Exam Bundle

That approach concerns a different situation: an OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. The required result is that a cross-origin synthetic update fails without the required valid token. The relevant evidence is: A cross-origin synthetic update fails without the required valid token.

That relates to a different issue: An app downloads files based on a path parameter that accepts parent-directory components. Path normalization and authorization must prevent escaping a file root. That is not a direct remedy for the requested outcome: A cross-origin synthetic update fails without the required valid token. The relevant evidence is: A cross-origin synthetic update fails without the required valid token.

It would address a login system sends session cookies without Secure on an HTTPS-only site. The relevant reason in that case is: Cookie attributes reduce exposure to transport and script risks. Here the required success condition is a cross-origin synthetic update fails without the required valid token. The relevant evidence is: A cross-origin synthetic update fails without the required valid token.

This action applies to a different case: An assessment needs an inventory of publicly accessible cloud buckets under the customer's account. Cloud access posture must be confirmed at both resource and data-plane levels. It does not establish the present requirement, where the crawl captures routes without repeatedly logging out test users. The appropriate action is: Configure crawl exclusions and session-preservation rules.

That approach concerns a different situation: an API returns sequential customer identifiers in JSON responses to a normal account. Guessable IDs alone are not proof of broken object authorization. The required result is that the crawl captures routes without repeatedly logging out test users. The appropriate action is: Configure crawl exclusions and session-preservation rules.

That relates to a different issue: A scanner reports a service on an address but the asset inventory names another system there. Virtual addresses and stale inventory can create false identity attribution. That is not a direct remedy for the requested outcome: The crawl captures routes without repeatedly logging out test users. The appropriate action is: Configure crawl exclusions and session-preservation rules.

This action applies to a different case: A C2 simulation in a sandbox uses periodic HTTP check-ins from an agent. Periodic callbacks can sustain remote tasking between interactions. It does not establish the present requirement, where a clean sign-in has no unexpected script execution. The appropriate action is: Report the persistence mechanism and remove it under signed cleanup rules.

That approach concerns a different situation: an authorized host assessment finds a hidden scheduled item masquerading as a routine updater. Task names are not proof of legitimacy or maliciousness. The required result is that a clean sign-in has no unexpected script execution. The appropriate action is: Report the persistence mechanism and remove it under signed cleanup rules.

That relates to a different issue: A lab host has a process listening locally for remote command connections. Bind shells expose a local listening endpoint. That is not a direct remedy for the requested outcome: A clean sign-in has no unexpected script execution. The appropriate action is: Report the persistence mechanism and remove it under signed cleanup rules.

That relates to a different issue: A test employee connects to a public-looking access point that offers the corporate SSID with a different certificate. Enterprise Wi-Fi trust should bind authentication to known infrastructure. That is not a direct remedy for the requested outcome: A controlled observation distinguishes sustained noise from authorized access point traffic. The relevant evidence is: A controlled observation distinguishes sustained noise from authorized access point traffic.

It would address a wireless network allows unauthenticated access to sensitive IoT controls via an isolated SSID. The relevant reason in that case is: Wireless network names do not enforce data-plane isolation. Here the required success condition is a controlled observation distinguishes sustained noise from authorized access point traffic. The relevant evidence is: A controlled observation distinguishes sustained noise from authorized access point traffic.

This result applies to a different case: A wireless router is configured for obsolete open authentication on an employee network. Unauthenticated radio access exposes business network traffic and services. It does not establish the present requirement, where a controlled observation distinguishes sustained noise from authorized access point traffic. The relevant evidence is: A controlled observation distinguishes sustained noise from authorized access point traffic.

That approach concerns a different situation: a building uses biometric authentication but has no procedure for emergency evacuation. Security controls must not obstruct legally required safe exit. The required result is that a safe observation confirms whether identity verification occurs for all entrants. The appropriate action is: Evaluate whether the access policy permits identity bypass during deliveries.

That relates to a different issue: A visitor uses an authorized staff member's badge replica in a test access system. Copied credentials can bypass physical identity checks if unprotected. That is not a direct remedy for the requested outcome: A safe observation confirms whether identity verification occurs for all entrants. The appropriate action is: Evaluate whether the access policy permits identity bypass during deliveries.

It would address a site survey finds two entrances to a data room, one with biometric checks and one with an unmonitored exit. The relevant reason in that case is: Security is limited by the least protected route into the same zone. Here the required success condition is a safe observation confirms whether identity verification occurs for all entrants. The appropriate action is: Evaluate whether the access policy permits identity bypass during deliveries.

That approach concerns a different situation: a cloud service is misconfigured but the contract forbids modification of production access policies. Exploitation must respect both target scope and permitted change types. The required result is that the plan documents why the selected method fits the verified target. The relevant evidence is: The plan documents why the selected method fits the verified target.

That relates to a different issue: An approved test finds a high-CVSS bug on an isolated lab system and a lower-CVSS exposed gateway weakness. CVSS base score does not incorporate local attack surface and asset criticality. That is not a direct remedy for the requested outcome: The plan documents why the selected method fits the verified target. The relevant evidence is: The plan documents why the selected method fits the verified target.

