Exam Bundle

This result applies to a different case: An assessor finds an apparently exposed cloud access key in a web app's client bundle. A visible string may be a test key, limited token, or revoked credential. It does not establish the present requirement, where the endpoint list includes owner-approved paths and access methods. The relevant evidence is: The endpoint list includes owner-approved paths and access methods.

That approach concerns a different situation: a service responds with a detailed stack trace that names its web framework and local file path. Verbose errors can expose implementation details useful for attack planning. The required result is that the endpoint list includes owner-approved paths and access methods. The relevant evidence is: The endpoint list includes owner-approved paths and access methods.

That relates to a different issue: A site map lists admin pages under a different product hostname than the approved portal. Discovery by crawling must not override hostname restrictions. That is not a direct remedy for the requested outcome: The endpoint list includes owner-approved paths and access methods. The relevant evidence is: The endpoint list includes owner-approved paths and access methods.

It would address a cloud customer expects a penetration tester to patch provider-managed hypervisor vulnerabilities. The relevant reason in that case is: The infrastructure provider retains responsibility for managed platform layers. Here the required success condition is the project file includes owner identity and a signed permission letter. The appropriate action is: Obtain a signed authorization letter from an accountable asset owner.

This action applies to a different case: An assessor wants to use credential spraying although the signed rules prohibit account lockouts. Potential lockouts violate explicit testing restrictions without changed authorization. It does not establish the present requirement, where the project file includes owner identity and a signed permission letter. The appropriate action is: Obtain a signed authorization letter from an accountable asset owner.

That approach concerns a different situation: a signed asset list contains both public DNS names and a private VPN address range. Identifiers describe scope but DNS mappings and ownership can change. The required result is that the project file includes owner identity and a signed permission letter. The appropriate action is: Obtain a signed authorization letter from an accountable asset owner.

That relates to a different issue: A penetration test report opens with a 100-page packet capture and no management overview. Executives need decisions without parsing raw technical artifacts. That is not a direct remedy for the requested outcome: An authorized reviewer can validate the finding using the report evidence. The appropriate action is: Record affected asset, evidence, conditions, and safe reproduction context.

It would address a tester identifies weak controls but omits any relevant client acceptance criteria. The relevant reason in that case is: Stakeholder acceptance depends on traceable results. Here the required success condition is an authorized reviewer can validate the finding using the report evidence. The appropriate action is: Record affected asset, evidence, conditions, and safe reproduction context.

This action applies to a different case: A client disputes the report because screenshots reveal an uninvolved customer's record. Evidence must remain sufficient without leaking unnecessary information. It does not establish the present requirement, where an authorized reviewer can validate the finding using the report evidence. The appropriate action is: Record affected asset, evidence, conditions, and safe reproduction context.

This result applies to a different case: A packet trace shows ARP responses for the same IP from conflicting MAC addresses. ARP trust can allow local interception when endpoint mappings are falsified. It does not establish the present requirement, where the report records safe authentication evidence and the required reset control. The relevant evidence is: The report records safe authentication evidence and the required reset control.

That approach concerns a different situation: a test host's ARP poisoning protection rejects an untrusted gateway claim. Network access checks can prevent an on-path position before application traffic. The required result is that the report records safe authentication evidence and the required reset control. The relevant evidence is: The report records safe authentication evidence and the required reset control.

It would address a network team wants safe evidence that its service account cannot authenticate to unrelated SMB hosts. The relevant reason in that case is: A service account's trust scope affects lateral movement potential. Here the required success condition is the report records safe authentication evidence and the required reset control. The relevant evidence is: The report records safe authentication evidence and the required reset control.

It would address two analysts assign different risk levels to identical exposures. The relevant reason in that case is: Risk ratings require documented criteria to be comparable. Here the required success condition is the final deliverable matches the client's approved reporting format. The relevant evidence is: The final deliverable matches the client's approved reporting format.

This result applies to a different case: A report includes an 'all systems secure' claim even though only a subnet was tested. Penetration tests cannot establish universal absence of vulnerabilities. It does not establish the present requirement, where the final deliverable matches the client's approved reporting format. The relevant evidence is: The final deliverable matches the client's approved reporting format.

That relates to a different issue: A penetration test report opens with a 100-page packet capture and no management overview. Executives need decisions without parsing raw technical artifacts. That is not a direct remedy for the requested outcome: The final deliverable matches the client's approved reporting format. The relevant evidence is: The final deliverable matches the client's approved reporting format.

That relates to a different issue: A client's lab shows a service accepts authentication using an old expired ticket. Kerberos security depends on correctly enforced validity intervals. That is not a direct remedy for the requested outcome: A synthetic mismatched-audience token is denied. The appropriate action is: Validate OIDC issuer and audience enforcement.

This action applies to a different case: A test user's reset flow issues single-use tokens that remain valid after consumption. One-time recovery tokens should be invalidated after successful use. It does not establish the present requirement, where a synthetic mismatched-audience token is denied. The appropriate action is: Validate OIDC issuer and audience enforcement.

