Exam Bundle

It would address a firewall sends TCP RST responses to selected ports during discovery. The relevant reason in that case is: TCP resets distinguish a rejected connection from a no-response condition. Here the required success condition is the result remains inconclusive until protocol-specific evidence is obtained. The appropriate action is: Interpret silence as open-or-filtered rather than definite closure and validate cautiously.

This action applies to a different case: An assessor attempts to correlate a domain's A, AAAA, and CNAME records before testing. DNS aliases and address families can point to differently owned endpoints. It does not establish the present requirement, where the result remains inconclusive until protocol-specific evidence is obtained. The appropriate action is: Interpret silence as open-or-filtered rather than definite closure and validate cautiously.

That approach concerns a different situation: a tester wants to infer whether an address is active while ICMP echo replies are blocked. Firewalls can suppress ping despite active TCP listeners. The required result is that the result remains inconclusive until protocol-specific evidence is obtained. The appropriate action is: Interpret silence as open-or-filtered rather than definite closure and validate cautiously.

That relates to a different issue: An assessor detects unsupported SMB dialects enabled for a legacy file service. Older dialects can lack modern session security features. That is not a direct remedy for the requested outcome: The safe lab evidence proves missing protection without production credential use. The relevant evidence is: The safe lab evidence proves missing protection without production credential use.

It would address a captured lab TCP session reveals an intermediary can see unencrypted application data. The relevant reason in that case is: Traffic traversing an attacker-controlled segment can expose plaintext. Here the required success condition is the safe lab evidence proves missing protection without production credential use. The relevant evidence is: The safe lab evidence proves missing protection without production credential use.

This result applies to a different case: A packet trace shows ARP responses for the same IP from conflicting MAC addresses. ARP trust can allow local interception when endpoint mappings are falsified. It does not establish the present requirement, where the safe lab evidence proves missing protection without production credential use. The relevant evidence is: The safe lab evidence proves missing protection without production credential use.

That approach concerns a different situation: a wireless router is configured for obsolete open authentication on an employee network. Unauthenticated radio access exposes business network traffic and services. The required result is that a synthetic client sees an authenticated portal and no untrusted redirects. The relevant evidence is: A synthetic client sees an authenticated portal and no untrusted redirects.

It would address a test employee connects to a public-looking access point that offers the corporate SSID with a different certificate. The relevant reason in that case is: Enterprise Wi-Fi trust should bind authentication to known infrastructure. Here the required success condition is a synthetic client sees an authenticated portal and no untrusted redirects. The relevant evidence is: A synthetic client sees an authenticated portal and no untrusted redirects.

This result applies to a different case: A company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. Service-disruption methods require explicit risk and impact authorization. It does not establish the present requirement, where a synthetic client sees an authenticated portal and no untrusted redirects. The relevant evidence is: A synthetic client sees an authenticated portal and no untrusted redirects.

That approach concerns a different situation: an analyst sees a high CVSS issue on an isolated lab host and a lower-scored actively exploited issue on a public gateway. CVSS alone omits environmental and current threat context. The required result is that the risk ranking documents asset reachability and compensating safeguards. The relevant evidence is: The risk ranking documents asset reachability and compensating safeguards.

That relates to a different issue: A scheduled assessment identifies fewer hosts than last month, but subnet routing has changed. Fewer findings may indicate lost visibility, not improved security. That is not a direct remedy for the requested outcome: The risk ranking documents asset reachability and compensating safeguards. The relevant evidence is: The risk ranking documents asset reachability and compensating safeguards.

It would address a report lists identical web flaws under many query-string permutations. The relevant reason in that case is: Multiple payload variants do not necessarily represent independent vulnerabilities. Here the required success condition is the risk ranking documents asset reachability and compensating safeguards. The relevant evidence is: The risk ranking documents asset reachability and compensating safeguards.

It would address a network team wants safe evidence that its service account cannot authenticate to unrelated SMB hosts. The relevant reason in that case is: A service account's trust scope affects lateral movement potential. Here the required success condition is an approved resolver test shows the intended name-to-address binding. The appropriate action is: Investigate possible name-resolution poisoning in the isolated test network.

That approach concerns a different situation: a captured lab TCP session reveals an intermediary can see unencrypted application data. Traffic traversing an attacker-controlled segment can expose plaintext. The required result is that an approved resolver test shows the intended name-to-address binding. The appropriate action is: Investigate possible name-resolution poisoning in the isolated test network.

That relates to a different issue: A packet trace shows ARP responses for the same IP from conflicting MAC addresses. ARP trust can allow local interception when endpoint mappings are falsified. That is not a direct remedy for the requested outcome: An approved resolver test shows the intended name-to-address binding. The appropriate action is: Investigate possible name-resolution poisoning in the isolated test network.

That relates to a different issue: A wireless network allows unauthenticated access to sensitive IoT controls via an isolated SSID. Wireless network names do not enforce data-plane isolation. That is not a direct remedy for the requested outcome: The asset owner confirms or rejects the discovered BSSID. The appropriate action is: Validate hardware ownership before labeling the radio malicious.

