Domain 7: Security/Compliance

IBM Certified Instana Observability v1.0.277 Administrator - Professional · 35 questions

• A junior security analyst needs to view Instana dashboards, service maps, and metric trends to support daily operations reporting. However, the analyst must not be permitted to create or modify alert policies, edit application perspectives, or manage users. Which built-in Instana role should the administrator assign?
• Your enterprise identity team has provisioned Instana as a SAML 2.0 Service Provider and wants employees to authenticate using corporate credentials from Okta as the Identity Provider. Which configuration step must the Instana administrator complete in the Instana Settings to enable SAML SSO?
• During a security incident investigation, the SOC team discovers that an Instana API token used by an automated deployment pipeline has been exfiltrated and may have already been used to query monitoring data. What is the correct immediate remediation action for the Instana administrator?
• Your organization's data governance policy mandates that observability data — including metrics, traces, and logs — must not be retained beyond 90 days. As the Instana self-hosted administrator, which approach correctly controls the data retention period for collected monitoring data?
• A security engineer auditing Instana deployments finds that several agents are configured to communicate with the Instana backend over an unencrypted channel. Which agent configuration change ensures all agent-to-backend communication is encrypted with TLS?
• The information security team wants Instana to automatically evaluate all discovered infrastructure components against security benchmark rules — such as verifying that SSH root login is disabled and that unused network services are not running — and surface any violations in a centralized view. Which Instana capability fulfills this requirement?
• Following a suspected insider threat incident, the security team requests a complete record of all configuration changes, user logins, and administrative actions performed within the Instana tenant over the past 45 days. Which Instana feature provides this information?
• Your security architecture requires that the Instana backend not only present a valid TLS certificate to agents, but also that each agent authenticate itself to the backend using a client certificate — implementing mutual TLS (mTLS). Which configuration correctly implements this requirement?
• A cloud operations team wants Instana to automatically identify software packages running on monitored hosts that have known Common Vulnerabilities and Exposures (CVEs) and display their severity scores alongside the affected infrastructure components. Which Instana feature directly provides this capability?
• An application monitored by Instana is passing user passwords and credit card numbers as HTTP query parameters, and these values are appearing unredacted in captured trace spans visible to all Instana users with trace access. Which Instana configuration prevents this sensitive data from being stored and displayed in traces?
• How should telemetry retention be decided for an Instana deployment?
• A team is creating an API token for an automation script that reads Instana data. How should the token be handled?
• What is the purpose of Instana's audit logs?
• How should access to Instana be structured for an organisation with several teams?
• Why is deleting telemetry immediately after an alert has fired a poor retention practice?
• Why should automation use a purpose-created token rather than an administrator's personal token?
• Why must audit history not be editable by users?
• What is the main problem with sharing one administrator account across teams?
• An organisation is subject to a regulation requiring certain records to be kept for a defined period. How should this affect retention planning?
• What is the risk of never rotating an Instana API token?
• An organisation proposes disabling audit logs to reduce storage consumption. What is the main objection?
• Which question is an Instana audit log best suited to answer?
• Why should dashboard viewers not be granted full access?
• What is the practical drawback of retaining all telemetry indefinitely?
• What does scoping an API token to a specific task achieve?
• Why are audit logs not a substitute for application traces?
• Why can an alert channel not serve as an access-control mechanism?
• Which retention approach best serves an environment with both routine operational troubleshooting and a compliance obligation on audit records?
• An API token has been pasted into a widely visible internal dashboard. What is the correct response?
• A compliance review asks who granted an elevated permission in Instana three months ago. Which source answers this?
• What is the practical advantage of assigning permissions through groups rather than to individual users?
• Which statement best summarises how retention should be planned?
• Which statement best summarises API token practice for Instana automation?
• Which statement best summarises the role of audit logs in Instana?
• Which statement best summarises correct permission design in Instana?