That approach concerns a different situation: a stolen application bearer token allows an API call without further challenge in a lab. Bearer tokens can authorize access for whoever possesses them. The required result is that a synthetic mismatched-audience token is denied. The appropriate action is: Validate OIDC issuer and audience enforcement.

That relates to a different issue: A model endpoint outputs confidential training examples when prompted with generic cues. Model behavior can expose sensitive memorized data. That is not a direct remedy for the requested outcome: A simulated unauthorized register write is blocked by the protective gateway. The relevant evidence is: A simulated unauthorized register write is blocked by the protective gateway.

It would address a point-of-sale device accepts unauthorized NFC interactions beyond its intended payment protocol. The relevant reason in that case is: Short-range communication still requires application-level authorization. Here the required success condition is a simulated unauthorized register write is blocked by the protective gateway. The relevant evidence is: A simulated unauthorized register write is blocked by the protective gateway.

This result applies to a different case: An app asks for contact-list access even though the business feature uses only a camera. Unnecessary mobile permissions expand sensitive data exposure. It does not establish the present requirement, where a simulated unauthorized register write is blocked by the protective gateway. The relevant evidence is: A simulated unauthorized register write is blocked by the protective gateway.

This action applies to a different case: The client asks which contract establishes general payment and liability terms across annual projects. An MSA typically governs the continuing commercial relationship. It does not establish the present requirement, where the exchanged diagrams are covered by a signed confidentiality agreement. The appropriate action is: Execute the non-disclosure agreement before exchanging sensitive architecture data.

That relates to a different issue: A client and supplier agree on ongoing terms, but the current test's exact hosts and dates are unrecorded. The statement of work defines this particular engagement's operational boundaries. That is not a direct remedy for the requested outcome: The exchanged diagrams are covered by a signed confidentiality agreement. The appropriate action is: Execute the non-disclosure agreement before exchanging sensitive architecture data.

It would address a cloud provider permits vulnerability scanning only under defined acceptable-use conditions. The relevant reason in that case is: A customer's permission cannot override a hosting provider's contractual constraints. Here the required success condition is the exchanged diagrams are covered by a signed confidentiality agreement. The appropriate action is: Execute the non-disclosure agreement before exchanging sensitive architecture data.

It would address an IoT controller is sensitive to unexpected network packets during a vulnerability assessment. The relevant reason in that case is: Industrial and embedded systems can fail under ordinary IT scan traffic. Here the required success condition is the result identifies relevant app version and secure remediation owner. The relevant evidence is: The result identifies relevant app version and secure remediation owner.

That approach concerns a different situation: an assessment finds a web service protected by a WAF that blocks many scanner patterns. WAF responses can mask vulnerabilities and reduce scan completeness. The required result is that the result identifies relevant app version and secure remediation owner. The relevant evidence is: The result identifies relevant app version and secure remediation owner.

That relates to a different issue: A small wireless network has neighboring SSIDs that must not be included in the client's assessment. SSID alone does not establish radio identity or scope ownership. That is not a direct remedy for the requested outcome: The result identifies relevant app version and secure remediation owner. The relevant evidence is: The result identifies relevant app version and secure remediation owner.

That relates to a different issue: A secure room's access logs show one badge opened the door repeatedly during an unoccupied shift. Access anomaly evidence is stronger when multiple sources agree. That is not a direct remedy for the requested outcome: A controlled visitor is denied at every relevant entrance. The appropriate action is: Document the bypass route and recommend consistent access enforcement.

This action applies to a different case: A visitor uses an authorized staff member's badge replica in a test access system. Copied credentials can bypass physical identity checks if unprotected. It does not establish the present requirement, where a controlled visitor is denied at every relevant entrance. The appropriate action is: Document the bypass route and recommend consistent access enforcement.

That approach concerns a different situation: a factory prohibits onsite photography but a tester wants to document an unmonitored side gate. Physical evidence collection remains bound by facility security policy. The required result is that a controlled visitor is denied at every relevant entrance. The appropriate action is: Document the bypass route and recommend consistent access enforcement.

That approach concerns a different situation: a web scanner claims SQL injection because a quote produces an HTTP 500 response. Generic server errors do not prove attacker-controlled SQL execution. The required result is that the resolved target outside the approved directory is denied. The relevant evidence is: The resolved target outside the approved directory is denied.

That relates to a different issue: An app downloads files based on a path parameter that accepts parent-directory components. Path normalization and authorization must prevent escaping a file root. That is not a direct remedy for the requested outcome: The resolved target outside the approved directory is denied. The relevant evidence is: The resolved target outside the approved directory is denied.

This result applies to a different case: A theme installer accepts an external URL that is included into server-side code execution. Server execution should not import untrusted remote code. It does not establish the present requirement, where the resolved target outside the approved directory is denied. The relevant evidence is: The resolved target outside the approved directory is denied.