Exam Bundle

That relates to a different issue: A mobile app stores unencrypted session tokens in a world-readable local database. Mobile client storage is not inherently confidential on compromised devices. That is not a direct remedy for the requested outcome: The report traces issues to the exact test build without accessing real user data. The relevant evidence is: The report traces issues to the exact test build without accessing real user data.

It would address a mobile app behaves differently when installed on a rooted or jailbroken test phone. The relevant reason in that case is: Rooting removes some platform isolation guarantees and changes test conditions. Here the required success condition is the report traces issues to the exact test build without accessing real user data. The relevant evidence is: The report traces issues to the exact test build without accessing real user data.

This result applies to a different case: Nearby phones receive unsolicited Bluetooth messages from an unknown device. Unsolicited proximity-based messages do not require classic network compromise. It does not establish the present requirement, where the report traces issues to the exact test build without accessing real user data. The relevant evidence is: The report traces issues to the exact test build without accessing real user data.

This result applies to a different case: A tester finds a second service account created during an old assessment with no recorded owner. Residual identities can preserve unauthorized access after a project ends. It does not establish the present requirement, where a standard test identity cannot stop the protective service. The relevant evidence is: A standard test identity cannot stop the protective service.

That relates to a different issue: A web server begins making outbound connections even after the original test session ends. Server-side scripts can maintain remote control outside initial access. That is not a direct remedy for the requested outcome: A standard test identity cannot stop the protective service. The relevant evidence is: A standard test identity cannot stop the protective service.

It would address a C2 simulation in a sandbox uses periodic HTTP check-ins from an agent. The relevant reason in that case is: Periodic callbacks can sustain remote tasking between interactions. Here the required success condition is a standard test identity cannot stop the protective service. The relevant evidence is: A standard test identity cannot stop the protective service.

It would address a route hidden from the site's navigation remains in the XML sitemap. The relevant reason in that case is: Sitemaps are inventory aids and not access permissions. Here the required success condition is the results note referrals without automatically following them. The relevant evidence is: The results note referrals without automatically following them.

That approach concerns a different situation: a cloud endpoint returns a metadata document with instance identifiers visible only from inside the instance. Instance metadata normally has context-specific network access boundaries. The required result is that the results note referrals without automatically following them. The relevant evidence is: The results note referrals without automatically following them.

That relates to a different issue: A tester needs to discover running operating system services using only a read-only endpoint account. Authenticated enumeration can identify services without exploiting them. That is not a direct remedy for the requested outcome: The results note referrals without automatically following them. The relevant evidence is: The results note referrals without automatically following them.

It would address a client wants to assess relay susceptibility without capturing employee credentials. The relevant reason in that case is: Proof of authentication relay must avoid collection of unrelated secrets. Here the required success condition is the finding verifies unencrypted management without logging real credentials. The appropriate action is: Observe protocol negotiation and warn about plaintext credential transit.

This action applies to a different case: A lab server accepts SMB authentication relayed from another service without enforcing signing. Unsigned authentication flows can be replayed or relayed across trust boundaries. It does not establish the present requirement, where the finding verifies unencrypted management without logging real credentials. The appropriate action is: Observe protocol negotiation and warn about plaintext credential transit.

That approach concerns a different situation: a switch port is configured to accept tags from an untrusted endpoint. Incorrect trunk or native VLAN settings can break intended network segregation. The required result is that the finding verifies unencrypted management without logging real credentials. The appropriate action is: Observe protocol negotiation and warn about plaintext credential transit.

That approach concerns a different situation: a security pipeline may contain private API tokens in committed history. Secret detection should avoid creating new exposure in logs. The required result is that the scanned digest is identical to the deployed artifact. The relevant evidence is: The scanned digest is identical to the deployed artifact.

That relates to a different issue: A team wants an assessment of a Kubernetes cluster while its production workloads cannot tolerate attack simulation. Kubernetes posture assessment can identify weak RBAC and workloads without disrupting them. That is not a direct remedy for the requested outcome: The scanned digest is identical to the deployed artifact. The relevant evidence is: The scanned digest is identical to the deployed artifact.

This result applies to a different case: An IoT controller is sensitive to unexpected network packets during a vulnerability assessment. Industrial and embedded systems can fail under ordinary IT scan traffic. It does not establish the present requirement, where the scanned digest is identical to the deployed artifact. The relevant evidence is: The scanned digest is identical to the deployed artifact.

This result applies to a different case: A test engineer wishes to find vulnerable applications in managed serverless services. Serverless resources lack direct host scanning but still have code and identity risks. It does not establish the present requirement, where the results reference the exact staging route and reproducible observed condition. The relevant evidence is: The results reference the exact staging route and reproducible observed condition.

