Exam Bundle

It would address an assessment uses only a CVSS number to estimate the likelihood of active exploitation. The relevant reason in that case is: EPSS estimates exploitation likelihood rather than vulnerability impact. Here the required success condition is the test plan records a safe method or a justified exclusion. The relevant evidence is: The test plan records a safe method or a justified exclusion.

That approach concerns a different situation: a network weakness requires two earlier access conditions that are not present in the scoped lab. An attack chain is limited by its unmet prerequisite steps. The required result is that the test plan records a safe method or a justified exclusion. The relevant evidence is: The test plan records a safe method or a justified exclusion.

That relates to a different issue: A published CVE affects a library not installed on the observed target. CVE applicability depends on exact product and version prerequisites. That is not a direct remedy for the requested outcome: The test plan records a safe method or a justified exclusion. The relevant evidence is: The test plan records a safe method or a justified exclusion.

That relates to a different issue: An approved lab uses Netcat to relay a simple TCP session through a second host. Relays obscure direct source-destination relationships. That is not a direct remedy for the requested outcome: Both endpoints show attributable login and process events. The relevant evidence is: Both endpoints show attributable login and process events.

It would address a second network segment is reached through an unauthorized proxy running on an intermediate device. The relevant reason in that case is: Intermediaries can bypass intended segmentation when routing rules are weak. Here the required success condition is both endpoints show attributable login and process events. The relevant evidence is: Both endpoints show attributable login and process events.

This result applies to a different case: An internal team finds unexpected use of PsExec on an accounting server. PsExec-style remote execution creates traceable service and process artifacts. It does not establish the present requirement, where both endpoints show attributable login and process events. The relevant evidence is: Both endpoints show attributable login and process events.

That relates to a different issue: A security engineer suspects steganography in images uploaded to an external content site. Hidden payloads may exist within apparently benign media files. That is not a direct remedy for the requested outcome: A separate synthetic account is denied access after the grant is removed. The relevant evidence is: A separate synthetic account is denied access after the grant is removed.

It would address a Windows host maps a cloud-backed virtual drive through an unauthorized sync client. The relevant reason in that case is: Mapped storage can move data outside conventional removable drives. Here the required success condition is a separate synthetic account is denied access after the grant is removed. The relevant evidence is: A separate synthetic account is denied access after the grant is removed.

This result applies to a different case: DNS queries carry unusually long encoded-looking subdomain labels during a simulated incident. DNS can carry data in query names when abused as a covert channel. It does not establish the present requirement, where a separate synthetic account is denied access after the grant is removed. The relevant evidence is: A separate synthetic account is denied access after the grant is removed.

This result applies to a different case: A team wants passive wireless access point geolocation candidates near a client site. Crowdsourced radio data is passive and may be stale or inaccurate. It does not establish the present requirement, where monitoring logs show observation only, with no transmitted attack frames. The relevant evidence is: Monitoring logs show observation only, with no transmitted attack frames.

That approach concerns a different situation: an approved local wireless survey needs SSID channels and signal strengths without association. Wireless analysis can inventory radios without authenticating to them. The required result is that monitoring logs show observation only, with no transmitted attack frames. The relevant evidence is: Monitoring logs show observation only, with no transmitted attack frames.

It would address a client wants known public internet hosts indexed by certificate and service metadata. The relevant reason in that case is: Internet-wide indices provide exposure intelligence but not proof of asset ownership. Here the required success condition is monitoring logs show observation only, with no transmitted attack frames. The relevant evidence is: Monitoring logs show observation only, with no transmitted attack frames.

It would address a scanner reports a service on an address but the asset inventory names another system there. The relevant reason in that case is: Virtual addresses and stale inventory can create false identity attribution. Here the required success condition is the list includes service name and state under the read-only context. The relevant evidence is: The list includes service name and state under the read-only context.

That approach concerns a different situation: a public application exposes an API descriptor that lists endpoints not reachable by the standard UI. API documentation can reveal functionality but does not establish exploitability. The required result is that the list includes service name and state under the read-only context. The relevant evidence is: The list includes service name and state under the read-only context.

That relates to a different issue: An assessment needs an inventory of publicly accessible cloud buckets under the customer's account. Cloud access posture must be confirmed at both resource and data-plane levels. That is not a direct remedy for the requested outcome: The list includes service name and state under the read-only context. The relevant evidence is: The list includes service name and state under the read-only context.

That relates to a different issue: A client wants to evaluate an old Telnet management interface without reading passwords. Telnet lacks built-in encrypted session protection. That is not a direct remedy for the requested outcome: The lab log shows the spoofed mapping was not adopted. The relevant evidence is: The lab log shows the spoofed mapping was not adopted.

This result applies to a different case: A printer fleet retains manufacturer default passwords on its administrative pages. Default credentials can expose management functions without any software exploit. It does not establish the present requirement, where the lab log shows the spoofed mapping was not adopted. The relevant evidence is: The lab log shows the spoofed mapping was not adopted.

