You save $69.98
The organization implemented the response to this scenario: Pull requests from untrusted contributors run on self-hosted privileged runners with live production credentials. The approved response was: Isolate untrusted builds and withhold sensitive credentials and deployment authority until trusted approval. Which statement MOST accurately identifies a remaining risk or constraint?
Untrusted code can execute inside CI and steal secrets or alter host state. A malicious test PR cannot access protected tokens or modify production resources.
Workflow event semantics and runner permissions can expose secrets despite branch rules.
Artifact signatures need trusted build identity and source/process provenance.
Short lifetime does not remove immediate exfiltration opportunities.
Management implemented a response after this event: Pull requests from untrusted contributors run on self-hosted privileged runners with live production credentials. The response was: Isolate untrusted builds and withhold sensitive credentials and deployment authority until trusted approval. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A malicious test PR cannot access protected tokens or modify production resources. Untrusted code can execute inside CI and steal secrets or alter host state.
The untrusted build isolation boundary is missing.
Functional success is not evidence of protected CI secret handling.
Repository approvals do not demonstrate restricted workflow execution.
A project claims secure coding success because it has zero open bugs without tracking escaped vulnerabilities. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Empty bug queues can indicate missing detection rather than genuinely secure software. Security metrics can be gamed if teams optimize counts instead of user-impacting outcomes.
No tickets may indicate under-detection rather than low defect incidence.
Ticket volume incentives can hide high-impact recurring vulnerabilities.
Without outcome measures leadership cannot assess real delivered risk reduction.
The organization implemented the response to this scenario: A project claims secure coding success because it has zero open bugs without tracking escaped vulnerabilities. The approved response was: Measure escape rates, severity, detection time and recurring root causes alongside ticket backlog. Which statement MOST accurately identifies a remaining risk or constraint?
Empty bug queues can indicate missing detection rather than genuinely secure software. Trend reports show reduced exploitable defects and improved detection coverage across releases.
A queue counts known findings, not every weakness or missed attack path.
Metrics need multiple perspectives and review of incentives and detection practices.
Root-cause correction and preventive practices are separate requirements.
Management implemented a response after this event: A project claims secure coding success because it has zero open bugs without tracking escaped vulnerabilities. The response was: Measure escape rates, severity, detection time and recurring root causes alongside ticket backlog. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Trend reports show reduced exploitable defects and improved detection coverage across releases. Empty bug queues can indicate missing detection rather than genuinely secure software.
Absence of reported issues is not proof of security effectiveness.
Work volume does not demonstrate preventive quality gains.
Delivery throughput cannot measure actual exploit-risk reduction.
An engineer can force-push release branches and erase review history after production deployment. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
Tamper-resistant provenance links deployed code to approved change decisions. Signing commits alone cannot guarantee the signer's authority or a safe code review.
History rewriting undermines traceability from production code to approved reviews.
Mutable labels cannot prove exact code provenance.
Erasing evidence prevents reconstruction of authorization and released artifacts.
The organization implemented the response to this scenario: An engineer can force-push release branches and erase review history after production deployment. The approved response was: Use protected version control, signed or attributable changes and preserved review/build evidence. Which statement MOST accurately identifies a remaining risk or constraint?
Tamper-resistant provenance links deployed code to approved change decisions. A released build traces to an immutable approved change, tests and accountable reviewer.
Cryptographic identity is separate from workflow authorization and review quality.
Mutable tags and dependency resolution can lead to different artifacts.
Source provenance alone does not show which artifact was promoted under which approval.
Management implemented a response after this event: An engineer can force-push release branches and erase review history after production deployment. The response was: Use protected version control, signed or attributable changes and preserved review/build evidence. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
A released build traces to an immutable approved change, tests and accountable reviewer. Tamper-resistant provenance links deployed code to approved change decisions.
Missing provenance prevents accountable change assurance.
A mutable label is not stable release evidence.
Test completion does not demonstrate attributable release governance.
A team patches an SQL injection flaw but its new regression test only checks one harmless input. As the accountable security practitioner, which response BEST addresses the specific weakness without introducing a different untested control?
A fix can reproduce the same assumption and leave alternative malformed inputs exploitable. One test cannot prove all future inputs are safe, so enforce safer implementation patterns.
One happy-path input cannot explore alternative syntax, encodings or authorization bypass.
A partial surface fix does not address the underlying vulnerable code path.
Pattern-specific test success is not structural prevention of query injection.
The organization implemented the response to this scenario: A team patches an SQL injection flaw but its new regression test only checks one harmless input. The approved response was: Write negative and adversarial requirements-based regression tests for equivalent injection paths. Which statement MOST accurately identifies a remaining risk or constraint?
A fix can reproduce the same assumption and leave alternative malformed inputs exploitable. Malicious input variations remain data and cannot change query structure or permissions.
Regression coverage should include meaningful variants and safer implementation patterns.
Ad hoc filtering can fail under syntax and encoding variations.
Preventing SQL syntax injection and enforcing data entitlement are distinct controls.
Management implemented a response after this event: A team patches an SQL injection flaw but its new regression test only checks one harmless input. The response was: Write negative and adversarial requirements-based regression tests for equivalent injection paths. Which observed outcome BEST verifies that the intended security protection operates, rather than merely appearing in a plan?
Malicious input variations remain data and cannot change query structure or permissions. A fix can reproduce the same assumption and leave alternative malformed inputs exploitable.
A narrow regression did not cover equivalent injection paths.
UI validation is not safe query construction at the data boundary.
Injection prevention alone does not establish object authorization.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (484 Questions, Last Updated on Oct 31, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
