Exam Bundle

That approach concerns a different situation: the engagement needs a passive mapping of email addresses published on customer sites. Public email discovery can reveal exposed identifiers without authentication. The required result is that the result lists verified ports only for approved IP addresses. The appropriate action is: Select Nmap with explicit target and rate restrictions.

That relates to a different issue: An assessor needs a visual correlation of public information about a company's technology footprint. Automated OSINT correlation must preserve provenance and avoid off-scope probing. That is not a direct remedy for the requested outcome: The result lists verified ports only for approved IP addresses. The appropriate action is: Select Nmap with explicit target and rate restrictions.

This action applies to a different case: A tester needs broad public-domain subdomain candidates without hitting customer hosts. Passive subdomain enumeration collects third-party DNS and certificate evidence. It does not establish the present requirement, where the result lists verified ports only for approved IP addresses. The appropriate action is: Select Nmap with explicit target and rate restrictions.

This action applies to a different case: An assessment sees valid Kerberos tickets used on another system outside their intended workflow. Kerberos tickets are bearer-like credentials within their valid scope. It does not establish the present requirement, where an invalid lab assertion is rejected by the service provider. The appropriate action is: Assess SAML trust validation and signature requirements with test identities.

That approach concerns a different situation: users receive repeated unsolicited MFA push prompts from an unknown source. Repeated prompts may coerce approval of an attacker-initiated sign-in. The required result is that an invalid lab assertion is rejected by the service provider. The appropriate action is: Assess SAML trust validation and signature requirements with test identities.

That relates to a different issue: A relying party accepts OpenID Connect identity tokens with a mismatched audience. An identity token intended for one client should not authenticate another. That is not a direct remedy for the requested outcome: An invalid lab assertion is rejected by the service provider. The appropriate action is: Assess SAML trust validation and signature requirements with test identities.

It would address a Python test harness submits the same harmless API validation twice after a timeout. The relevant reason in that case is: Retries must not produce duplicate state changes in a target app. Here the required success condition is unit tests confirm risky branches require a positive authorization flag. The relevant evidence is: Unit tests confirm risky branches require a positive authorization flag.

This result applies to a different case: A Python assessment script must process a JSON vulnerability feed with missing keys. Defensive handling prevents script crashes or fabricated values. It does not establish the present requirement, where unit tests confirm risky branches require a positive authorization flag. The relevant evidence is: Unit tests confirm risky branches require a positive authorization flag.

That approach concerns a different situation: a security analyst wants to run Atomic Red Team tests but production containment could be triggered. Breach-and-attack simulation must respect real business impact. The required result is that unit tests confirm risky branches require a positive authorization flag. The relevant evidence is: Unit tests confirm risky branches require a positive authorization flag.

That relates to a different issue: A client requests test data in a collaboration workspace available to all contractors. Findings can expose exploitation paths if shared broadly. That is not a direct remedy for the requested outcome: An executive can identify the at-risk service and required decision. The relevant evidence is: An executive can identify the at-risk service and required decision.

This result applies to a different case: A service owner reports unexpected instability that might be unrelated to a recent scan. Temporal correlation alone is insufficient proof of test-caused outage. It does not establish the present requirement, where an executive can identify the at-risk service and required decision. The relevant evidence is: An executive can identify the at-risk service and required decision.

That approach concerns a different situation: an active test reveals evidence of a critical customer-data exposure while the weekly meeting is days away. Critical material findings require timely escalation outside routine reporting cadence. The required result is that an executive can identify the at-risk service and required decision. The relevant evidence is: An executive can identify the at-risk service and required decision.

That approach concerns a different situation: a testing team ran only passive reconnaissance but the report implies full active validation. Readers must not overinterpret partial assessment coverage. The required result is that the reader can trace the demonstrated chain through timestamped observations. The relevant evidence is: The reader can trace the demonstrated chain through timestamped observations.

It would address a team used an AI writing assistant and introduced an invented exploit claim into the draft. The relevant reason in that case is: Generated narrative must not replace factual source observations. Here the required success condition is the reader can trace the demonstrated chain through timestamped observations. The relevant evidence is: The reader can trace the demonstrated chain through timestamped observations.

This result applies to a different case: A client disputes the report because screenshots reveal an uninvolved customer's record. Evidence must remain sufficient without leaking unnecessary information. It does not establish the present requirement, where the reader can trace the demonstrated chain through timestamped observations. The relevant evidence is: The reader can trace the demonstrated chain through timestamped observations.

This action applies to a different case: An approved lab account accesses a second Windows host using a remote service management channel. Valid credentials and remote management can bridge compromised systems. It does not establish the present requirement, where the investigation attributes activity to a permitted or suspicious principal. The appropriate action is: Correlate remote service creation and source authentication evidence.

