Exam Bundle

That approach concerns a different situation: dNS queries carry unusually long encoded-looking subdomain labels during a simulated incident. DNS can carry data in query names when abused as a covert channel. The required result is that a lab anomaly produces an attributable telemetry record. The appropriate action is: Recommend relevant protocol metadata and behavioral monitoring for the approved environment.

It would address a penetration tester wants to prove data exfiltration but the contract forbids copying personal information. The relevant reason in that case is: Exfiltration tests should avoid moving real sensitive client content. Here the required success condition is a lab anomaly produces an attributable telemetry record. The appropriate action is: Recommend relevant protocol metadata and behavioral monitoring for the approved environment.

This action applies to a different case: An application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. Encrypted transport can conceal unauthorized data transfer. It does not establish the present requirement, where a lab anomaly produces an attributable telemetry record. The appropriate action is: Recommend relevant protocol metadata and behavioral monitoring for the approved environment.

This result applies to a different case: A PowerShell lab tool scans too many endpoints in parallel, triggering service health alarms. Automation pacing is part of authorized test safety. It does not establish the present requirement, where the same signed scope yields reproducible read-only results. The relevant evidence is: The same signed scope yields reproducible read-only results.

That relates to a different issue: A security analyst wants to run Atomic Red Team tests but production containment could be triggered. Breach-and-attack simulation must respect real business impact. That is not a direct remedy for the requested outcome: The same signed scope yields reproducible read-only results. The relevant evidence is: The same signed scope yields reproducible read-only results.

It would address a lab Python script has a condition that executes a risky action whenever a value is nonempty. The relevant reason in that case is: Truthiness errors can make automation exceed safe test conditions. Here the required success condition is the same signed scope yields reproducible read-only results. The relevant evidence is: The same signed scope yields reproducible read-only results.

It would address a tester's controlled payload survives reboots through an unapproved login script. The relevant reason in that case is: Login scripts can reestablish code execution repeatedly. Here the required success condition is the removed lab service is absent after a controlled restart. The appropriate action is: Investigate service-based persistence and correlate service creation logs.

That approach concerns a different situation: a test account appears in a privileged group despite the engagement not permitting account creation. Unauthorized account additions create lasting access beyond the test. The required result is that the removed lab service is absent after a controlled restart. The appropriate action is: Investigate service-based persistence and correlate service creation logs.

That relates to a different issue: An endpoint security agent stops automatically after an unauthorized service modification. Weak control integrity can help malicious access persist. That is not a direct remedy for the requested outcome: The removed lab service is absent after a controlled restart. The appropriate action is: Investigate service-based persistence and correlate service creation logs.

It would address employees frequently enter a controlled warehouse door by carrying boxes that obstruct badge presentation. The relevant reason in that case is: Operational processes can unintentionally defeat physical control design. Here the required success condition is the test confirms the second entrant cannot enter on the same credential. The appropriate action is: Recommend an anti-passback or one-person physical access measure.

This action applies to a different case: An assessor finds a portable storage device labeled 'payroll' left in an office lobby. Lures can induce unauthorized device execution or data disclosure. It does not establish the present requirement, where the test confirms the second entrant cannot enter on the same credential. The appropriate action is: Recommend an anti-passback or one-person physical access measure.

That approach concerns a different situation: a client wants to determine whether an employee can remotely open a door with another person's proximity badge. Authentication properties must be demonstrated without using actual employee identifiers. The required result is that the test confirms the second entrant cannot enter on the same credential. The appropriate action is: Recommend an anti-passback or one-person physical access measure.

That relates to a different issue: A lab's Kerberos service accounts use weak reusable secrets with no rotation plan. Weak long-lived service account credentials expand ticket abuse risk. That is not a direct remedy for the requested outcome: A reused test reset token cannot authorize a second reset. The appropriate action is: Assess reset-token replay prevention in an isolated test account.

It would address a client's lab shows a service accepts authentication using an old expired ticket. The relevant reason in that case is: Kerberos security depends on correctly enforced validity intervals. Here the required success condition is a reused test reset token cannot authorize a second reset. The appropriate action is: Assess reset-token replay prevention in an isolated test account.

This action applies to a different case: An approved lab shows NTLM network authentication may be accepted without a plaintext password. Reusable password-derived authentication material can be abused in some NTLM flows. It does not establish the present requirement, where a reused test reset token cannot authorize a second reset. The appropriate action is: Assess reset-token replay prevention in an isolated test account.

This result applies to a different case: A Python script recurses indefinitely while following cyclic links in a web asset graph. Cycle detection prevents unbounded crawling and request amplification. It does not establish the present requirement, where a boundary test excludes an adjacent but out-of-scope address. The relevant evidence is: A boundary test excludes an adjacent but out-of-scope address.

That approach concerns a different situation: a script retries failed probes indefinitely when an endpoint is unavailable. Retry storms can cause avoidable service impact and unreliable results. The required result is that a boundary test excludes an adjacent but out-of-scope address. The relevant evidence is: A boundary test excludes an adjacent but out-of-scope address.

