Exam Bundle

It would address an assessor wants to use credential spraying although the signed rules prohibit account lockouts. The relevant reason in that case is: Potential lockouts violate explicit testing restrictions without changed authorization. Here the required success condition is each risk and task has an identified accountable party. The relevant evidence is: Each risk and task has an identified accountable party.

That approach concerns a different situation: a 24-hour assessment has only a two-hour approved production change window for exploitation. Operational windows may differ by activity and production sensitivity. The required result is that each risk and task has an identified accountable party. The relevant evidence is: Each risk and task has an identified accountable party.

That relates to a different issue: A client asks a contractor to test a partner-managed wireless network without notifying the partner. Shared-responsibility and third-party ownership restrict testing authority. That is not a direct remedy for the requested outcome: Each risk and task has an identified accountable party. The relevant evidence is: Each risk and task has an identified accountable party.

That relates to a different issue: A cloud service exposes an administrative dashboard on a public endpoint despite an internal-only design. Cloud service public access settings can override intended network trust boundaries. That is not a direct remedy for the requested outcome: A pipeline audit identifies immutable approved action versions. The appropriate action is: Pin trusted dependency revisions and review build permissions.

It would address a cloud identity policy grants wildcard actions on all resources to an automation job. The relevant reason in that case is: Overly broad IAM permissions expand compromise impact. Here the required success condition is a pipeline audit identifies immutable approved action versions. The appropriate action is: Pin trusted dependency revisions and review build permissions.

This action applies to a different case: A container runtime allows an ordinary workload to access its orchestration API with cluster-admin privileges. Runtime identities can grant control of the wider container cluster. It does not establish the present requirement, where a pipeline audit identifies immutable approved action versions. The appropriate action is: Pin trusted dependency revisions and review build permissions.

That relates to a different issue: A corporate access point sends users to a captive portal that allows arbitrary external form pages. Captive portals can be impersonated to harvest user credentials. That is not a direct remedy for the requested outcome: A controlled client rejects the untrusted access point. The appropriate action is: Investigate an evil-twin risk using approved radio monitoring and certificate verification.

It would address a survey sees a strong new radio using the office network name but its BSSID is not inventoried. The relevant reason in that case is: SSID duplication alone can be legitimate multi-access-point design. Here the required success condition is a controlled client rejects the untrusted access point. The appropriate action is: Investigate an evil-twin risk using approved radio monitoring and certificate verification.

This action applies to a different case: A tester wants to map an organization's access points while driving around neighboring offices. Radio proximity does not establish permission for active testing. It does not establish the present requirement, where a controlled client rejects the untrusted access point. The appropriate action is: Investigate an evil-twin risk using approved radio monitoring and certificate verification.

This action applies to a different case: A Bash host inventory script silently processes blank lines as targets. Input sanitation prevents accidental or malformed probe targets. It does not establish the present requirement, where a fixture yields separate access-denied, not-found, and throttled outcomes. The appropriate action is: Preserve status codes and explicitly distinguish 401, 403, 404, and 429.

That relates to a different issue: A script retries failed probes indefinitely when an endpoint is unavailable. Retry storms can cause avoidable service impact and unreliable results. That is not a direct remedy for the requested outcome: A fixture yields separate access-denied, not-found, and throttled outcomes. The appropriate action is: Preserve status codes and explicitly distinguish 401, 403, 404, and 429.

It would address a PowerShell inventory includes duplicate IPs from multiple subnets and scans them repeatedly. The relevant reason in that case is: Unnecessary probes increase risk and distort evidence counts. Here the required success condition is a fixture yields separate access-denied, not-found, and throttled outcomes. The appropriate action is: Preserve status codes and explicitly distinguish 401, 403, 404, and 429.

It would address a security engineer suspects steganography in images uploaded to an external content site. The relevant reason in that case is: Hidden payloads may exist within apparently benign media files. Here the required success condition is a network control blocks the simulated upload to the prohibited destination. The appropriate action is: Use designated synthetic data and an approved mock endpoint.

This action applies to a different case: A malicious process appears to send compressed data archives to external cloud storage. Compression can stage data for transfer but is not itself proof of theft. It does not establish the present requirement, where a network control blocks the simulated upload to the prohibited destination. The appropriate action is: Use designated synthetic data and an approved mock endpoint.

That relates to a different issue: A service sends files to an external mailbox instead of a sanctioned business archive. Email offers a familiar outbound path that may bypass specialized DLP controls. That is not a direct remedy for the requested outcome: A network control blocks the simulated upload to the prohibited destination. The appropriate action is: Use designated synthetic data and an approved mock endpoint.

That relates to a different issue: A route hidden from the site's navigation remains in the XML sitemap. Sitemaps are inventory aids and not access permissions. That is not a direct remedy for the requested outcome: The endpoint is only tested after customer ownership verification. The relevant evidence is: The endpoint is only tested after customer ownership verification.