That approach concerns a different situation: an administrator observes unexpected use of legitimate Windows command utilities in a remote script. Ordinary administrative binaries may be used during legitimate management or abuse. The required result is that the investigation attributes activity to a permitted or suspicious principal. The appropriate action is: Correlate remote service creation and source authentication evidence.

It would address an authorized lab shows remote administrative tasks created through WMI. The relevant reason in that case is: WMI supports legitimate management as well as remote execution activity. Here the required success condition is the investigation attributes activity to a permitted or suspicious principal. The appropriate action is: Correlate remote service creation and source authentication evidence.

This action applies to a different case: An assessment needs an inventory of publicly accessible cloud buckets under the customer's account. Cloud access posture must be confirmed at both resource and data-plane levels. It does not establish the present requirement, where only allowed pages appear in the final crawl evidence. The appropriate action is: Classify those links as candidate assets and request scope confirmation.

That approach concerns a different situation: an office Wi-Fi assessment records a strong signal from a neighbor-owned access point. Physical proximity does not establish authorization to test a wireless asset. The required result is that only allowed pages appear in the final crawl evidence. The appropriate action is: Classify those links as candidate assets and request scope confirmation.

That relates to a different issue: A route hidden from the site's navigation remains in the XML sitemap. Sitemaps are inventory aids and not access permissions. That is not a direct remedy for the requested outcome: Only allowed pages appear in the final crawl evidence. The appropriate action is: Classify those links as candidate assets and request scope confirmation.

That relates to a different issue: A tester is asked to assess 802.11 channel utilization and coverage without disruption. Radio surveys can evaluate exposure without performing active interference. That is not a direct remedy for the requested outcome: The evidence records confirmed active exposure or a false positive. The relevant evidence is: The evidence records confirmed active exposure or a false positive.

This result applies to a different case: A test engineer wishes to find vulnerable applications in managed serverless services. Serverless resources lack direct host scanning but still have code and identity risks. It does not establish the present requirement, where the evidence records confirmed active exposure or a false positive. The relevant evidence is: The evidence records confirmed active exposure or a false positive.

That approach concerns a different situation: a security pipeline may contain private API tokens in committed history. Secret detection should avoid creating new exposure in logs. The required result is that the evidence records confirmed active exposure or a false positive. The relevant evidence is: The evidence records confirmed active exposure or a false positive.

That approach concerns a different situation: a website allows a cross-site form to change an authenticated user's email without an anti-CSRF check. An authenticated browser can carry session cookies for unintended state-changing requests. The required result is that a scoped test token is denied the unauthorized update. The appropriate action is: Enforce resource-level authorization and exact OAuth scopes at the endpoint.

It would address a login system sends session cookies without Secure on an HTTPS-only site. The relevant reason in that case is: Cookie attributes reduce exposure to transport and script risks. Here the required success condition is a scoped test token is denied the unauthorized update. The appropriate action is: Enforce resource-level authorization and exact OAuth scopes at the endpoint.

This action applies to a different case: A web gateway trusts an unsigned JWT claim that a user is an administrator. Untrusted token content must never grant privileged API access. It does not establish the present requirement, where a scoped test token is denied the unauthorized update. The appropriate action is: Enforce resource-level authorization and exact OAuth scopes at the endpoint.

That approach concerns a different situation: a tester selects an attack tool because it is familiar, not because it matches target protocol. Tool choice should be threat-led and technically appropriate. The required result is that the action plan does not claim unsupported exploit compatibility. The relevant evidence is: The action plan does not claim unsupported exploit compatibility.

That relates to a different issue: A team is about to test a service containing a safety-critical industrial controller. Fragile and safety-related services need tailored test restrictions. That is not a direct remedy for the requested outcome: The action plan does not claim unsupported exploit compatibility. The relevant evidence is: The action plan does not claim unsupported exploit compatibility.

It would address a cloud service is misconfigured but the contract forbids modification of production access policies. The relevant reason in that case is: Exploitation must respect both target scope and permitted change types. Here the required success condition is the action plan does not claim unsupported exploit compatibility. The relevant evidence is: The action plan does not claim unsupported exploit compatibility.

It would address a client wants to determine whether an employee can remotely open a door with another person's proximity badge. The relevant reason in that case is: Authentication properties must be demonstrated without using actual employee identifiers. Here the required success condition is a controlled observation shows an unverified visitor passed the door. The relevant evidence is: A controlled observation shows an unverified visitor passed the door.

This result applies to a different case: A staff member encounters an unknown visitor attempting to enter a restricted work area. Policies require actual procedural enforcement, not only badge hardware. It does not establish the present requirement, where a controlled observation shows an unverified visitor passed the door. The relevant evidence is: A controlled observation shows an unverified visitor passed the door.

That approach concerns a different situation: a factory prohibits onsite photography but a tester wants to document an unmonitored side gate. Physical evidence collection remains bound by facility security policy. The required result is that a controlled observation shows an unverified visitor passed the door. The relevant evidence is: A controlled observation shows an unverified visitor passed the door.