Exam Bundle

This result applies to a different case: A wireless security review notes that unauthenticated traffic can trigger large retransmission storms. Radio protocol abuse can affect availability without credential compromise. It does not establish the present requirement, where the evidence notes frame anomalies without active fuzzing on production equipment. The relevant evidence is: The evidence notes frame anomalies without active fuzzing on production equipment.

That approach concerns a different situation: a company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. Service-disruption methods require explicit risk and impact authorization. The required result is that the evidence notes frame anomalies without active fuzzing on production equipment. The relevant evidence is: The evidence notes frame anomalies without active fuzzing on production equipment.

That relates to a different issue: A site uses WPS PIN enrollment on an access point that does not require it. Weak enrollment mechanisms may expose network credentials independently of WPA data encryption. That is not a direct remedy for the requested outcome: The evidence notes frame anomalies without active fuzzing on production equipment. The relevant evidence is: The evidence notes frame anomalies without active fuzzing on production equipment.

It would address a service operator cannot determine whether a cloud attack attempt originated from a stolen temporary token. The relevant reason in that case is: Temporary credential abuse requires identity and control-plane evidence. Here the required success condition is a synthetic access event creates a retained attributable record. The relevant evidence is: A synthetic access event creates a retained attributable record.

That approach concerns a different situation: a container runtime allows an ordinary workload to access its orchestration API with cluster-admin privileges. Runtime identities can grant control of the wider container cluster. The required result is that a synthetic access event creates a retained attributable record. The relevant evidence is: A synthetic access event creates a retained attributable record.

That relates to a different issue: A cloud VM snapshot is shared with another account unintentionally. Data snapshots can disclose sensitive disk content outside running systems. That is not a direct remedy for the requested outcome: A synthetic access event creates a retained attributable record. The relevant evidence is: A synthetic access event creates a retained attributable record.

That relates to a different issue: A cloud application trusts a third-party integration with tenant-wide token privileges. Third-party integrations can hold persistent cloud credentials. That is not a direct remedy for the requested outcome: An unapproved account cannot read the snapshot metadata or data. The relevant evidence is: An unapproved account cannot read the snapshot metadata or data.

It would address a cloud project has a cross-account role trust that permits principals outside the expected partner organization. The relevant reason in that case is: Cross-account trust can expand reach beyond intended organizational boundaries. Here the required success condition is an unapproved account cannot read the snapshot metadata or data. The relevant evidence is: An unapproved account cannot read the snapshot metadata or data.

That approach concerns a different situation: a workload pod mounts the host filesystem and runs privileged with no operational need. Weak container isolation increases opportunities for host-level impact. The required result is that an unapproved account cannot read the snapshot metadata or data. The relevant evidence is: An unapproved account cannot read the snapshot metadata or data.

That approach concerns a different situation: an incident team finds a suspicious process invoking remote PowerShell but no indication of the target machine. Remote management artifacts must be connected to endpoints to assess movement. The required result is that the report separately classifies credential use and execution evidence. The relevant evidence is: The report separately classifies credential use and execution evidence.

That relates to a different issue: An authorized lab shows remote administrative tasks created through WMI. WMI supports legitimate management as well as remote execution activity. That is not a direct remedy for the requested outcome: The report separately classifies credential use and execution evidence. The relevant evidence is: The report separately classifies credential use and execution evidence.

It would address a tester's lab traffic from a pivot host reaches a protected subnet not accessible directly. The relevant reason in that case is: Pivoting uses an intermediate host to reach another zone. Here the required success condition is the report separately classifies credential use and execution evidence. The relevant evidence is: The report separately classifies credential use and execution evidence.

That approach concerns a different situation: a search endpoint concatenates raw query text into SQL statements. Data must not be interpreted as SQL syntax during query construction. The required result is that a synthetic external include URL is rejected by the application. The appropriate action is: Identify remote file inclusion risk and restrict executable include sources.

That relates to a different issue: A file-conversion service passes filenames directly to a system shell. Shell metacharacters can change command execution when inputs are concatenated. That is not a direct remedy for the requested outcome: A synthetic external include URL is rejected by the application. The appropriate action is: Identify remote file inclusion risk and restrict executable include sources.

It would address a web gateway trusts an unsigned JWT claim that a user is an administrator. The relevant reason in that case is: Untrusted token content must never grant privileged API access. Here the required success condition is a synthetic external include URL is rejected by the application. The appropriate action is: Identify remote file inclusion risk and restrict executable include sources.

