Exam Bundle

It would address a client wants to determine whether an employee can remotely open a door with another person's proximity badge. The relevant reason in that case is: Authentication properties must be demonstrated without using actual employee identifiers. Here the required success condition is a controlled observation shows an unverified visitor passed the door. The relevant evidence is: A controlled observation shows an unverified visitor passed the door.

This result applies to a different case: A staff member encounters an unknown visitor attempting to enter a restricted work area. Policies require actual procedural enforcement, not only badge hardware. It does not establish the present requirement, where a controlled observation shows an unverified visitor passed the door. The relevant evidence is: A controlled observation shows an unverified visitor passed the door.

That approach concerns a different situation: a factory prohibits onsite photography but a tester wants to document an unmonitored side gate. Physical evidence collection remains bound by facility security policy. The required result is that a controlled observation shows an unverified visitor passed the door. The relevant evidence is: A controlled observation shows an unverified visitor passed the door.

It would address a shared workstation allows users to write into a privileged application's plugin folder. The relevant reason in that case is: Writable extension paths create opportunities for untrusted code under elevated context. Here the required success condition is the file's permissions and retention conform to the approved policy. The relevant evidence is: The file's permissions and retention conform to the approved policy.

This result applies to a different case: A penetration tester identifies an accessible PowerShell script that imports a privileged module from a writable directory. Dynamic module loading can cross privilege boundaries if paths are user-controlled. It does not establish the present requirement, where the file's permissions and retention conform to the approved policy. The relevant evidence is: The file's permissions and retention conform to the approved policy.

That approach concerns a different situation: a Windows kiosk permits access to a general command shell through a settings shortcut. Single-purpose devices should not expose general operating-system controls. The required result is that the file's permissions and retention conform to the approved policy. The relevant evidence is: The file's permissions and retention conform to the approved policy.

That relates to a different issue: A limited-scope assessment needs the list of responding ports without overwhelming a fragile legacy gateway. Discovery intensity must reflect operational constraints and written permission. That is not a direct remedy for the requested outcome: Host presence is inferred from safe observed protocol replies. The relevant evidence is: Host presence is inferred from safe observed protocol replies.

It would address a tester needs to identify an industrial controller while the plant prohibits active protocol enumeration. The relevant reason in that case is: Passive OT reconnaissance reduces risk of disrupting fragile control equipment. Here the required success condition is host presence is inferred from safe observed protocol replies. The relevant evidence is: Host presence is inferred from safe observed protocol replies.

This result applies to a different case: A UDP application is suspected, but no response appears to a generic UDP probe. UDP scanning often lacks reliable positive replies without an application response. It does not establish the present requirement, where host presence is inferred from safe observed protocol replies. The relevant evidence is: Host presence is inferred from safe observed protocol replies.

That approach concerns a different situation: a scanner's authenticated credential was disabled during the test with no alert in the output summary. Credentials can silently fail and create false negative coverage. The required result is that the report maps the root issue to each affected host and image. The appropriate action is: Group occurrences by root cause while retaining affected asset inventory.

That relates to a different issue: A risk report applies one CVSS score to every asset regardless of security controls and exposure. Base severity is not identical to local business risk. That is not a direct remedy for the requested outcome: The report maps the root issue to each affected host and image. The appropriate action is: Group occurrences by root cause while retaining affected asset inventory.

It would address a report lists identical web flaws under many query-string permutations. The relevant reason in that case is: Multiple payload variants do not necessarily represent independent vulnerabilities. Here the required success condition is the report maps the root issue to each affected host and image. The appropriate action is: Group occurrences by root cause while retaining affected asset inventory.

It would address a web application's LDAP filter directly concatenates a username field. The relevant reason in that case is: Unescaped filter meta-characters can alter directory query meaning. Here the required success condition is an anonymous test query returns only approved public attributes. The appropriate action is: Report overbroad directory permissions and restrict anonymous access.

This action applies to a different case: A tester plans to use Hydra against a production identity provider with a strict account-lockout policy. Online attack tooling can exceed legal and availability constraints. It does not establish the present requirement, where an anonymous test query returns only approved public attributes. The appropriate action is: Report overbroad directory permissions and restrict anonymous access.

That approach concerns a different situation: a web login receives credentials from a known external breach list. Credential stuffing reuses previously leaked username-password combinations. The required result is that an anonymous test query returns only approved public attributes. The appropriate action is: Report overbroad directory permissions and restrict anonymous access.

It would address an internal application requires a comparison of its dependencies before and after a release. The relevant reason in that case is: Changed packages alter exposure even if application source appears unchanged. Here the required success condition is the report distinguishes perimeter exposure from internal asset coverage. The appropriate action is: Document the unauthenticated coverage limitation and supplement with scoped internal scans.

