You save $69.98
Application developers can export signing private keys from a regular filesystem after completing a CI deployment. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Protected key generation and sign operations reduce theft through ordinary build accounts. Compromised authorized signers can still request bad signatures; approval workflows matter.
Build administrators can export the private material and bypass signing trust boundaries.
Public-key distribution does not secure the corresponding private signing key.
A secret variable accessible to untrusted builds is still exportable signing material.
The organization implemented the response to this scenario: Application developers can export signing private keys from a regular filesystem after completing a CI deployment. The approved response was: Keep sensitive signing keys in access-controlled HSM-backed nonexportable operations with independent administration. Which statement MOST accurately identifies a remaining risk or constraint?
Protected key generation and sign operations reduce theft through ordinary build accounts. A developer can submit authorized signing requests but cannot extract private key material.
An attacker with valid signing permission can still submit harmful content for signing.
Signing operations themselves need independent authorization and policy.
An attacker controlling the authorized decrypting principal can still export key material.
Management implemented a response after this event: Application developers can export signing private keys from a regular filesystem after completing a CI deployment. The response was: Keep sensitive signing keys in access-controlled HSM-backed nonexportable operations with independent administration. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A developer can submit authorized signing requests but cannot extract private key material. Protected key generation and sign operations reduce theft through ordinary build accounts.
Artifact encryption does not demonstrate nonexportability of the signing credential.
A device’s presence does not prove every effective extraction path is denied.
A correct signature proves the key worked, not that private-key custody is secure.
A CI runner executes pull-request containers as privileged root with host filesystem mounts, enabling untrusted tests to inspect production secrets. Which redesign best limits container escape and lateral access?
Container images and jobs may include adversarial code. Privileged containers and host mounts collapse host/process isolation and expose secrets unrelated to tests.
Static scanning does not remove runtime privileges that allow host filesystem access or container breakout.
Root access expands compromise impact instead of isolating untrusted build code.
Path obscurity cannot prevent privileged workloads from reading an accessible mounted directory.
A CI platform removes privileged containers and host mounts for untrusted pull requests. Which additional boundary must still be protected?
Container runtime isolation reduces host exposure but does not automatically restrict outbound connections or accessible tokens provided to untrusted jobs.
A clean scan is not proof that arbitrary pull-request code should receive highly privileged secrets.
Shared broad keys erase the trust separation between unreviewed and approved code.
A sandbox may still make network requests to sensitive internal or external services.
A software factory claims untrusted pull-request containers are isolated from host secrets and production infrastructure. Which adversarial test most directly checks the claim?
An explicit negative isolation exercise and positive build check test the runner’s actual authority boundaries.
Test completion is irrelevant when the job can access privileged host secrets.
Static image health does not verify runtime containment against host access.
Stated configuration without enforcement is a failed isolation control.
A small serverless invoice function uses an account-wide administrator role to read one billing table. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Managed compute does not remove customer responsibility for excessive function permissions. An execution token stolen from a vulnerable function may still be abused within its allowed scope.
Managed compute does not remove customer responsibility for function execution privileges.
Network controls do not eliminate excess API permissions granted to the identity.
Shared broad authorization increases compromise impact across applications.
The organization implemented the response to this scenario: A small serverless invoice function uses an account-wide administrator role to read one billing table. The approved response was: Scope the function identity to required data actions and enforce downstream resource boundaries. Which statement MOST accurately identifies a remaining risk or constraint?
Managed compute does not remove customer responsibility for excessive function permissions. Authorized invoice reads work, while unrelated table deletion and key-management operations fail.
A stolen scoped identity can still abuse the resources and operations it is permitted to use.
Physical infrastructure assurance is separate from workload authorization.
Read access itself can be abused if business-level authorization or data scope is too broad.
Management implemented a response after this event: A small serverless invoice function uses an account-wide administrator role to read one billing table. The response was: Scope the function identity to required data actions and enforce downstream resource boundaries. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Authorized invoice reads work, while unrelated table deletion and key-management operations fail. Managed compute does not remove customer responsibility for excessive function permissions.
Positive function behavior does not verify denial of excessive permissions.
Service model labels cannot establish least privilege.
Source hygiene cannot substitute for effective IAM negative-permission tests.
A plant's programmable controller cannot be restarted safely during production, but IT schedules an automatic firmware update. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
OT availability and human safety constraints change acceptable patch methods and timing. An isolated plant still needs monitoring and a tested emergency shutdown procedure.
A disruptive update without safety approval can endanger equipment and people.
Scheduling constraints do not justify ignoring interim segmentation and monitoring.
Corporate automation must account for industrial process state and approved maintenance procedures.
The organization implemented the response to this scenario: A plant's programmable controller cannot be restarted safely during production, but IT schedules an automatic firmware update. The approved response was: Use safety-engineered maintenance planning and segmented compensating controls with approved vendor procedures. Which statement MOST accurately identifies a remaining risk or constraint?
OT availability and human safety constraints change acceptable patch methods and timing. A dry-run change plan demonstrates safe state, rollback and approved maintenance window.
Even segregated OT systems need monitoring, controlled access and tested safe shutdown.
Patching priorities must account for industrial hazard and safe maintenance constraints.
Safety-engineered procedures need rehearsed failure handling and vendor compatibility checks.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