That approach concerns a different situation: a service replies from an IP outside its documented subnet after a proxy forwards a request. Proxying and multihoming can shift traffic into unexpected legal scope. The required result is that the lab log shows the spoofed mapping was not adopted. The relevant evidence is: The lab log shows the spoofed mapping was not adopted.

That relates to a different issue: An IoT controller is sensitive to unexpected network packets during a vulnerability assessment. Industrial and embedded systems can fail under ordinary IT scan traffic. That is not a direct remedy for the requested outcome: The scanner records a safely reproducible endpoint issue in staging. The appropriate action is: Run bounded DAST against a staging environment using synthetic identities.

It would address a cloud team needs to check insecure Terraform settings before applying a new deployment. The relevant reason in that case is: IaC scanning catches misconfigurations before infrastructure exists. Here the required success condition is the scanner records a safely reproducible endpoint issue in staging. The appropriate action is: Run bounded DAST against a staging environment using synthetic identities.

This action applies to a different case: A custom application service cannot be instrumented for IAST due to platform restrictions. Testing technique choice must fit runtime access and instrumentation limits. It does not establish the present requirement, where the scanner records a safely reproducible endpoint issue in staging. The appropriate action is: Run bounded DAST against a staging environment using synthetic identities.

That approach concerns a different situation: a test account reaches a Windows management endpoint through WinRM from an unexpected subnet. WinRM provides remote Windows management under authenticated privileges. The required result is that both endpoints show attributable login and process events. The appropriate action is: Classify the movement as lateral access and correlate authentication across both hosts.

That relates to a different issue: An internal service uses cleartext FTP to move administrative files between servers. Plaintext file transfer can reveal data and credentials to intermediate observers. That is not a direct remedy for the requested outcome: Both endpoints show attributable login and process events. The appropriate action is: Classify the movement as lateral access and correlate authentication across both hosts.

It would address a file server presents an SMB share writable by an account used across unrelated hosts. The relevant reason in that case is: Shared writable resources and reused credentials can connect trust zones. Here the required success condition is both endpoints show attributable login and process events. The appropriate action is: Classify the movement as lateral access and correlate authentication across both hosts.

It would address a firewall sends TCP RST responses to selected ports during discovery. The relevant reason in that case is: TCP resets distinguish a rejected connection from a no-response condition. Here the required success condition is the test yields a bounded port inventory with no disruption alerts. The appropriate action is: Select carefully rate-limited TCP service discovery within approved limits.

This action applies to a different case: A tester needs to identify an industrial controller while the plant prohibits active protocol enumeration. Passive OT reconnaissance reduces risk of disrupting fragile control equipment. It does not establish the present requirement, where the test yields a bounded port inventory with no disruption alerts. The appropriate action is: Select carefully rate-limited TCP service discovery within approved limits.

That relates to a different issue: A security engineer needs to discover unmanaged assets visible at a site but cannot reach them from the test subnet. Visibility boundaries can limit an active scanner's completeness. That is not a direct remedy for the requested outcome: The test yields a bounded port inventory with no disruption alerts. The appropriate action is: Select carefully rate-limited TCP service discovery within approved limits.

That relates to a different issue: A rules-of-engagement document allows web requests but explicitly forbids denial-of-service tests. A permitted web scope does not imply authorization for availability attacks. That is not a direct remedy for the requested outcome: The team has an approved revised test case before any authentication attempt. The relevant evidence is: The team has an approved revised test case before any authentication attempt.

This result applies to a different case: Operations permits active scans only after midnight, while the tester finds an exposed service in the afternoon. Rules of engagement control test timing independently of technical urgency. It does not establish the present requirement, where the team has an approved revised test case before any authentication attempt. The relevant evidence is: The team has an approved revised test case before any authentication attempt.

That approach concerns a different situation: a production database crashes after low-rate probes during an authorized assessment. Availability risk triggers the agreed stop condition even during permitted work. The required result is that the team has an approved revised test case before any authentication attempt. The relevant evidence is: The team has an approved revised test case before any authentication attempt.

That approach concerns a different situation: an OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. The required result is that a cross-origin synthetic update fails without the required valid token. The relevant evidence is: A cross-origin synthetic update fails without the required valid token.

That relates to a different issue: An app downloads files based on a path parameter that accepts parent-directory components. Path normalization and authorization must prevent escaping a file root. That is not a direct remedy for the requested outcome: A cross-origin synthetic update fails without the required valid token. The relevant evidence is: A cross-origin synthetic update fails without the required valid token.

It would address a login system sends session cookies without Secure on an HTTPS-only site. The relevant reason in that case is: Cookie attributes reduce exposure to transport and script risks. Here the required success condition is a cross-origin synthetic update fails without the required valid token. The relevant evidence is: A cross-origin synthetic update fails without the required valid token.