Exam Bundle

It would address a security team wants to evaluate whether staff report suspicious phone calls instead of obeying them. The relevant reason in that case is: Social testing measures human response while protecting staff privacy and safety. Here the required success condition is a controlled campaign records reporting without real account entry. The relevant evidence is: A controlled campaign records reporting without real account entry.

That approach concerns a different situation: a telephone caller impersonates a helpdesk employee and demands a one-time authentication code. Voice pretexts can solicit secrets or bypass verification procedures. The required result is that a controlled campaign records reporting without real account entry. The relevant evidence is: A controlled campaign records reporting without real account entry.

That relates to a different issue: A compromised community website frequently used by a particular department redirects users to unsafe content. Trusted browsing habits can expose targeted groups to hostile sites. That is not a direct remedy for the requested outcome: A controlled campaign records reporting without real account entry. The relevant evidence is: A controlled campaign records reporting without real account entry.

It would address a printer fleet retains manufacturer default passwords on its administrative pages. The relevant reason in that case is: Default credentials can expose management functions without any software exploit. Here the required success condition is the report lists a safe read-only unauthorized operation as evidence. The appropriate action is: Compare observed unauthenticated functions against the expected service policy.

This action applies to a different case: A legacy SSL VPN service is exposed behind an unchanged default configuration. Default network configurations can create easily reachable attack surfaces. It does not establish the present requirement, where the report lists a safe read-only unauthorized operation as evidence. The appropriate action is: Compare observed unauthenticated functions against the expected service policy.

That approach concerns a different situation: a client wants to assess relay susceptibility without capturing employee credentials. Proof of authentication relay must avoid collection of unrelated secrets. The required result is that the report lists a safe read-only unauthorized operation as evidence. The appropriate action is: Compare observed unauthenticated functions against the expected service policy.

That approach concerns a different situation: a script assumes a TCP connection timeout means a port is closed. Filtering, routing loss, and explicit rejection have distinct meanings. The required result is that a cyclic test graph terminates within the configured bounds. The relevant evidence is: A cyclic test graph terminates within the configured bounds.

It would address a recon script classifies every non-200 HTTP response as an absent endpoint. The relevant reason in that case is: Authentication and rate limiting are not equivalent to missing resources. Here the required success condition is a cyclic test graph terminates within the configured bounds. The relevant evidence is: A cyclic test graph terminates within the configured bounds.

This result applies to a different case: A Python reconnaissance script stops after the first page of API results. APIs commonly limit each response and require explicit continuation. It does not establish the present requirement, where a cyclic test graph terminates within the configured bounds. The relevant evidence is: A cyclic test graph terminates within the configured bounds.

This result applies to a different case: An assessor created a temporary directory account to validate scoped identity permissions. Tester-created identities can become lingering access paths. It does not establish the present requirement, where a safe follow-up request returns not found for the removed file. The relevant evidence is: A safe follow-up request returns not found for the removed file.

That approach concerns a different situation: an assessment deployed a temporary cloud VM and associated public IP for a controlled attack simulation. Temporary test resources can create ongoing cost and exposure. The required result is that a safe follow-up request returns not found for the removed file. The relevant evidence is: A safe follow-up request returns not found for the removed file.

It would address a tester's temporary agent service remains installed after a sandbox demonstration. The relevant reason in that case is: Removing the installer alone does not terminate active service components. Here the required success condition is a safe follow-up request returns not found for the removed file. The relevant evidence is: A safe follow-up request returns not found for the removed file.

It would address a production database crashes after low-rate probes during an authorized assessment. The relevant reason in that case is: Availability risk triggers the agreed stop condition even during permitted work. Here the required success condition is active scanner timestamps fall inside the signed testing window. The appropriate action is: Schedule the active scan for the permitted window and use only approved passive analysis meanwhile.

This action applies to a different case: A rules-of-engagement document allows web requests but explicitly forbids denial-of-service tests. A permitted web scope does not imply authorization for availability attacks. It does not establish the present requirement, where active scanner timestamps fall inside the signed testing window. The appropriate action is: Schedule the active scan for the permitted window and use only approved passive analysis meanwhile.

That relates to a different issue: An assessor wants to use credential spraying although the signed rules prohibit account lockouts. Potential lockouts violate explicit testing restrictions without changed authorization. That is not a direct remedy for the requested outcome: Active scanner timestamps fall inside the signed testing window. The appropriate action is: Schedule the active scan for the permitted window and use only approved passive analysis meanwhile.

It would address a production database crashes after low-rate probes during an authorized assessment. The relevant reason in that case is: Availability risk triggers the agreed stop condition even during permitted work. Here the required success condition is all tested IPs and names trace to approved scope entries. The appropriate action is: Reconcile hostname resolution and range membership against the exact approved target inventory.

This action applies to a different case: A client lists 10.40.0.0/24 as the only authorized internal range, but an asset resolves to 10.41.0.8. A resolved IP outside the signed CIDR range is not automatically included. It does not establish the present requirement, where all tested IPs and names trace to approved scope entries. The appropriate action is: Reconcile hostname resolution and range membership against the exact approved target inventory.

