Exam Bundle

That approach concerns a different situation: a web scanner claims SQL injection because a quote produces an HTTP 500 response. Generic server errors do not prove attacker-controlled SQL execution. The required result is that the resolved target outside the approved directory is denied. The relevant evidence is: The resolved target outside the approved directory is denied.

That relates to a different issue: An app downloads files based on a path parameter that accepts parent-directory components. Path normalization and authorization must prevent escaping a file root. That is not a direct remedy for the requested outcome: The resolved target outside the approved directory is denied. The relevant evidence is: The resolved target outside the approved directory is denied.

This result applies to a different case: A theme installer accepts an external URL that is included into server-side code execution. Server execution should not import untrusted remote code. It does not establish the present requirement, where the resolved target outside the approved directory is denied. The relevant evidence is: The resolved target outside the approved directory is denied.

This action applies to a different case: A cloud application trusts a third-party integration with tenant-wide token privileges. Third-party integrations can hold persistent cloud credentials. It does not establish the present requirement, where an unapproved account cannot read the snapshot metadata or data. The appropriate action is: Review snapshot sharing ACLs and remove unnecessary cross-account access.

That approach concerns a different situation: a workload pod mounts the host filesystem and runs privileged with no operational need. Weak container isolation increases opportunities for host-level impact. The required result is that an unapproved account cannot read the snapshot metadata or data. The appropriate action is: Review snapshot sharing ACLs and remove unnecessary cross-account access.

It would address a public artifact repository accepts uploads under a shared build identity with no review process. The relevant reason in that case is: Unsigned or unauthorized artifacts can contaminate downstream releases. Here the required success condition is an unapproved account cannot read the snapshot metadata or data. The appropriate action is: Review snapshot sharing ACLs and remove unnecessary cross-account access.

This result applies to a different case: A reception area has cameras covering exits but not the badge reader at the server room. Physical monitoring coverage determines visibility into unauthorized access. It does not establish the present requirement, where evidence documents lock resistance without physical damage. The relevant evidence is: Evidence documents lock resistance without physical damage.

That approach concerns a different situation: a client wants to determine whether an employee can remotely open a door with another person's proximity badge. Authentication properties must be demonstrated without using actual employee identifiers. The required result is that evidence documents lock resistance without physical damage. The relevant evidence is: Evidence documents lock resistance without physical damage.

That relates to a different issue: A secure room's access logs show one badge opened the door repeatedly during an unoccupied shift. Access anomaly evidence is stronger when multiple sources agree. That is not a direct remedy for the requested outcome: Evidence documents lock resistance without physical damage. The relevant evidence is: Evidence documents lock resistance without physical damage.

That relates to a different issue: A service exposes its administrative interface to every network segment. Limiting reachability reduces opportunities for credential and service abuse. That is not a direct remedy for the requested outcome: A password-only sign-in cannot open the administrative portal. The appropriate action is: Recommend phishing-resistant multifactor authentication for privileged accounts.

It would address a testing team finds a public storage share containing unencrypted customer exports. The relevant reason in that case is: Access control and cryptography address separate disclosure paths. Here the required success condition is a password-only sign-in cannot open the administrative portal. The appropriate action is: Recommend phishing-resistant multifactor authentication for privileged accounts.

That approach concerns a different situation: a production app stores an API key in a publicly readable deployment manifest. Secret revocation is necessary after disclosure; merely hiding a file is insufficient. The required result is that a password-only sign-in cannot open the administrative portal. The appropriate action is: Recommend phishing-resistant multifactor authentication for privileged accounts.

That approach concerns a different situation: a container runtime allows an ordinary workload to access its orchestration API with cluster-admin privileges. Runtime identities can grant control of the wider container cluster. The required result is that a pipeline audit identifies immutable approved action versions. The relevant evidence is: A pipeline audit identifies immutable approved action versions.

That relates to a different issue: A cloud project has a cross-account role trust that permits principals outside the expected partner organization. Cross-account trust can expand reach beyond intended organizational boundaries. That is not a direct remedy for the requested outcome: A pipeline audit identifies immutable approved action versions. The relevant evidence is: A pipeline audit identifies immutable approved action versions.

It would address a cloud service exposes an administrative dashboard on a public endpoint despite an internal-only design. The relevant reason in that case is: Cloud service public access settings can override intended network trust boundaries. Here the required success condition is a pipeline audit identifies immutable approved action versions. The relevant evidence is: A pipeline audit identifies immutable approved action versions.

This action applies to a different case: A network weakness requires two earlier access conditions that are not present in the scoped lab. An attack chain is limited by its unmet prerequisite steps. It does not establish the present requirement, where the test plan records why the gateway is handled first within scope. The appropriate action is: Prioritize the reachable gateway using exploit evidence and business consequences.

That approach concerns a different situation: a team is about to test a service containing a safety-critical industrial controller. Fragile and safety-related services need tailored test restrictions. The required result is that the test plan records why the gateway is handled first within scope. The appropriate action is: Prioritize the reachable gateway using exploit evidence and business consequences.

