Exam Bundle

It would address a web handler includes a local log file by user-supplied filename. The relevant reason in that case is: Local file inclusion may expose protected files or interpret unexpected content. Here the required success condition is a harmless executable test file is stored inertly or rejected. The appropriate action is: Require extension, content, storage, and execution-policy controls.

This action applies to a different case: A search endpoint concatenates raw query text into SQL statements. Data must not be interpreted as SQL syntax during query construction. It does not establish the present requirement, where a harmless executable test file is stored inertly or rejected. The appropriate action is: Require extension, content, storage, and execution-policy controls.

That relates to a different issue: A customer message displays unsanitized HTML that executes inside another user's browser. Untrusted content can cross the browser's code/data boundary. That is not a direct remedy for the requested outcome: A harmless executable test file is stored inertly or rejected. The appropriate action is: Require extension, content, storage, and execution-policy controls.

That relates to a different issue: A staff member encounters an unknown visitor attempting to enter a restricted work area. Policies require actual procedural enforcement, not only badge hardware. That is not a direct remedy for the requested outcome: A controlled training exercise documents pickup/reporting outcomes safely. The appropriate action is: Report the USB-drop social-engineering risk without connecting it to production endpoints.

This action applies to a different case: A factory prohibits onsite photography but a tester wants to document an unmonitored side gate. Physical evidence collection remains bound by facility security policy. It does not establish the present requirement, where a controlled training exercise documents pickup/reporting outcomes safely. The appropriate action is: Report the USB-drop social-engineering risk without connecting it to production endpoints.

That approach concerns a different situation: a test team discovers sensitive paper records in an unattended office recycling bin. Physical information leakage may occur without network exploitation. The required result is that a controlled training exercise documents pickup/reporting outcomes safely. The appropriate action is: Report the USB-drop social-engineering risk without connecting it to production endpoints.

That approach concerns a different situation: a tester plans to use Hydra against a production identity provider with a strict account-lockout policy. Online attack tooling can exceed legal and availability constraints. The required result is that a benign test value cannot expand the directory search predicate. The relevant evidence is: A benign test value cannot expand the directory search predicate.

That relates to a different issue: A privileged account can bypass MFA when authenticating through a legacy protocol. Strong interactive MFA is undermined by weaker alternate sign-in routes. That is not a direct remedy for the requested outcome: A benign test value cannot expand the directory search predicate. The relevant evidence is: A benign test value cannot expand the directory search predicate.

This result applies to a different case: A tester identifies anonymous LDAP directory reads exposing sensitive account groups. Directory enumeration can reveal high-value targets without account compromise. It does not establish the present requirement, where a benign test value cannot expand the directory search predicate. The relevant evidence is: A benign test value cannot expand the directory search predicate.

This result applies to a different case: A privileged account can bypass MFA when authenticating through a legacy protocol. Strong interactive MFA is undermined by weaker alternate sign-in routes. It does not establish the present requirement, where synthetic valid and invalid names receive equivalent public responses. The relevant evidence is: Synthetic valid and invalid names receive equivalent public responses.

That approach concerns a different situation: a test user's reset flow issues single-use tokens that remain valid after consumption. One-time recovery tokens should be invalidated after successful use. The required result is that synthetic valid and invalid names receive equivalent public responses. The relevant evidence is: Synthetic valid and invalid names receive equivalent public responses.

It would address a lab's Kerberos service accounts use weak reusable secrets with no rotation plan. The relevant reason in that case is: Weak long-lived service account credentials expand ticket abuse risk. Here the required success condition is synthetic valid and invalid names receive equivalent public responses. The relevant evidence is: Synthetic valid and invalid names receive equivalent public responses.

It would address an assessor needs to query current A, MX, and TXT records for a customer's domain. The relevant reason in that case is: DNS command-line tools retrieve authoritative or resolver responses. Here the required success condition is the candidate list contains source attribution and no active probes. The appropriate action is: Use Amass in an approved passive-only mode.

This action applies to a different case: An assessor needs public business email patterns without scraping private directories. Public contact intelligence is different from private account enumeration. It does not establish the present requirement, where the candidate list contains source attribution and no active probes. The appropriate action is: Use Amass in an approved passive-only mode.

That approach concerns a different situation: an approved local wireless survey needs SSID channels and signal strengths without association. Wireless analysis can inventory radios without authenticating to them. The required result is that the candidate list contains source attribution and no active probes. The appropriate action is: Use Amass in an approved passive-only mode.

It would address a mobile app stores unencrypted session tokens in a world-readable local database. The relevant reason in that case is: Mobile client storage is not inherently confidential on compromised devices. Here the required success condition is the app operates without contacts permission. The relevant evidence is: The app operates without contacts permission.

