Which Control Blocks Unauthorized Agentic Shell Commands?
A security alert triggers an agentic system. An analyst notices the following payload in the logs”
The alert includes multiple shell commands that are not typically run as part of any hardening. Which of the following is the most effective control to implement?
Community Insight
The question tests runtime control of an agentic system's shell execution; the trap is picking a supply-chain control (approved libraries) instead of validating the actual commands before they run.
When an agentic AI system triggered by a security alert starts executing shell commands that no hardening workflow would run, the strongest fix is to gate execution behind an allowlist of approved command strings. This page shows why pre-execution command allowlisting (option A) beats library restrictions, tag suppression, or retiring the model.
Option D is the popular wrong pick — the lone community comment voted D reasoning that "allowlisting will be needed here" — but restricting libraries only governs what code the agent imports, not the arbitrary shell commands already appearing in the logs.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A directly intercepts the observed behavior: shell commands that no hardening procedure would legitimately run. Placing logic that matches each command against an approved set of strings before execution converts the agent from free-form shell access to an allowlisted command vocabulary, which is the classic least-functionality control for AI agents. Because the payload is already visible in the logs as raw command text, a pre-execution allowlist is the only option that sits on the exact path the malicious commands travel. It also fails closed, so an injected or hallucinated command never reaches the shell.Why the Other Options Are Wrong
Option D — using only approved libraries — addresses software supply-chain risk for packages the agent imports; it does nothing about the shell strings the agent is already issuing at runtime, which is the actual alert. Option C would have the application ignore the SECURITY_UPDATE tag, disabling a detection signal rather than preventing execution, so it weakens monitoring instead of adding a control. Option B, deprecating model usage while keeping the model with safer parameters, is disproportionate and still leaves the agent capable of running arbitrary shell commands if it is retained in service.Community Comment Notes
Kristen8730 voted D on the grounds that "allowlisting will be needed here," but the allowlisting that applies here is allowlisting of shell commands before execution, which is exactly what option A describes. Approved libraries are a different allowlist target (dependencies, not commands), so the comment's reasoning actually supports A once the payload's shell commands are considered. No other comments were posted, so the vote distribution gives no further signal on this item.Official Reference
Exam Strategy
Read what the logs actually show and match the control to that artifact: shell command text in the payload points to a pre-execution command allowlist, not a dependency or model-lifecycle control. Eliminate any option that suppresses detection (ignoring tags) or overreacts (deprecating the model) before comparing the remaining choices.
Frequently Asked Questions
Why is restricting the system to approved libraries not enough for this alert?
Approved libraries only control which dependencies the agent can import, while the alert shows arbitrary shell command strings reaching execution. You need validation of the commands themselves, not just the packages.
Why not just ignore the SECURITY_UPDATE tag or retire the model?
Ignoring SECURITY_UPDATE tag removes a detection signal and makes the system blind rather than secure. Deprecating the model is an overreaction that still leaves an agent capable of running shell commands.