Exam Bundle

It would address a client requests exploration of public DNS records including delegated subdomain records. The relevant reason in that case is: DNS intelligence services help build candidate domain inventories. Here the required success condition is the activity report contains no direct requests to the client target. The appropriate action is: Prefer passive third-party OSINT tooling and document the restriction.

This action applies to a different case: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. It does not establish the present requirement, where the activity report contains no direct requests to the client target. The appropriate action is: Prefer passive third-party OSINT tooling and document the restriction.

That approach concerns a different situation: an assessor needs a visual correlation of public information about a company's technology footprint. Automated OSINT correlation must preserve provenance and avoid off-scope probing. The required result is that the activity report contains no direct requests to the client target. The appropriate action is: Prefer passive third-party OSINT tooling and document the restriction.

That relates to a different issue: A company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. Service-disruption methods require explicit risk and impact authorization. That is not a direct remedy for the requested outcome: An unauthorized test client cannot join the protected SSID. The relevant evidence is: An unauthorized test client cannot join the protected SSID.

This result applies to a different case: A survey sees a strong new radio using the office network name but its BSSID is not inventoried. SSID duplication alone can be legitimate multi-access-point design. It does not establish the present requirement, where an unauthorized test client cannot join the protected SSID. The relevant evidence is: An unauthorized test client cannot join the protected SSID.

That approach concerns a different situation: a site uses WPS PIN enrollment on an access point that does not require it. Weak enrollment mechanisms may expose network credentials independently of WPA data encryption. The required result is that an unauthorized test client cannot join the protected SSID. The relevant evidence is: An unauthorized test client cannot join the protected SSID.

That approach concerns a different situation: a penetration tester wants an initial list of OSINT resource types for a new engagement. Resource directories organize potential intelligence sources but are not findings. The required result is that each indexed endpoint is corroborated before active testing. The appropriate action is: Use Censys or Shodan results for passive candidate discovery.

That relates to a different issue: A tester needs an ownership hint for a domain's registration and delegated name servers. Registration metadata may identify contacts and service providers. That is not a direct remedy for the requested outcome: Each indexed endpoint is corroborated before active testing. The appropriate action is: Use Censys or Shodan results for passive candidate discovery.

This action applies to a different case: An assessor wants to enumerate external records but cannot use a product requiring active client network contact. Tool mode is more important than product name for scope compliance. It does not establish the present requirement, where each indexed endpoint is corroborated before active testing. The appropriate action is: Use Censys or Shodan results for passive candidate discovery.

That approach concerns a different situation: a wireless security review notes that unauthenticated traffic can trigger large retransmission storms. Radio protocol abuse can affect availability without credential compromise. The required result is that an unauthorized test client cannot join the protected SSID. The appropriate action is: Migrate to appropriate WPA3 or supported enterprise security with strong authentication.

That relates to a different issue: A site uses WPS PIN enrollment on an access point that does not require it. Weak enrollment mechanisms may expose network credentials independently of WPA data encryption. That is not a direct remedy for the requested outcome: An unauthorized test client cannot join the protected SSID. The appropriate action is: Migrate to appropriate WPA3 or supported enterprise security with strong authentication.

It would address a wireless network allows unauthenticated access to sensitive IoT controls via an isolated SSID. The relevant reason in that case is: Wireless network names do not enforce data-plane isolation. Here the required success condition is an unauthorized test client cannot join the protected SSID. The appropriate action is: Migrate to appropriate WPA3 or supported enterprise security with strong authentication.

It would address an organization wants to identify potential service exposure from an approved public perimeter capture. The relevant reason in that case is: Traffic analysis can reveal services not documented in current asset inventory. Here the required success condition is a follow-up safe connection confirms the exposed service. The appropriate action is: Record the endpoint as accepting a TCP connection on that port.

This action applies to a different case: A tester needs to identify an industrial controller while the plant prohibits active protocol enumeration. Passive OT reconnaissance reduces risk of disrupting fragile control equipment. It does not establish the present requirement, where a follow-up safe connection confirms the exposed service. The appropriate action is: Record the endpoint as accepting a TCP connection on that port.

That relates to a different issue: A customer wants evidence that a network capture could expose plaintext application credentials. Plaintext transport makes credential material observable to network participants. That is not a direct remedy for the requested outcome: A follow-up safe connection confirms the exposed service. The appropriate action is: Record the endpoint as accepting a TCP connection on that port.

That relates to a different issue: An analyst relies on a CVE record without noting whether the affected function is enabled. Attack prerequisites determine relevance to a specific system. That is not a direct remedy for the requested outcome: The finding records the negotiated protocol evidence. The relevant evidence is: The finding records the negotiated protocol evidence.