That relates to a different issue: A script assumes a TCP connection timeout means a port is closed. Filtering, routing loss, and explicit rejection have distinct meanings. That is not a direct remedy for the requested outcome: A boundary test excludes an adjacent but out-of-scope address. The relevant evidence is: A boundary test excludes an adjacent but out-of-scope address.

It would address an attacker stages files in a hidden alternate data stream on an NTFS test volume. The relevant reason in that case is: Alternate streams can hide data outside ordinary visible file content. Here the required success condition is a network control blocks the simulated upload to the prohibited destination. The relevant evidence is: A network control blocks the simulated upload to the prohibited destination.

This result applies to a different case: An application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. Encrypted transport can conceal unauthorized data transfer. It does not establish the present requirement, where a network control blocks the simulated upload to the prohibited destination. The relevant evidence is: A network control blocks the simulated upload to the prohibited destination.

That relates to a different issue: A tester plans to stage a 10 GB dataset for proof but the signed exfiltration budget is 1 MB. Demonstrating the data path does not require large transfers of client content. That is not a direct remedy for the requested outcome: A network control blocks the simulated upload to the prohibited destination. The relevant evidence is: A network control blocks the simulated upload to the prohibited destination.

It would address a test team has a PCAP but needs only a brief view of a suspicious DNS exchange. The relevant reason in that case is: Capture filters reduce noise while retaining original evidence. Here the required success condition is the inventory includes open, closed, and open-or-filtered states where relevant. The appropriate action is: Choose Nmap with protocol-appropriate interpretation and cautious rate settings.

This action applies to a different case: The engagement needs a passive mapping of email addresses published on customer sites. Public email discovery can reveal exposed identifiers without authentication. It does not establish the present requirement, where the inventory includes open, closed, and open-or-filtered states where relevant. The appropriate action is: Choose Nmap with protocol-appropriate interpretation and cautious rate settings.

That approach concerns a different situation: a tester needs to analyze 802.11 management frames from an authorized lab capture. Wireless tooling can inspect captures separately from active disruption. The required result is that the inventory includes open, closed, and open-or-filtered states where relevant. The appropriate action is: Choose Nmap with protocol-appropriate interpretation and cautious rate settings.

That approach concerns a different situation: a requester claims to own a customer-facing app but cannot prove authority to authorize testing. A verbal request from an unverified party is insufficient legal approval. The required result is that the subsidiary appears only after a signed scope amendment. The appropriate action is: Decline the expansion and submit an amendment for subsidiary approval.

It would address a client lists 10.40.0.0/24 as the only authorized internal range, but an asset resolves to 10.41.0.8. The relevant reason in that case is: A resolved IP outside the signed CIDR range is not automatically included. Here the required success condition is the subsidiary appears only after a signed scope amendment. The appropriate action is: Decline the expansion and submit an amendment for subsidiary approval.

This action applies to a different case: A cloud customer expects a penetration tester to patch provider-managed hypervisor vulnerabilities. The infrastructure provider retains responsibility for managed platform layers. It does not establish the present requirement, where the subsidiary appears only after a signed scope amendment. The appropriate action is: Decline the expansion and submit an amendment for subsidiary approval.

This result applies to a different case: A mobile app behaves differently when installed on a rooted or jailbroken test phone. Rooting removes some platform isolation guarantees and changes test conditions. It does not establish the present requirement, where a synthetic malicious document cannot trigger an unauthorized export. The relevant evidence is: A synthetic malicious document cannot trigger an unauthorized export.

That approach concerns a different situation: a mobile app stores unencrypted session tokens in a world-readable local database. Mobile client storage is not inherently confidential on compromised devices. The required result is that a synthetic malicious document cannot trigger an unauthorized export. The relevant evidence is: A synthetic malicious document cannot trigger an unauthorized export.

That relates to a different issue: A security engineer needs to inspect BLE advertising data for an approved IoT sensor. Bluetooth advertisement fields can disclose device information passively. That is not a direct remedy for the requested outcome: A synthetic malicious document cannot trigger an unauthorized export. The relevant evidence is: A synthetic malicious document cannot trigger an unauthorized export.

It would address a web handler includes a local log file by user-supplied filename. The relevant reason in that case is: Local file inclusion may expose protected files or interpret unexpected content. Here the required success condition is a harmless executable test file is stored inertly or rejected. The appropriate action is: Require extension, content, storage, and execution-policy controls.

This action applies to a different case: A search endpoint concatenates raw query text into SQL statements. Data must not be interpreted as SQL syntax during query construction. It does not establish the present requirement, where a harmless executable test file is stored inertly or rejected. The appropriate action is: Require extension, content, storage, and execution-policy controls.

That relates to a different issue: A customer message displays unsanitized HTML that executes inside another user's browser. Untrusted content can cross the browser's code/data boundary. That is not a direct remedy for the requested outcome: A harmless executable test file is stored inertly or rejected. The appropriate action is: Require extension, content, storage, and execution-policy controls.