Exam Bundle

It would address a customer has stale machine account certificates with expired owners. The relevant reason in that case is: Key and certificate hygiene prevents service interruption and untrusted identity reuse. Here the required success condition is an unapproved test drive is blocked and recorded. The appropriate action is: Enforce removable-media policy and endpoint device controls.

That approach concerns a different situation: a production app stores an API key in a publicly readable deployment manifest. Secret revocation is necessary after disclosure; merely hiding a file is insufficient. The required result is that an unapproved test drive is blocked and recorded. The appropriate action is: Enforce removable-media policy and endpoint device controls.

That relates to a different issue: Physical testing shows unauthorized visitors can follow staff into a secure data center. Anti-tailgating controls reduce unauthorized physical entry. That is not a direct remedy for the requested outcome: An unapproved test drive is blocked and recorded. The appropriate action is: Enforce removable-media policy and endpoint device controls.

It would address a Python extractor sometimes misclassifies ports because values arrive as strings. The relevant reason in that case is: Structured input still requires type checking before comparisons. Here the required success condition is the execution plan has one authorized action per unique address. The appropriate action is: Normalize and deduplicate target addresses before scheduling requests.

This action applies to a different case: A Python DNS enumeration utility repeats the same hostname many times. Canonicalization and deduplication reduce unnecessary traffic and noisy evidence. It does not establish the present requirement, where the execution plan has one authorized action per unique address. The appropriate action is: Normalize and deduplicate target addresses before scheduling requests.

That approach concerns a different situation: a PowerShell script exports internal usernames to a publicly writable diagnostics folder. Recon output can expose sensitive client information beyond the testing system. The required result is that the execution plan has one authorized action per unique address. The appropriate action is: Normalize and deduplicate target addresses before scheduling requests.

That approach concerns a different situation: a tester needs an ownership hint for a domain's registration and delegated name servers. Registration metadata may identify contacts and service providers. The required result is that candidate radios are labeled unverified until the client confirms ownership. The appropriate action is: Use WiGLE observations as leads subject to ownership confirmation.

It would address a research team needs to inspect whether a host has unsafe publicly disclosed service banners. The relevant reason in that case is: NSE has scripts with varied impact; safe category selection matters. Here the required success condition is candidate radios are labeled unverified until the client confirms ownership. The appropriate action is: Use WiGLE observations as leads subject to ownership confirmation.

This action applies to a different case: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. It does not establish the present requirement, where candidate radios are labeled unverified until the client confirms ownership. The appropriate action is: Use WiGLE observations as leads subject to ownership confirmation.

That approach concerns a different situation: a tester needs to know whether a privileged session used PsExec to start a remote service in a permitted lab. Remote service tools can be used by administrators and attackers. The required result is that the test host rejects an untrusted driver under enforced policy. The relevant evidence is: The test host rejects an untrusted driver under enforced policy.

That relates to a different issue: A Windows endpoint uses an overly broad service account that can install services on many servers. Service creation rights can enable privileged code execution. That is not a direct remedy for the requested outcome: The test host rejects an untrusted driver under enforced policy. The relevant evidence is: The test host rejects an untrusted driver under enforced policy.

It would address a shared workstation allows users to write into a privileged application's plugin folder. The relevant reason in that case is: Writable extension paths create opportunities for untrusted code under elevated context. Here the required success condition is the test host rejects an untrusted driver under enforced policy. The relevant evidence is: The test host rejects an untrusted driver under enforced policy.

It would address a team wants to identify weak settings on a test container but cannot inspect its internals. The relevant reason in that case is: Container vulnerability analysis depends on the specific image and runtime conditions. Here the required success condition is the reported CVE is associated with an installed package and image hash. The appropriate action is: Use Trivy or Grype against the fixed image digest.

This action applies to a different case: A CI pipeline contains an image registry scanner but scans only a mutable latest tag. Mutable tags can change between scan and deployment, invalidating evidence. It does not establish the present requirement, where the reported CVE is associated with an installed package and image hash. The appropriate action is: Use Trivy or Grype against the fixed image digest.

That relates to a different issue: A code repository must be checked for old leaked tokens across all accessible revisions. Deleted source lines may still exist in repository history. That is not a direct remedy for the requested outcome: The reported CVE is associated with an installed package and image hash. The appropriate action is: Use Trivy or Grype against the fixed image digest.

That relates to a different issue: A tester's temporary agent service remains installed after a sandbox demonstration. Removing the installer alone does not terminate active service components. That is not a direct remedy for the requested outcome: The container is empty and a deletion record identifies the artifact. The appropriate action is: Securely delete the test copy according to the agreed retention policy.

This action applies to a different case: A test team performed controlled changes to a lab Kubernetes role assignment. Temporary elevated cluster roles can outlive the exercise. It does not establish the present requirement, where the container is empty and a deletion record identifies the artifact. The appropriate action is: Securely delete the test copy according to the agreed retention policy.