It would address a tester observes a weakness classified by CWE but needs an identifier for a specific published vulnerability. The relevant reason in that case is: CWE describes weakness types; CVE identifies particular disclosed vulnerabilities. Here the required success condition is the test plan records why the gateway is handled first within scope. The appropriate action is: Prioritize the reachable gateway using exploit evidence and business consequences.

It would address a network team wants safe evidence that its service account cannot authenticate to unrelated SMB hosts. The relevant reason in that case is: A service account's trust scope affects lateral movement potential. Here the required success condition is the approved test observes access from a prohibited network segment. The relevant evidence is: The approved test observes access from a prohibited network segment.

That approach concerns a different situation: a Windows domain has AD Certificate Services templates granting enrollment privileges to unintended users. Misconfigured certificate templates can grant unintended authentication capabilities. The required result is that the approved test observes access from a prohibited network segment. The relevant evidence is: The approved test observes access from a prohibited network segment.

That relates to a different issue: A lab server accepts SMB authentication relayed from another service without enforcing signing. Unsigned authentication flows can be replayed or relayed across trust boundaries. That is not a direct remedy for the requested outcome: The approved test observes access from a prohibited network segment. The relevant evidence is: The approved test observes access from a prohibited network segment.

That relates to a different issue: A wireless survey sees several access points broadcasting the same SSID. SSID is a network name shared by multiple radios. That is not a direct remedy for the requested outcome: The DNS inventory documents names without attempting unauthorized transfers. The relevant evidence is: The DNS inventory documents names without attempting unauthorized transfers.

It would address an in-scope Linux account is permitted to view local service configuration but not system credential files. The relevant reason in that case is: Local test authorization is constrained by supplied account privileges. Here the required success condition is the DNS inventory documents names without attempting unauthorized transfers. The relevant evidence is: The DNS inventory documents names without attempting unauthorized transfers.

This result applies to a different case: An application includes third-party JavaScript that calls an analytics API outside client ownership. Embedded dependencies can cross organizational control boundaries. It does not establish the present requirement, where the DNS inventory documents names without attempting unauthorized transfers. The relevant evidence is: The DNS inventory documents names without attempting unauthorized transfers.

That approach concerns a different situation: a penetration test report opens with a 100-page packet capture and no management overview. Executives need decisions without parsing raw technical artifacts. The required result is that the report labels demonstrated impact and remaining uncertainty distinctly. The appropriate action is: Separate confirmed proof from assumptions and untested hypotheses.

It would address a draft describes a five-stage intrusion but has no chronological sequence. The relevant reason in that case is: A chronological narrative explains causal progression and potential impact. Here the required success condition is the report labels demonstrated impact and remaining uncertainty distinctly. The appropriate action is: Separate confirmed proof from assumptions and untested hypotheses.

This action applies to a different case: A client disputes the report because screenshots reveal an uninvolved customer's record. Evidence must remain sufficient without leaking unnecessary information. It does not establish the present requirement, where the report labels demonstrated impact and remaining uncertainty distinctly. The appropriate action is: Separate confirmed proof from assumptions and untested hypotheses.

That approach concerns a different situation: a service account has access to a second application's database but no business need for it. Privilege propagation depends on actual effective entitlements. The required result is that a synthetic unrelated account cannot write to the share. The appropriate action is: Reduce share ACL and service-account reuse to restrict lateral access.

That relates to a different issue: An approved lab account accesses a second Windows host using a remote service management channel. Valid credentials and remote management can bridge compromised systems. That is not a direct remedy for the requested outcome: A synthetic unrelated account cannot write to the share. The appropriate action is: Reduce share ACL and service-account reuse to restrict lateral access.

It would address an internal team finds unexpected use of PsExec on an accounting server. The relevant reason in that case is: PsExec-style remote execution creates traceable service and process artifacts. Here the required success condition is a synthetic unrelated account cannot write to the share. The appropriate action is: Reduce share ACL and service-account reuse to restrict lateral access.

It would address a security team wants to evaluate whether staff report suspicious phone calls instead of obeying them. The relevant reason in that case is: Social testing measures human response while protecting staff privacy and safety. Here the required success condition is a controlled campaign records reporting without real account entry. The relevant evidence is: A controlled campaign records reporting without real account entry.

That approach concerns a different situation: a telephone caller impersonates a helpdesk employee and demands a one-time authentication code. Voice pretexts can solicit secrets or bypass verification procedures. The required result is that a controlled campaign records reporting without real account entry. The relevant evidence is: A controlled campaign records reporting without real account entry.

That relates to a different issue: A compromised community website frequently used by a particular department redirects users to unsafe content. Trusted browsing habits can expose targeted groups to hostile sites. That is not a direct remedy for the requested outcome: A controlled campaign records reporting without real account entry. The relevant evidence is: A controlled campaign records reporting without real account entry.