Question 470
Multiple teams provision service accounts from scripts, but the resulting roles have no owner and changes cannot be linked to tickets. Which limitation must be considered before claiming the issue is fully resolved?
Explanation
Correct Answer
A generated resource name is not proof of accountable approval. This caution prevents extrapolating beyond the specific evidence or product boundary. Automation quality includes governance, provenance and verification. The unresolved point should be tested using service account inventory, script execution logs and approval records rather than assuming a working interface proves full compliance or resilience.
Incorrect Answers
Automation removes the need to audit identity provisioning decisions. This limitation is framed as a blanket exception, but the case requires a different, narrower caution. The relevant boundary is that a generated resource name is not proof of accountable approval. Automation quality includes governance, provenance and verification. Inspect service account inventory, script execution logs and approval records.
Service account naming conventions are an adequate replacement for authorization records. The proposed claim mistakes an incomplete signal or product feature for a universal guarantee. The relevant boundary is that a generated resource name is not proof of accountable approval. Automation quality includes governance, provenance and verification. Inspect service account inventory, script execution logs and approval records.
An automated identity automatically has a legitimate service owner. This claim exceeds the evidence and ignores an important risk or operational dependency. The relevant boundary is that a generated resource name is not proof of accountable approval. Automation quality includes governance, provenance and verification. Inspect service account inventory, script execution logs and approval records.