It would address a wireless security review notes that unauthenticated traffic can trigger large retransmission storms. The relevant reason in that case is: Radio protocol abuse can affect availability without credential compromise. Here the required success condition is the asset owner confirms or rejects the discovered BSSID. The appropriate action is: Validate hardware ownership before labeling the radio malicious.

This action applies to a different case: A company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. Service-disruption methods require explicit risk and impact authorization. It does not establish the present requirement, where the asset owner confirms or rejects the discovered BSSID. The appropriate action is: Validate hardware ownership before labeling the radio malicious.

That approach concerns a different situation: an attacker-created process launches inside a legitimate application's process tree after untrusted DLL loading. Untrusted library loading can execute code under another application's privileges. The required result is that a standard user cannot introduce a new loaded plugin. The appropriate action is: Restrict plugin installation and ownership to approved administrators.

That relates to a different issue: A Linux server grants passwordless sudo for a broad interpreter rather than one intended task. Broad interpreter rights can approximate unrestricted root access. That is not a direct remedy for the requested outcome: A standard user cannot introduce a new loaded plugin. The appropriate action is: Restrict plugin installation and ownership to approved administrators.

This action applies to a different case: A Windows endpoint uses an overly broad service account that can install services on many servers. Service creation rights can enable privileged code execution. It does not establish the present requirement, where a standard user cannot introduce a new loaded plugin. The appropriate action is: Restrict plugin installation and ownership to approved administrators.

This action applies to a different case: A service owner reports unexpected instability that might be unrelated to a recent scan. Temporal correlation alone is insufficient proof of test-caused outage. It does not establish the present requirement, where access logs show only approved stakeholders could retrieve the report. The appropriate action is: Restrict report and evidence distribution to a named need-to-know group.

That approach concerns a different situation: an active test reveals evidence of a critical customer-data exposure while the weekly meeting is days away. Critical material findings require timely escalation outside routine reporting cadence. The required result is that access logs show only approved stakeholders could retrieve the report. The appropriate action is: Restrict report and evidence distribution to a named need-to-know group.

That relates to a different issue: A security team wants to publish screenshots showing real account names in a public presentation. Client confidentiality extends to demonstrations and marketing material. That is not a direct remedy for the requested outcome: Access logs show only approved stakeholders could retrieve the report. The appropriate action is: Restrict report and evidence distribution to a named need-to-know group.

It would address a service startup configuration references an executable removed during a software upgrade. The relevant reason in that case is: Missing service executables are not exploitable without a controllable replacement path. Here the required success condition is an unprivileged lab user can modify only the unsafe path in a controlled test. The appropriate action is: Report the writable service path as a privilege-escalation condition.

This action applies to a different case: A Windows kiosk permits access to a general command shell through a settings shortcut. Single-purpose devices should not expose general operating-system controls. It does not establish the present requirement, where an unprivileged lab user can modify only the unsafe path in a controlled test. The appropriate action is: Report the writable service path as a privilege-escalation condition.

That relates to a different issue: A scheduled Linux maintenance script is writable by a nonprivileged group but runs from root cron. Root-run scheduled code must be protected against untrusted modification. That is not a direct remedy for the requested outcome: An unprivileged lab user can modify only the unsafe path in a controlled test. The appropriate action is: Report the writable service path as a privilege-escalation condition.

That relates to a different issue: A client wants to know whether channel interference is a coverage issue or intentional signal jamming. Interference and malicious jamming can present similar symptoms. That is not a direct remedy for the requested outcome: The output accurately lists channel and advertised protection mode. The appropriate action is: Use passive Kismet or InSSIDer survey functions.

It would address a site uses WPS PIN enrollment on an access point that does not require it. The relevant reason in that case is: Weak enrollment mechanisms may expose network credentials independently of WPA data encryption. Here the required success condition is the output accurately lists channel and advertised protection mode. The appropriate action is: Use passive Kismet or InSSIDer survey functions.

That approach concerns a different situation: a test employee connects to a public-looking access point that offers the corporate SSID with a different certificate. Enterprise Wi-Fi trust should bind authentication to known infrastructure. The required result is that the output accurately lists channel and advertised protection mode. The appropriate action is: Use passive Kismet or InSSIDer survey functions.

That approach concerns a different situation: the engagement needs a passive mapping of email addresses published on customer sites. Public email discovery can reveal exposed identifiers without authentication. The required result is that the result lists verified ports only for approved IP addresses. The appropriate action is: Select Nmap with explicit target and rate restrictions.

That relates to a different issue: An assessor needs a visual correlation of public information about a company's technology footprint. Automated OSINT correlation must preserve provenance and avoid off-scope probing. That is not a direct remedy for the requested outcome: The result lists verified ports only for approved IP addresses. The appropriate action is: Select Nmap with explicit target and rate restrictions.

This action applies to a different case: A tester needs broad public-domain subdomain candidates without hitting customer hosts. Passive subdomain enumeration collects third-party DNS and certificate evidence. It does not establish the present requirement, where the result lists verified ports only for approved IP addresses. The appropriate action is: Select Nmap with explicit target and rate restrictions.