This result applies to a different case: A point-of-sale device accepts unauthorized NFC interactions beyond its intended payment protocol. Short-range communication still requires application-level authorization. It does not establish the present requirement, where the app operates without contacts permission. The relevant evidence is: The app operates without contacts permission.

That approach concerns a different situation: a model endpoint outputs confidential training examples when prompted with generic cues. Model behavior can expose sensitive memorized data. The required result is that the app operates without contacts permission. The relevant evidence is: The app operates without contacts permission.

That approach concerns a different situation: a team wants to detect weak API authorization in a running staging application. DAST evaluates behavior from the application's external interface. The required result is that the results classify code flaws separately from platform configuration. The appropriate action is: Use vendor-approved configuration and application-level security assessments.

It would address a security engineer must distinguish a leaked password from a harmless test placeholder in a configuration file. The relevant reason in that case is: String-pattern matching alone can overstate an actual credential exposure. Here the required success condition is the results classify code flaws separately from platform configuration. The appropriate action is: Use vendor-approved configuration and application-level security assessments.

This action applies to a different case: A Java application must be monitored for unsafe runtime data flows while executing tests. IAST combines application execution and code-level instrumentation signals. It does not establish the present requirement, where the results classify code flaws separately from platform configuration. The appropriate action is: Use vendor-approved configuration and application-level security assessments.

This result applies to a different case: An attacker-created process launches inside a legitimate application's process tree after untrusted DLL loading. Untrusted library loading can execute code under another application's privileges. It does not establish the present requirement, where the threat model records the observed process behavior accurately. The relevant evidence is: The threat model records the observed process behavior accurately.

That approach concerns a different situation: a security agent is disabled by an ordinary user with local permissions. Endpoint safeguards must resist unauthorized security-control changes. The required result is that the threat model records the observed process behavior accurately. The relevant evidence is: The threat model records the observed process behavior accurately.

That relates to a different issue: A Windows service binary directory is writable by ordinary users while the service runs as a privileged identity. Writable privileged service artifacts can cross user-to-system trust boundaries. That is not a direct remedy for the requested outcome: The threat model records the observed process behavior accurately. The relevant evidence is: The threat model records the observed process behavior accurately.

It would address a penetration tester wants to prove data exfiltration but the contract forbids copying personal information. The relevant reason in that case is: Exfiltration tests should avoid moving real sensitive client content. Here the required success condition is a safe lab pattern triggers the intended anomaly detection. The appropriate action is: Classify possible DNS tunneling and compare query patterns with known application use.

That approach concerns a different situation: a security engineer suspects steganography in images uploaded to an external content site. Hidden payloads may exist within apparently benign media files. The required result is that a safe lab pattern triggers the intended anomaly detection. The appropriate action is: Classify possible DNS tunneling and compare query patterns with known application use.

That relates to a different issue: A project storage account is shared with an unrelated external cloud account. Cloud-native access may enable transfer without conventional internet downloads. That is not a direct remedy for the requested outcome: A safe lab pattern triggers the intended anomaly detection. The appropriate action is: Classify possible DNS tunneling and compare query patterns with known application use.

That relates to a different issue: A Python script recurses indefinitely while following cyclic links in a web asset graph. Cycle detection prevents unbounded crawling and request amplification. That is not a direct remedy for the requested outcome: A boundary test excludes an adjacent but out-of-scope address. The appropriate action is: Use a proper IP-address library and network membership comparison.

It would address a PowerShell script exports internal usernames to a publicly writable diagnostics folder. The relevant reason in that case is: Recon output can expose sensitive client information beyond the testing system. Here the required success condition is a boundary test excludes an adjacent but out-of-scope address. The appropriate action is: Use a proper IP-address library and network membership comparison.

That approach concerns a different situation: a Python reconnaissance script stops after the first page of API results. APIs commonly limit each response and require explicit continuation. The required result is that a boundary test excludes an adjacent but out-of-scope address. The appropriate action is: Use a proper IP-address library and network membership comparison.

That relates to a different issue: A tester plans to stage a 10 GB dataset for proof but the signed exfiltration budget is 1 MB. Demonstrating the data path does not require large transfers of client content. That is not a direct remedy for the requested outcome: Transferred test content matches the approved hash and byte limit. The relevant evidence is: Transferred test content matches the approved hash and byte limit.

It would address a malicious process appears to send compressed data archives to external cloud storage. The relevant reason in that case is: Compression can stage data for transfer but is not itself proof of theft. Here the required success condition is transferred test content matches the approved hash and byte limit. The relevant evidence is: Transferred test content matches the approved hash and byte limit.

This result applies to a different case: A test team wants to assess whether confidential files could be moved to personal web text storage. Public paste sites may provide an outbound data path not intended for business use. It does not establish the present requirement, where transferred test content matches the approved hash and byte limit. The relevant evidence is: Transferred test content matches the approved hash and byte limit.