This result applies to a different case: A host reports UDP ports as open-or-filtered and the analyst marks them definitely exploitable. Silence does not prove a UDP listener exists. It does not establish the present requirement, where the finding records the negotiated protocol evidence. The relevant evidence is: The finding records the negotiated protocol evidence.

That approach concerns a different situation: a scanner reports a critical flaw based solely on an HTTP banner with a potentially spoofed version. Banner-only matching can produce false positives. The required result is that the finding records the negotiated protocol evidence. The relevant evidence is: The finding records the negotiated protocol evidence.

That approach concerns a different situation: a host exposes a remote printing service on a restricted subnet and testers want to enumerate it. Print services may bridge operating-system privileges and network segments. The required result is that the path diagram names each host and approved network boundary. The relevant evidence is: The path diagram names each host and approved network boundary.

That relates to a different issue: A test account reaches a Windows management endpoint through WinRM from an unexpected subnet. WinRM provides remote Windows management under authenticated privileges. That is not a direct remedy for the requested outcome: The path diagram names each host and approved network boundary. The relevant evidence is: The path diagram names each host and approved network boundary.

It would address a test server accepts SSH from an untrusted internal segment despite its approved management design. The relevant reason in that case is: Encrypted SSH still creates a lateral path when exposed broadly. Here the required success condition is the path diagram names each host and approved network boundary. The relevant evidence is: The path diagram names each host and approved network boundary.

This result applies to a different case: A Bash parser confuses space-delimited columns when service banners include spaces. Human-readable tool output is unsafe as an implicit fixed-column schema. It does not establish the present requirement, where the report labels timeout results as uncertain rather than closed. The relevant evidence is: The report labels timeout results as uncertain rather than closed.

That approach concerns a different situation: a Python extractor sometimes misclassifies ports because values arrive as strings. Structured input still requires type checking before comparisons. The required result is that the report labels timeout results as uncertain rather than closed. The relevant evidence is: The report labels timeout results as uncertain rather than closed.

It would address a Bash host inventory script silently processes blank lines as targets. The relevant reason in that case is: Input sanitation prevents accidental or malformed probe targets. Here the required success condition is the report labels timeout results as uncertain rather than closed. The relevant evidence is: The report labels timeout results as uncertain rather than closed.

It would address a Python assessment script must process a JSON vulnerability feed with missing keys. The relevant reason in that case is: Defensive handling prevents script crashes or fabricated values. Here the required success condition is the resulting alerts occur only in the authorized test environment. The appropriate action is: Use the tests only in an approved isolated simulation with reviewed detection expectations.

That approach concerns a different situation: a Python test harness submits the same harmless API validation twice after a timeout. Retries must not produce duplicate state changes in a target app. The required result is that the resulting alerts occur only in the authorized test environment. The appropriate action is: Use the tests only in an approved isolated simulation with reviewed detection expectations.

That relates to a different issue: A team plans to use Scapy to craft arbitrary network packets on a sensitive industrial segment. Packet crafting can bypass normal protocol safeguards and destabilize fragile systems. That is not a direct remedy for the requested outcome: The resulting alerts occur only in the authorized test environment. The appropriate action is: Use the tests only in an approved isolated simulation with reviewed detection expectations.

That relates to a different issue: A tester finds a second service account created during an old assessment with no recorded owner. Residual identities can preserve unauthorized access after a project ends. That is not a direct remedy for the requested outcome: The removed lab service is absent after a controlled restart. The relevant evidence is: The removed lab service is absent after a controlled restart.

It would address a Linux service manager starts a rogue daemon at boot under an elevated account. The relevant reason in that case is: Service managers can provide durable execution with configured privileges. Here the required success condition is the removed lab service is absent after a controlled restart. The relevant evidence is: The removed lab service is absent after a controlled restart.

This result applies to a different case: A Linux test host launches an unknown script daily from a root crontab. Cron entries provide recurring execution independent of user sessions. It does not establish the present requirement, where the removed lab service is absent after a controlled restart. The relevant evidence is: The removed lab service is absent after a controlled restart.

That approach concerns a different situation: a risk report applies one CVSS score to every asset regardless of security controls and exposure. Base severity is not identical to local business risk. The required result is that the risk queue explains why the public gateway receives earlier action. The relevant evidence is: The risk queue explains why the public gateway receives earlier action.

That relates to a different issue: A credentialed scan finds no missing patches but several hosts never accepted the scan account. Unscanned hosts cannot be treated as confirmed patched. That is not a direct remedy for the requested outcome: The risk queue explains why the public gateway receives earlier action. The relevant evidence is: The risk queue explains why the public gateway receives earlier action.

It would address a scanner labels a host unreachable while a jump system sees it available. The relevant reason in that case is: Network visibility differs by source segment. Here the required success condition is the risk queue explains why the public gateway receives earlier action. The relevant evidence is: The risk queue explains why the public gateway receives earlier action.