This action applies to a different case: A code repository must be checked for old leaked tokens across all accessible revisions. Deleted source lines may still exist in repository history. It does not establish the present requirement, where the report distinguishes perimeter exposure from internal asset coverage. The appropriate action is: Document the unauthenticated coverage limitation and supplement with scoped internal scans.

That approach concerns a different situation: a small wireless network has neighboring SSIDs that must not be included in the client's assessment. SSID alone does not establish radio identity or scope ownership. The required result is that the report distinguishes perimeter exposure from internal asset coverage. The appropriate action is: Document the unauthenticated coverage limitation and supplement with scoped internal scans.

That approach concerns a different situation: a testing team finds a public storage share containing unencrypted customer exports. Access control and cryptography address separate disclosure paths. The required result is that an unbadged test visitor is denied unescorted entry. The appropriate action is: Introduce access control vestibules and monitored identity checks.

It would address a service exposes its administrative interface to every network segment. The relevant reason in that case is: Limiting reachability reduces opportunities for credential and service abuse. Here the required success condition is an unbadged test visitor is denied unescorted entry. The appropriate action is: Introduce access control vestibules and monitored identity checks.

This action applies to a different case: A customer has stale machine account certificates with expired owners. Key and certificate hygiene prevents service interruption and untrusted identity reuse. It does not establish the present requirement, where an unbadged test visitor is denied unescorted entry. The appropriate action is: Introduce access control vestibules and monitored identity checks.

That approach concerns a different situation: an analyst relies on a CVE record without noting whether the affected function is enabled. Attack prerequisites determine relevance to a specific system. The required result is that the report identifies the trust violation or records why it is not relevant. The relevant evidence is: The report identifies the trust violation or records why it is not relevant.

That relates to a different issue: A vulnerability ID references a flaw fixed in a backported enterprise Linux package. Vendor backports can remediate CVEs without changing upstream major version. That is not a direct remedy for the requested outcome: The report identifies the trust violation or records why it is not relevant. The relevant evidence is: The report identifies the trust violation or records why it is not relevant.

It would address an analyst sees a high CVSS issue on an isolated lab host and a lower-scored actively exploited issue on a public gateway. The relevant reason in that case is: CVSS alone omits environmental and current threat context. Here the required success condition is the report identifies the trust violation or records why it is not relevant. The relevant evidence is: The report identifies the trust violation or records why it is not relevant.

It would address a tester copied a synthetic data set to a controlled staging container. The relevant reason in that case is: Even synthetic test data should follow documented lifecycle cleanup. Here the required success condition is the retired key fails and the key inventory lists its revocation. The appropriate action is: Revoke the key and validate dependent test automation is retired.

That approach concerns a different situation: an engagement installed a scheduled laboratory test task that remains after testing is complete. Persistence artifacts must not survive beyond signed testing authorization. The required result is that the retired key fails and the key inventory lists its revocation. The appropriate action is: Revoke the key and validate dependent test automation is retired.

That relates to a different issue: An application security exercise saved a proof-of-concept script in an application document root. Residual files in a web root can become unintended access points. That is not a direct remedy for the requested outcome: The retired key fails and the key inventory lists its revocation. The appropriate action is: Revoke the key and validate dependent test automation is retired.

That relates to a different issue: A cloud provider permits vulnerability scanning only under defined acceptable-use conditions. A customer's permission cannot override a hosting provider's contractual constraints. That is not a direct remedy for the requested outcome: The signed document identifies host ranges, times, and expected outputs. The relevant evidence is: The signed document identifies host ranges, times, and expected outputs.

This result applies to a different case: The client asks which contract establishes general payment and liability terms across annual projects. An MSA typically governs the continuing commercial relationship. It does not establish the present requirement, where the signed document identifies host ranges, times, and expected outputs. The relevant evidence is: The signed document identifies host ranges, times, and expected outputs.

That approach concerns a different situation: two companies need confidentiality protection before testers receive internal network diagrams. An NDA governs handling of confidential information prior to technical access. The required result is that the signed document identifies host ranges, times, and expected outputs. The relevant evidence is: The signed document identifies host ranges, times, and expected outputs.

That approach concerns a different situation: a customer has stale machine account certificates with expired owners. Key and certificate hygiene prevents service interruption and untrusted identity reuse. The required result is that an unapproved test drive is blocked and recorded. The relevant evidence is: An unapproved test drive is blocked and recorded.

It would address a production app stores an API key in a publicly readable deployment manifest. The relevant reason in that case is: Secret revocation is necessary after disclosure; merely hiding a file is insufficient. Here the required success condition is an unapproved test drive is blocked and recorded. The relevant evidence is: An unapproved test drive is blocked and recorded.

This result applies to a different case: A login form is vulnerable to injected SQL fragments in a parameter. Bound query parameters prevent user input from becoming SQL syntax. It does not establish the present requirement, where an unapproved test drive is blocked and recorded. The relevant evidence is: An unapproved test drive is blocked and recorded.