It would address a target's CDN returns the same default page for every unknown URL. The relevant reason in that case is: Uniform fallback responses can make missing endpoints appear valid. Here the required success condition is the endpoint is only tested after customer ownership verification. The relevant evidence is: The endpoint is only tested after customer ownership verification.

This result applies to a different case: A portal uses an API host not listed among the contract's authorized DNS names. Front-end references do not implicitly authorize backend testing. It does not establish the present requirement, where the endpoint is only tested after customer ownership verification. The relevant evidence is: The endpoint is only tested after customer ownership verification.

That approach concerns a different situation: an organization wants to identify potential service exposure from an approved public perimeter capture. Traffic analysis can reveal services not documented in current asset inventory. The required result is that the finding redacts content while retaining protocol and traffic evidence. The appropriate action is: Identify unencrypted login flows in approved capture data without reusing the secrets.

It would address an assessor sees a TCP SYN-ACK from an in-scope host during a permitted probe. The relevant reason in that case is: A SYN-ACK is evidence of a listening TCP service under ordinary conditions. Here the required success condition is the finding redacts content while retaining protocol and traffic evidence. The appropriate action is: Identify unencrypted login flows in approved capture data without reusing the secrets.

This action applies to a different case: A firewall sends TCP RST responses to selected ports during discovery. TCP resets distinguish a rejected connection from a no-response condition. It does not establish the present requirement, where the finding redacts content while retaining protocol and traffic evidence. The appropriate action is: Identify unencrypted login flows in approved capture data without reusing the secrets.

That approach concerns a different situation: the technical report mentions high severity but does not state what business process would fail. Business stakeholders need consequence-based interpretation, not just severity labels. The required result is that the closeout record contains client sign-off or documented exceptions. The appropriate action is: Run the agreed closeout review and document client acceptance or disputed findings.

That relates to a different issue: A client changes its target business objective midway through an authorized engagement. Material objective changes can affect budget, risk, and scope. That is not a direct remedy for the requested outcome: The closeout record contains client sign-off or documented exceptions. The appropriate action is: Run the agreed closeout review and document client acceptance or disputed findings.

It would address an executive questions why a seemingly low-scored issue was escalated immediately. The relevant reason in that case is: Contextual risk may exceed a scanner's default severity estimate. Here the required success condition is the closeout record contains client sign-off or documented exceptions. The appropriate action is: Run the agreed closeout review and document client acceptance or disputed findings.

It would address a Windows kiosk permits access to a general command shell through a settings shortcut. The relevant reason in that case is: Single-purpose devices should not expose general operating-system controls. Here the required success condition is the report states both path ambiguity and relevant writable directories. The appropriate action is: Identify unquoted service path exposure and verify filesystem permission prerequisites.

This action applies to a different case: A service startup configuration references an executable removed during a software upgrade. Missing service executables are not exploitable without a controllable replacement path. It does not establish the present requirement, where the report states both path ambiguity and relevant writable directories. The appropriate action is: Identify unquoted service path exposure and verify filesystem permission prerequisites.

That approach concerns a different situation: a Windows event log unexpectedly stops recording privileged actions during a test. Audit integrity is required to detect and investigate host compromise. The required result is that the report states both path ambiguity and relevant writable directories. The appropriate action is: Identify unquoted service path exposure and verify filesystem permission prerequisites.

That relates to a different issue: A service uses LDAP to locate accounts that are also local administrators of other machines. Directory relationships can suggest a lateral path but require actual access conditions. That is not a direct remedy for the requested outcome: A controlled capture no longer contains sensitive FTP content. The appropriate action is: Replace the unsafe transfer and restrict remote file services.

This action applies to a different case: A Windows domain exposes DCOM remote activation rights to a broad group. DCOM can provide remote activation paths when permissive. It does not establish the present requirement, where a controlled capture no longer contains sensitive FTP content. The appropriate action is: Replace the unsafe transfer and restrict remote file services.

That approach concerns a different situation: a file server presents an SMB share writable by an account used across unrelated hosts. Shared writable resources and reused credentials can connect trust zones. The required result is that a controlled capture no longer contains sensitive FTP content. The appropriate action is: Replace the unsafe transfer and restrict remote file services.

That approach concerns a different situation: a tester plans to stage a 10 GB dataset for proof but the signed exfiltration budget is 1 MB. Demonstrating the data path does not require large transfers of client content. The required result is that a lab anomaly produces an attributable telemetry record. The relevant evidence is: A lab anomaly produces an attributable telemetry record.

That relates to a different issue: A test team wants to assess whether confidential files could be moved to personal web text storage. Public paste sites may provide an outbound data path not intended for business use. That is not a direct remedy for the requested outcome: A lab anomaly produces an attributable telemetry record. The relevant evidence is: A lab anomaly produces an attributable telemetry record.

This result applies to a different case: A service sends files to an external mailbox instead of a sanctioned business archive. Email offers a familiar outbound path that may bypass specialized DLP controls. It does not establish the present requirement, where a lab anomaly produces an attributable telemetry record. The relevant evidence is: A lab anomaly produces an attributable telemetry record.