Exam Bundle

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Brookside Manufacturing problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

The robot reads the intended Pods but fails an attempt to modify cluster-wide resources. That observed result would support another specific correction: Create a least-privilege Role and namespaced binding permitting only the required read operations. The other scenario concerns: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The current Brookside Manufacturing problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Brookside Manufacturing problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Juniper Media is instead: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. It does not establish the required correction; the decisive verification would be: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. That choice addresses a different foundational issue: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The issue at Juniper Media is instead: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. It does not establish the required correction; the decisive verification would be: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

Create a least-privilege Role and namespaced binding permitting only the required read operations. That choice addresses a different foundational issue: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The issue at Juniper Media is instead: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. It does not establish the required correction; the decisive verification would be: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Juniper Media problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

A container inspection shows no broad host filesystem mount and the approved workload remains functional. That observed result would support another specific correction: Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. The other scenario concerns: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The current Juniper Media problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

The application uses the rotated credential after the approved restart or reload and the previous credential stops working. That observed result would support another specific correction: Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. The other scenario concerns: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The current Juniper Media problem is: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The evidence required here is: Audit records identify the actual calling identity and an expired or revoked token no longer authenticates.

Separate Pod security standards at admission time from RBAC that governs API requests and object access. That choice addresses a different foundational issue: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The issue at Highland Education is instead: An application with access to the Kubernetes API logs its mounted service-account token during error handling. It does not establish the required correction; the decisive verification would be: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. That choice addresses a different foundational issue: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The issue at Highland Education is instead: An application with access to the Kubernetes API logs its mounted service-account token during error handling. It does not establish the required correction; the decisive verification would be: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. That choice addresses a different foundational issue: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The issue at Highland Education is instead: An application with access to the Kubernetes API logs its mounted service-account token during error handling. It does not establish the required correction; the decisive verification would be: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Normal workloads remain subject to the restrictive standard and any approved exception is scoped and auditable. That observed result would support another specific correction: Use a narrowly justified and reviewed exception process rather than weakening the baseline policy for an entire namespace. The other scenario concerns: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The current Highland Education problem is: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The evidence required here is: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Audit records identify the actual calling identity and an expired or revoked token no longer authenticates. That observed result would support another specific correction: Adopt appropriate distinct identities and short-lived credentials with auditable least-privilege RBAC bindings. The other scenario concerns: A cluster uses the same long-lived static token for developers, automation, and workloads, making activity attribution difficult. The current Highland Education problem is: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The evidence required here is: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Only authorized identities retrieve the secret and the nonsecret ConfigMap contains no key material. That observed result would support another specific correction: Use a Secret with appropriately scoped RBAC, avoid placing credentials in ConfigMaps, and configure at-rest encryption where available. The other scenario concerns: An organization stores an API key in a ConfigMap and believes RBAC on the deployment alone prevents its disclosure. The current Highland Education problem is: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The evidence required here is: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Separate Pod security standards at admission time from RBAC that governs API requests and object access. That choice addresses a different foundational issue: A project expects Pod Security Admission to replace authorization checks on sensitive Kubernetes API resources. The issue at Eastshore Energy is instead: An application with access to the Kubernetes API logs its mounted service-account token during error handling. It does not establish the required correction; the decisive verification would be: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. That choice addresses a different foundational issue: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The issue at Eastshore Energy is instead: An application with access to the Kubernetes API logs its mounted service-account token during error handling. It does not establish the required correction; the decisive verification would be: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. That choice addresses a different foundational issue: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The issue at Eastshore Energy is instead: An application with access to the Kubernetes API logs its mounted service-account token during error handling. It does not establish the required correction; the decisive verification would be: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Only the intended application component can read the mounted secret in a controlled multi-container test. That observed result would support another specific correction: Restrict which containers and paths receive the secret and control filesystem and application access within the Pod. The other scenario concerns: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The current Eastshore Energy problem is: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The evidence required here is: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Eastshore Energy problem is: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The evidence required here is: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

The application uses the rotated credential after the approved restart or reload and the previous credential stops working. That observed result would support another specific correction: Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. The other scenario concerns: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The current Eastshore Energy problem is: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The evidence required here is: Diagnostic logs contain no reusable credential and a least-privilege Pod continues to complete its approved work.

Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. That choice addresses a different foundational issue: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The issue at Maplewood Schools is instead: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. It does not establish the required correction; the decisive verification would be: Only the intended application component can read the mounted secret in a controlled multi-container test.

Create a least-privilege Role and namespaced binding permitting only the required read operations. That choice addresses a different foundational issue: A team grants a CI robot cluster-admin rights merely to read Pod status from one project namespace. The issue at Maplewood Schools is instead: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. It does not establish the required correction; the decisive verification would be: Only the intended application component can read the mounted secret in a controlled multi-container test.

Remove secret-bearing logging, minimize token mounting and scope API permissions to the actual workload operations. That choice addresses a different foundational issue: An application with access to the Kubernetes API logs its mounted service-account token during error handling. The issue at Maplewood Schools is instead: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. It does not establish the required correction; the decisive verification would be: Only the intended application component can read the mounted secret in a controlled multi-container test.

The application performs its work but a test process cannot exercise unneeded privileged capabilities. That observed result would support another specific correction: Set a restrictive securityContext with nonroot execution and dropped capabilities where supported. The other scenario concerns: An image supplies a process running as root with the ability to add Linux kernel capabilities unnecessary for its task. The current Maplewood Schools problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Maplewood Schools problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.

The application uses the rotated credential after the approved restart or reload and the previous credential stops working. That observed result would support another specific correction: Plan the application's secret consumption and restart or reload behavior for environment variables versus mounted volumes. The other scenario concerns: A security engineer rotates a Secret but forgets that applications reading it through environment variables may require a restart. The current Maplewood Schools problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.

Set readOnlyRootFilesystem where supported and mount narrowly scoped writable directories needed by the process. That choice addresses a different foundational issue: A workload requires read-only source files but mounts its entire container root filesystem writable. The issue at Brookside Manufacturing is instead: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. It does not establish the required correction; the decisive verification would be: Only the intended application component can read the mounted secret in a controlled multi-container test.

Use a narrowly justified and reviewed exception process rather than weakening the baseline policy for an entire namespace. That choice addresses a different foundational issue: An admission policy blocks privileged containers in production but the team bypasses it by adding broad namespace exemptions. The issue at Brookside Manufacturing is instead: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. It does not establish the required correction; the decisive verification would be: Only the intended application component can read the mounted secret in a controlled multi-container test.

Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. That choice addresses a different foundational issue: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The issue at Brookside Manufacturing is instead: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. It does not establish the required correction; the decisive verification would be: Only the intended application component can read the mounted secret in a controlled multi-container test.

An authorization test allows the namespace resource and rejects access to a forbidden namespace or cluster-scoped object. That observed result would support another specific correction: Apply least-privilege RoleBindings and distinguish namespaced permissions from cluster-wide authorization. The other scenario concerns: A cluster user assumes Kubernetes RBAC grants access to all resources because they have access to one namespace. The current Brookside Manufacturing problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.

A container inspection shows no broad host filesystem mount and the approved workload remains functional. That observed result would support another specific correction: Remove unnecessary hostPath mounts and use scoped volumes or supported APIs for legitimate data exchange. The other scenario concerns: A development workload mounts the host root filesystem for convenient file access and expands the blast radius of a compromise. The current Brookside Manufacturing problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.

A controlled test shows default reachability and then verifies the intended default-deny policy after enforcement is installed. That observed result would support another specific correction: Explain that Pod-to-Pod connectivity is generally permitted unless effective network restrictions are configured. The other scenario concerns: A team assumes every running Pod is isolated from all other Pods by default without NetworkPolicy. The current Brookside Manufacturing problem is: An operator expects a Kubernetes Secret resource alone to prevent disclosure of a mounted credential to every process in its Pod. The evidence required here is: Only the intended application component can read the mounted secret in a controlled multi-container test.