That approach concerns a different situation: an assessment delivered a security finding while the last test proxy still listens on a public address. Temporary test infrastructure can itself become an internet exposure. The required result is that the container is empty and a deletion record identifies the artifact. The appropriate action is: Securely delete the test copy according to the agreed retention policy.

That approach concerns a different situation: a JSON Web Token API accepts tokens with an unexpected algorithm or mismatched audience. JWT validation requires more than decoding a base64 payload. The required result is that a reference to a protected local path cannot be loaded. The appropriate action is: Identify local file inclusion and whitelist approved templates or resources.

That relates to a different issue: A server presents user profile data from a shared cache keyed only by URL. Cross-user cache leakage can bypass application-level access policy. That is not a direct remedy for the requested outcome: A reference to a protected local path cannot be loaded. The appropriate action is: Identify local file inclusion and whitelist approved templates or resources.

This action applies to a different case: A web gateway trusts an unsigned JWT claim that a user is an administrator. Untrusted token content must never grant privileged API access. It does not establish the present requirement, where a reference to a protected local path cannot be loaded. The appropriate action is: Identify local file inclusion and whitelist approved templates or resources.

That approach concerns a different situation: a Python assessment script must process a JSON vulnerability feed with missing keys. Defensive handling prevents script crashes or fabricated values. The required result is that a separate low-right user cannot read the test artifacts. The appropriate action is: Write outputs to an access-controlled directory and enforce retention cleanup.

That relates to a different issue: A tester wants to use PowerShell functions for recurring approved AD inventory steps. Reusable scripted functions improve repeatability and limit accidental actions. That is not a direct remedy for the requested outcome: A separate low-right user cannot read the test artifacts. The appropriate action is: Write outputs to an access-controlled directory and enforce retention cleanup.

It would address a lab Python script has a condition that executes a risky action whenever a value is nonempty. The relevant reason in that case is: Truthiness errors can make automation exceed safe test conditions. Here the required success condition is a separate low-right user cannot read the test artifacts. The appropriate action is: Write outputs to an access-controlled directory and enforce retention cleanup.

It would address a penetration test report opens with a 100-page packet capture and no management overview. The relevant reason in that case is: Executives need decisions without parsing raw technical artifacts. Here the required success condition is the revised attachment proves the issue without displaying protected records. The appropriate action is: Redact unrelated sensitive evidence and apply documented quality control.

This action applies to a different case: The customer cannot reproduce a finding because no affected endpoint or observation time is included. Reproducible reporting supports client verification and remediation. It does not establish the present requirement, where the revised attachment proves the issue without displaying protected records. The appropriate action is: Redact unrelated sensitive evidence and apply documented quality control.

That relates to a different issue: A report includes an 'all systems secure' claim even though only a subnet was tested. Penetration tests cannot establish universal absence of vulnerabilities. That is not a direct remedy for the requested outcome: The revised attachment proves the issue without displaying protected records. The appropriate action is: Redact unrelated sensitive evidence and apply documented quality control.

That relates to a different issue: A Linux test lab uses an SSH jump server and the team must ensure only the signed target is reachable. Jump infrastructure can expand reach if left unrestricted. That is not a direct remedy for the requested outcome: The investigation maps the originating session to the remote machine. The appropriate action is: Correlate remoting logs, source identity, and destination host telemetry.

This action applies to a different case: A network trace shows a remote SMB login but no evidence of file execution or a second-stage process. A successful login is not proof that code ran on the destination. It does not establish the present requirement, where the investigation maps the originating session to the remote machine. The appropriate action is: Correlate remoting logs, source identity, and destination host telemetry.

That approach concerns a different situation: a tester is given permission to assess one management jump host but finds cached connections to other clients. Existing routes or credentials cannot grant authorization over unrelated customers. The required result is that the investigation maps the originating session to the remote machine. The appropriate action is: Correlate remoting logs, source identity, and destination host telemetry.

That relates to a different issue: A team wants to correlate results from Bash, Python, and PowerShell utilities. Consistent output fields support reproducible, attributable analysis. That is not a direct remedy for the requested outcome: A test token is absent from all generated log files. The appropriate action is: Redact authorization headers and restrict debug log content.

It would address a shell loop sends every possible path to a fragile production app at full speed. The relevant reason in that case is: Rate and volume controls are required to respect engagement limits. Here the required success condition is a test token is absent from all generated log files. The appropriate action is: Redact authorization headers and restrict debug log content.

This action applies to a different case: A Bash host inventory script silently processes blank lines as targets. Input sanitation prevents accidental or malformed probe targets. It does not establish the present requirement, where a test token is absent from all generated log files. The appropriate action is: Redact authorization headers and restrict debug log content.