This action applies to a different case: An endpoint protection tool flags a suspicious LOLBin process, but no malicious action is confirmed. Legitimate system binaries can support both administration and abuse. It does not establish the present requirement, where a test account performs the intended maintenance action but not arbitrary commands. The appropriate action is: Reduce sudoers rules to the required narrowly scoped command.

That approach concerns a different situation: a Linux helper binary has setuid enabled despite no demonstrated business requirement. Setuid changes execution privileges and can increase escalation impact. The required result is that a test account performs the intended maintenance action but not arbitrary commands. The appropriate action is: Reduce sudoers rules to the required narrowly scoped command.

That relates to a different issue: A security agent is disabled by an ordinary user with local permissions. Endpoint safeguards must resist unauthorized security-control changes. That is not a direct remedy for the requested outcome: A test account performs the intended maintenance action but not arbitrary commands. The appropriate action is: Reduce sudoers rules to the required narrowly scoped command.

That relates to a different issue: A client wants to evaluate an old Telnet management interface without reading passwords. Telnet lacks built-in encrypted session protection. That is not a direct remedy for the requested outcome: The lab log shows the spoofed mapping was not adopted. The appropriate action is: Record the defensive behavior and avoid escalating beyond authorized proof.

It would address a packet trace shows ARP responses for the same IP from conflicting MAC addresses. The relevant reason in that case is: ARP trust can allow local interception when endpoint mappings are falsified. Here the required success condition is the lab log shows the spoofed mapping was not adopted. The appropriate action is: Record the defensive behavior and avoid escalating beyond authorized proof.

That approach concerns a different situation: a printer fleet retains manufacturer default passwords on its administrative pages. Default credentials can expose management functions without any software exploit. The required result is that the lab log shows the spoofed mapping was not adopted. The appropriate action is: Record the defensive behavior and avoid escalating beyond authorized proof.

That approach concerns a different situation: an organization wants publicly exposed SSL certificate history for a retired hostname. Certificates can reveal previously registered names and issuance chronology. The required result is that the report labels technology inferences as unconfirmed until supported by other evidence. The relevant evidence is: The report labels technology inferences as unconfirmed until supported by other evidence.

That relates to a different issue: A client asks testers to discover public subdomains without sending packets to the client's servers. Certificate issuance logs expose hostnames passively but do not prove current ownership. That is not a direct remedy for the requested outcome: The report labels technology inferences as unconfirmed until supported by other evidence. The relevant evidence is: The report labels technology inferences as unconfirmed until supported by other evidence.

This result applies to a different case: A tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. Reverse names provide attribution hints but are not reliable proof of asset ownership. It does not establish the present requirement, where the report labels technology inferences as unconfirmed until supported by other evidence. The relevant evidence is: The report labels technology inferences as unconfirmed until supported by other evidence.

This result applies to a different case: A workstation appears compromised below normal process-monitor visibility. Kernel or low-level compromise can hide from ordinary host tools. It does not establish the present requirement, where a controlled network capture confirms the listening orientation. The relevant evidence is: A controlled network capture confirms the listening orientation.

That approach concerns a different situation: a lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. Scheduled execution can restore a foothold without an interactive login. The required result is that a controlled network capture confirms the listening orientation. The relevant evidence is: A controlled network capture confirms the listening orientation.

It would address a Windows machine auto-starts an unapproved process from a user-controlled registry Run key. The relevant reason in that case is: Autostart registry paths can launch programs at sign-in. Here the required success condition is a controlled network capture confirms the listening orientation. The relevant evidence is: A controlled network capture confirms the listening orientation.

It would address a customer has stale machine account certificates with expired owners. The relevant reason in that case is: Key and certificate hygiene prevents service interruption and untrusted identity reuse. Here the required success condition is an unapproved test drive is blocked and recorded. The appropriate action is: Enforce removable-media policy and endpoint device controls.

That approach concerns a different situation: a production app stores an API key in a publicly readable deployment manifest. Secret revocation is necessary after disclosure; merely hiding a file is insufficient. The required result is that an unapproved test drive is blocked and recorded. The appropriate action is: Enforce removable-media policy and endpoint device controls.

That relates to a different issue: Physical testing shows unauthorized visitors can follow staff into a secure data center. Anti-tailgating controls reduce unauthorized physical entry. That is not a direct remedy for the requested outcome: An unapproved test drive is blocked and recorded. The appropriate action is: Enforce removable-media policy and endpoint device controls.