It would address a published CVE affects a library not installed on the observed target. The relevant reason in that case is: CVE applicability depends on exact product and version prerequisites. Here the required success condition is the plan documents why the selected method fits the verified target. The relevant evidence is: The plan documents why the selected method fits the verified target.

This action applies to a different case: A service operator cannot determine whether a cloud attack attempt originated from a stolen temporary token. Temporary credential abuse requires identity and control-plane evidence. It does not establish the present requirement, where the test automation works while unrelated administrative calls are denied. The appropriate action is: Reduce the role to exact necessary operations and resource scope.

That approach concerns a different situation: a cloud service exposes an administrative dashboard on a public endpoint despite an internal-only design. Cloud service public access settings can override intended network trust boundaries. The required result is that the test automation works while unrelated administrative calls are denied. The appropriate action is: Reduce the role to exact necessary operations and resource scope.

That relates to a different issue: A private cloud endpoint resolves to a public address because the DNS zone is misconfigured. Private endpoint creation alone does not ensure clients use private routes. That is not a direct remedy for the requested outcome: The test automation works while unrelated administrative calls are denied. The appropriate action is: Reduce the role to exact necessary operations and resource scope.

That relates to a different issue: A targeted text asks employees to visit a fake payroll verification link. Smishing delivers phishing lures through text messaging. That is not a direct remedy for the requested outcome: A browser protection test blocks the laboratory redirection safely. The appropriate action is: Identify a watering-hole threat and evaluate browser and endpoint defenses.

This action applies to a different case: A tester proposes scraping discarded sensitive papers from an office dumpster after physical scope ended. Dumpster diving is physical reconnaissance and is not implied by web authorization. It does not establish the present requirement, where a browser protection test blocks the laboratory redirection safely. The appropriate action is: Identify a watering-hole threat and evaluate browser and endpoint defenses.

That approach concerns a different situation: a tester receives approval for employee phishing simulation but not collection of real passwords. Social engineering exercises should gather only the explicitly approved evidence. The required result is that a browser protection test blocks the laboratory redirection safely. The appropriate action is: Identify a watering-hole threat and evaluate browser and endpoint defenses.

That relates to a different issue: An assessor sees an RPC endpoint mapper but cannot tell which application endpoint is active. RPC services can advertise dynamic ports and interfaces. That is not a direct remedy for the requested outcome: The server negotiates only the approved dialects after change. The appropriate action is: Use negotiated protocol metadata to recommend removing legacy modes safely.

It would address a tester sees port 445 on an authorized server but has no credentials to enumerate its shares. The relevant reason in that case is: Service availability is not the same as permission to enumerate protected resources. Here the required success condition is the server negotiates only the approved dialects after change. The appropriate action is: Use negotiated protocol metadata to recommend removing legacy modes safely.

This action applies to a different case: A client wants to assess relay susceptibility without capturing employee credentials. Proof of authentication relay must avoid collection of unrelated secrets. It does not establish the present requirement, where the server negotiates only the approved dialects after change. The appropriate action is: Use negotiated protocol metadata to recommend removing legacy modes safely.

This result applies to a different case: A research team needs to inspect whether a host has unsafe publicly disclosed service banners. NSE has scripts with varied impact; safe category selection matters. It does not establish the present requirement, where the result lists verified ports only for approved IP addresses. The relevant evidence is: The result lists verified ports only for approved IP addresses.

That approach concerns a different situation: a client asks which tool can discover service exposure without assuming all UDP ports respond. UDP probing results need qualified interpretation of silence and ICMP errors. The required result is that the result lists verified ports only for approved IP addresses. The relevant evidence is: The result lists verified ports only for approved IP addresses.

It would address a tester needs service version metadata from a tightly scoped lab host. The relevant reason in that case is: Service fingerprinting can establish versions more reliably than port assumptions. Here the required success condition is the result lists verified ports only for approved IP addresses. The relevant evidence is: The result lists verified ports only for approved IP addresses.

It would address a firewall sends TCP RST responses to selected ports during discovery. The relevant reason in that case is: TCP resets distinguish a rejected connection from a no-response condition. Here the required success condition is the result remains inconclusive until protocol-specific evidence is obtained. The appropriate action is: Interpret silence as open-or-filtered rather than definite closure and validate cautiously.

This action applies to a different case: An assessor attempts to correlate a domain's A, AAAA, and CNAME records before testing. DNS aliases and address families can point to differently owned endpoints. It does not establish the present requirement, where the result remains inconclusive until protocol-specific evidence is obtained. The appropriate action is: Interpret silence as open-or-filtered rather than definite closure and validate cautiously.

That approach concerns a different situation: a tester wants to infer whether an address is active while ICMP echo replies are blocked. Firewalls can suppress ping despite active TCP listeners. The required result is that the result remains inconclusive until protocol-specific evidence is obtained. The appropriate action is: Interpret silence as open-or-filtered rather than definite closure and validate cautiously.