That approach concerns a different situation: a Java application must be monitored for unsafe runtime data flows while executing tests. IAST combines application execution and code-level instrumentation signals. The required result is that the results reference the exact staging route and reproducible observed condition. The relevant evidence is: The results reference the exact staging route and reproducible observed condition.

It would address a security pipeline may contain private API tokens in committed history. The relevant reason in that case is: Secret detection should avoid creating new exposure in logs. Here the required success condition is the results reference the exact staging route and reproducible observed condition. The relevant evidence is: The results reference the exact staging route and reproducible observed condition.

It would address a site requires an inventory of TLS-enabled services without attempting authentication. The relevant reason in that case is: TLS handshakes can describe certificate names and supported protocol families. Here the required success condition is the result lists observed systems and states that active verification was unavailable. The appropriate action is: Use permitted network telemetry and owner-provided logs to develop candidate assets.

This action applies to a different case: A managed router disallows active fingerprinting, but passive captures show TCP stack traits. Packet behavior can suggest platforms without sending new probes. It does not establish the present requirement, where the result lists observed systems and states that active verification was unavailable. The appropriate action is: Use permitted network telemetry and owner-provided logs to develop candidate assets.

That relates to a different issue: A server sends an ICMP destination-unreachable response during a UDP assessment. Certain ICMP unreachable codes are evidence of blocked or unavailable UDP destinations. That is not a direct remedy for the requested outcome: The result lists observed systems and states that active verification was unavailable. The appropriate action is: Use permitted network telemetry and owner-provided logs to develop candidate assets.

It would address a Windows kiosk permits access to a general command shell through a settings shortcut. The relevant reason in that case is: Single-purpose devices should not expose general operating-system controls. Here the required success condition is the script loads only reviewed modules after hardening. The relevant evidence is: The script loads only reviewed modules after hardening.

This result applies to a different case: An endpoint accepts unsigned drivers from a normal user context in an authorized lab. Unsigned kernel components can threaten host integrity. It does not establish the present requirement, where the script loads only reviewed modules after hardening. The relevant evidence is: The script loads only reviewed modules after hardening.

That approach concerns a different situation: a sandboxed application allows launching an unrestricted terminal through a helper menu. Process spawning can bypass an application's intended restricted environment. The required result is that the script loads only reviewed modules after hardening. The relevant evidence is: The script loads only reviewed modules after hardening.

That approach concerns a different situation: a tester identifies anonymous LDAP directory reads exposing sensitive account groups. Directory enumeration can reveal high-value targets without account compromise. The required result is that synthetic valid and invalid names receive equivalent public responses. The appropriate action is: Identify account enumeration by authentication response differences.

It would address a client needs to visualize delegated privileges leading from a low-right account to an admin role. The relevant reason in that case is: Directory graphing can reveal potential escalation edges for remediation. Here the required success condition is synthetic valid and invalid names receive equivalent public responses. The appropriate action is: Identify account enumeration by authentication response differences.

This action applies to a different case: A login portal sees a few guesses for one password across many different usernames. Spraying tests one or few common secrets against many identities. It does not establish the present requirement, where synthetic valid and invalid names receive equivalent public responses. The appropriate action is: Identify account enumeration by authentication response differences.

This action applies to a different case: A visitor uses an authorized staff member's badge replica in a test access system. Copied credentials can bypass physical identity checks if unprotected. It does not establish the present requirement, where evidence documents lock resistance without physical damage. The appropriate action is: Use a non-destructive authorized lock assessment or report the limitation.

That approach concerns a different situation: a testing team receives approval for a site survey but not for collecting unattended staff badges. Physical testing permission is limited to the agreed method and property. The required result is that evidence documents lock resistance without physical damage. The appropriate action is: Use a non-destructive authorized lock assessment or report the limitation.

It would address an assessor finds a portable storage device labeled 'payroll' left in an office lobby. The relevant reason in that case is: Lures can induce unauthorized device execution or data disclosure. Here the required success condition is evidence documents lock resistance without physical damage. The appropriate action is: Use a non-destructive authorized lock assessment or report the limitation.

It would address a client requests exploration of public DNS records including delegated subdomain records. The relevant reason in that case is: DNS intelligence services help build candidate domain inventories. Here the required success condition is the activity report contains no direct requests to the client target. The appropriate action is: Prefer passive third-party OSINT tooling and document the restriction.

This action applies to a different case: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. It does not establish the present requirement, where the activity report contains no direct requests to the client target. The appropriate action is: Prefer passive third-party OSINT tooling and document the restriction.

That approach concerns a different situation: an assessor needs a visual correlation of public information about a company's technology footprint. Automated OSINT correlation must preserve provenance and avoid off-scope probing. The required result is that the activity report contains no direct requests to the client target. The appropriate action is: Prefer passive third-party OSINT tooling and document the restriction.