification would be: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Brookside Manufacturing is instead: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. It does not establish the required correction; the decisive verification would be: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Brookside Manufacturing problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

The robot reads the intended Pods but fails an attempt to modify cluster-wide resources. That observed result would support another specific correction: Create a least-privilege Role and namespaced binding permitting only the required read operations. The other scenario concerns: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The current Brookside Manufacturing problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Brookside Manufacturing problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.