You save $69.98
A dynamic web scanner tests only the public login page but misses role-specific internal APIs. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Runtime tests require representative authenticated access to detect protected endpoint flaws. A successful scanner login does not establish role/tenant authorization coverage.
Unauthenticated DAST misses authorization and input flows reachable after sign-in.
A single privileged perspective can obscure horizontal and cross-role authorization faults.
Visual coverage is not runtime authorization assessment.
The organization implemented the response to this scenario: A dynamic web scanner tests only the public login page but misses role-specific internal APIs. The approved response was: Run appropriately authorized DAST sessions representing user roles and negative cross-role behavior. Which statement MOST accurately identifies a remaining risk or constraint?
Runtime tests require representative authenticated access to detect protected endpoint flaws. Admin and ordinary user sessions test both allowed and denied paths across relevant APIs.
Authentication itself does not establish test coverage across privileges and routes.
Cross-role authorization needs explicit negative tests with distinct credentials.
A runtime tool cannot assess unreachable code paths without appropriate access.
Management implemented a response after this event: A dynamic web scanner tests only the public login page but misses role-specific internal APIs. The response was: Run appropriately authorized DAST sessions representing user roles and negative cross-role behavior. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Admin and ordinary user sessions test both allowed and denied paths across relevant APIs. Runtime tests require representative authenticated access to detect protected endpoint flaws.
A login-page test does not demonstrate protected role behavior.
Positive privileged access is not negative authorization proof.
Completion status alone cannot establish meaningful test coverage.
An application’s cloud API key appears in a public source commit. Developers delete the literal from the latest commit, but the build still authenticates using that key. What is the BEST immediate remediation?
A key remains compromised after deletion from a visible revision because copies may exist in history or external caches. Rotation stops use of known credentials; ephemeral scoped identity reduces recurrence.
The compromised credential may already be known to attackers and remains valid regardless of source-file appearance.
Changing the identifier does nothing to invalidate copied secret material.
Privacy setting changes cannot recall previously copied secrets or revoke active authentication tokens.
A leaked cloud API key has been revoked and the release pipeline now uses short-lived workload identity. The team removes the exposed string from the latest commit, but cloned repository histories and build logs may contain other service credentials. What is the MOST important remaining exposure to investigate?
Revoking one leaked API key does not contain other secrets already visible in copied history or CI artifacts. Search/limit exposure and rotate each compromised credential; this is distinct from testing token issuer/audience conditions.
History and distributed clones retain copies; the current tree says nothing about other secrets disclosed in earlier jobs.
Reintroducing a reusable privileged key recreates exposure and offers no security benefit to the federated pipeline.
Visibility changes cannot recall prior copies or revoke any unrelated leaked tokens.
An enterprise claims a public CI secret leak has been contained and its replacement workflow has least privilege. What test is strongest?
The test addresses actual revocation, authorized functionality and negative federation trust boundaries.
A clean diff is not credential revocation; attackers may hold the old value.
Functional success with long-lived broad privileges repeats the unsafe secret model.
Limited scanning does not establish containment or improved runtime authorization.
Two production regions rebuild the same Git tag and ship different dependency versions. Which release design BEST ensures they run identical approved bytes?
Rebuilding mutable inputs can produce different binaries despite identical source tags.
A tag does not freeze external dependencies or all build-tool inputs.
Human-readable versions are not cryptographic proof of artifact identity.
Skipping supply-chain validation can worsen risk and does not ensure deterministic output.
An immutable artifact is signed and promoted by digest. What residual risk STILL exists?
A valid signature proves the signer, not automatically that produced code is safe.
Authenticity is not comprehensive vulnerability assurance.
A cryptographic digest is intended to expose content changes.
Who may promote artifacts remains a separate access-control decision.
Which test BEST demonstrates artifact promotion integrity across two regions?
Byte identity and trusted provenance bind both deployments to the reviewed supply-chain outcome.
Labels can match while dependency bytes and compiled artifacts differ.
Memory cannot prove cryptographic identity or dependency provenance.
Job completion does not prove deployed packages match the approved artifact.
Pull requests from untrusted contributors run on self-hosted privileged runners with live production credentials. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Untrusted code can execute inside CI and steal secrets or alter host state. Repository branch protection is insufficient if workflow triggers expose secrets to unreviewed jobs.
Attacker-controlled test steps may steal secrets or alter the host and production resources.
Untrusted contributors must not have a path to production secrets.
Repository settings cannot replace isolated execution and credential release boundaries.
The organization implemented the response to this scenario: Pull requests from untrusted contributors run on self-hosted privileged runners with live production credentials. The approved response was: Isolate untrusted builds and withhold sensitive credentials and deployment authority until trusted approval. Which statement MOST accurately identifies a remaining risk or constraint?
Untrusted code can execute inside CI and steal secrets or alter host state. A malicious test PR cannot access protected tokens or modify production resources.
Workflow event semantics and runner permissions can expose secrets despite branch rules.
Artifact signatures need trusted build identity and source/process provenance.
Short lifetime does not remove immediate exfiltration opportunities.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