That approach concerns a different situation: a client asks a contractor to test a partner-managed wireless network without notifying the partner. Shared-responsibility and third-party ownership restrict testing authority. The required result is that all tested IPs and names trace to approved scope entries. The appropriate action is: Reconcile hostname resolution and range membership against the exact approved target inventory.

That approach concerns a different situation: an LDAP directory query returns fewer user records than the account inventory provided by the owner. Enumeration completeness depends on query filters and directory permissions. The required result is that only client-approved access point identifiers appear in active testing. The appropriate action is: Exclude the unrelated radio and document location or owner uncertainty.

That relates to a different issue: An external DNS zone permits public records but the client has not authorized zone-transfer testing against its provider. A DNS service may be third-party managed and subject to additional restrictions. That is not a direct remedy for the requested outcome: Only client-approved access point identifiers appear in active testing. The appropriate action is: Exclude the unrelated radio and document location or owner uncertainty.

This action applies to a different case: A scanner reports a service on an address but the asset inventory names another system there. Virtual addresses and stale inventory can create false identity attribution. It does not establish the present requirement, where only client-approved access point identifiers appear in active testing. The appropriate action is: Exclude the unrelated radio and document location or owner uncertainty.

This result applies to a different case: A tester sees port 445 on an authorized server but has no credentials to enumerate its shares. Service availability is not the same as permission to enumerate protected resources. It does not establish the present requirement, where the audit names the risky template and excessive enrollment scope. The relevant evidence is: The audit names the risky template and excessive enrollment scope.

That approach concerns a different situation: a test host's ARP poisoning protection rejects an untrusted gateway claim. Network access checks can prevent an on-path position before application traffic. The required result is that the audit names the risky template and excessive enrollment scope. The relevant evidence is: The audit names the risky template and excessive enrollment scope.

It would address a lab network has a dual-homed server forwarding traffic between segmented networks. The relevant reason in that case is: Unexpected forwarding can bypass security boundaries. Here the required success condition is the audit names the risky template and excessive enrollment scope. The relevant evidence is: The audit names the risky template and excessive enrollment scope.

It would address two companies need confidentiality protection before testers receive internal network diagrams. The relevant reason in that case is: An NDA governs handling of confidential information prior to technical access. Here the required success condition is the signed document identifies host ranges, times, and expected outputs. The appropriate action is: Create a statement of work specifying targets, deliverables, and assessment windows.

This action applies to a different case: A cloud provider permits vulnerability scanning only under defined acceptable-use conditions. A customer's permission cannot override a hosting provider's contractual constraints. It does not establish the present requirement, where the signed document identifies host ranges, times, and expected outputs. The appropriate action is: Create a statement of work specifying targets, deliverables, and assessment windows.

That relates to a different issue: The client asks which contract establishes general payment and liability terms across annual projects. An MSA typically governs the continuing commercial relationship. That is not a direct remedy for the requested outcome: The signed document identifies host ranges, times, and expected outputs. The appropriate action is: Create a statement of work specifying targets, deliverables, and assessment windows.

That relates to a different issue: A cloud customer expects a penetration tester to patch provider-managed hypervisor vulnerabilities. The infrastructure provider retains responsibility for managed platform layers. That is not a direct remedy for the requested outcome: Every impact-bearing test is time stamped inside its permitted interval. The relevant evidence is: Every impact-bearing test is time stamped inside its permitted interval.

It would address operations permits active scans only after midnight, while the tester finds an exposed service in the afternoon. The relevant reason in that case is: Rules of engagement control test timing independently of technical urgency. Here the required success condition is every impact-bearing test is time stamped inside its permitted interval. The relevant evidence is: Every impact-bearing test is time stamped inside its permitted interval.

This result applies to a different case: A client lists 10.40.0.0/24 as the only authorized internal range, but an asset resolves to 10.41.0.8. A resolved IP outside the signed CIDR range is not automatically included. It does not establish the present requirement, where every impact-bearing test is time stamped inside its permitted interval. The relevant evidence is: Every impact-bearing test is time stamped inside its permitted interval.

That approach concerns a different situation: a scheduled Linux maintenance script is writable by a nonprivileged group but runs from root cron. Root-run scheduled code must be protected against untrusted modification. The required result is that the installed directory ACL denies unprivileged replacement of program files. The relevant evidence is: The installed directory ACL denies unprivileged replacement of program files.

It would address a workstation has a sensitive LSASS process dump file stored in a world-readable diagnostics directory. The relevant reason in that case is: Credential memory dumps can contain reusable authentication material. Here the required success condition is the installed directory ACL denies unprivileged replacement of program files. The relevant evidence is: The installed directory ACL denies unprivileged replacement of program files.

This result applies to a different case: An endpoint accepts unsigned drivers from a normal user context in an authorized lab. Unsigned kernel components can threaten host integrity. It does not establish the present requirement, where the installed directory ACL denies unprivileged replacement of program files. The relevant evidence is: The installed directory ACL denies unprivileged replacement of program files.