Exam Bundle

That approach concerns a different situation: a customer has stale machine account certificates with expired owners. Key and certificate hygiene prevents service interruption and untrusted identity reuse. The required result is that an unapproved test drive is blocked and recorded. The relevant evidence is: An unapproved test drive is blocked and recorded.

It would address a production app stores an API key in a publicly readable deployment manifest. The relevant reason in that case is: Secret revocation is necessary after disclosure; merely hiding a file is insufficient. Here the required success condition is an unapproved test drive is blocked and recorded. The relevant evidence is: An unapproved test drive is blocked and recorded.

This result applies to a different case: A login form is vulnerable to injected SQL fragments in a parameter. Bound query parameters prevent user input from becoming SQL syntax. It does not establish the present requirement, where an unapproved test drive is blocked and recorded. The relevant evidence is: An unapproved test drive is blocked and recorded.

This result applies to a different case: A cloud team worries that an old object storage endpoint is indexed in search results. Search indices can disclose public paths even after application navigation changes. It does not establish the present requirement, where the inventory distinguishes historical URLs from currently reachable endpoints. The relevant evidence is: The inventory distinguishes historical URLs from currently reachable endpoints.

That relates to a different issue: A tester's passive source lists an IP as belonging to a vendor, but the contract targets the customer only. Internet intelligence results may have stale service ownership attribution. That is not a direct remedy for the requested outcome: The inventory distinguishes historical URLs from currently reachable endpoints. The relevant evidence is: The inventory distinguishes historical URLs from currently reachable endpoints.

It would address a tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. The relevant reason in that case is: Reverse names provide attribution hints but are not reliable proof of asset ownership. Here the required success condition is the inventory distinguishes historical URLs from currently reachable endpoints. The relevant evidence is: The inventory distinguishes historical URLs from currently reachable endpoints.

This result applies to a different case: A CI pipeline uses an external build action pinned only to a mutable branch name. Mutable third-party build dependencies can change unexpectedly. It does not establish the present requirement, where the test automation works while unrelated administrative calls are denied. The relevant evidence is: The test automation works while unrelated administrative calls are denied.

That approach concerns a different situation: a cloud project has a cross-account role trust that permits principals outside the expected partner organization. Cross-account trust can expand reach beyond intended organizational boundaries. The required result is that the test automation works while unrelated administrative calls are denied. The relevant evidence is: The test automation works while unrelated administrative calls are denied.

That relates to a different issue: A web server can reach instance metadata with broad credentials accessible to its application identity. Metadata-derived temporary credentials may confer excessive cloud authority. That is not a direct remedy for the requested outcome: The test automation works while unrelated administrative calls are denied. The relevant evidence is: The test automation works while unrelated administrative calls are denied.

It would address a tester sees an employee hold open a restricted office door for a visitor without checking credentials. The relevant reason in that case is: Tailgating involves following an authorized entrant through a secured access point. Here the required success condition is the assessment records the risk without possessing employee credentials. The relevant evidence is: The assessment records the risk without possessing employee credentials.

This result applies to a different case: A building uses biometric authentication but has no procedure for emergency evacuation. Security controls must not obstruct legally required safe exit. It does not establish the present requirement, where the assessment records the risk without possessing employee credentials. The relevant evidence is: The assessment records the risk without possessing employee credentials.

That approach concerns a different situation: a staff member encounters an unknown visitor attempting to enter a restricted work area. Policies require actual procedural enforcement, not only badge hardware. The required result is that the assessment records the risk without possessing employee credentials. The relevant evidence is: The assessment records the risk without possessing employee credentials.

That approach concerns a different situation: a testing team ran only passive reconnaissance but the report implies full active validation. Readers must not overinterpret partial assessment coverage. The required result is that the remediation section names the control and an observable success test. The appropriate action is: Include targeted remediation steps, accountable owner, and verification guidance.

That relates to a different issue: A client disputes the report because screenshots reveal an uninvolved customer's record. Evidence must remain sufficient without leaking unnecessary information. That is not a direct remedy for the requested outcome: The remediation section names the control and an observable success test. The appropriate action is: Include targeted remediation steps, accountable owner, and verification guidance.

This action applies to a different case: A team used an AI writing assistant and introduced an invented exploit claim into the draft. Generated narrative must not replace factual source observations. It does not establish the present requirement, where the remediation section names the control and an observable success test. The appropriate action is: Include targeted remediation steps, accountable owner, and verification guidance.

This action applies to a different case: A company finds a rogue access point advertising the same SSID as its legitimate Wi-Fi. Impersonated wireless infrastructure can redirect or harvest client connections. It does not establish the present requirement, where the test record shows a non-disruptive alternative or signed change approval. The appropriate action is: Refuse that unapproved method and request a lab or maintenance-window addendum.

That approach concerns a different situation: a wireless network allows unauthenticated access to sensitive IoT controls via an isolated SSID. Wireless network names do not enforce data-plane isolation. The required result is that the test record shows a non-disruptive alternative or signed change approval. The appropriate action is: Refuse that unapproved method and request a lab or maintenance-window addendum.

That relates to a different issue: A tester wants to map an organization's access points while driving around neighboring offices. Radio proximity does not establish permission for active testing. That is not a direct remedy for the requested outcome: The test record shows a non-disruptive alternative or signed change approval. The appropriate action is: Refuse that unapproved method and request a lab or maintenance-window addendum.

This result applies to a different case: A tester finds a second service account created during an old assessment with no recorded owner. Residual identities can preserve unauthorized access after a project ends. It does not establish the present requirement, where the revoked unit cannot start after reboot. The relevant evidence is: The revoked unit cannot start after reboot.

That approach concerns a different situation: a Windows endpoint contains a newly created service with a binary path outside approved software folders. Services can restart unwanted binaries during boot. The required result is that the revoked unit cannot start after reboot. The relevant evidence is: The revoked unit cannot start after reboot.

That relates to a different issue: An endpoint security agent stops automatically after an unauthorized service modification. Weak control integrity can help malicious access persist. That is not a direct remedy for the requested outcome: The revoked unit cannot start after reboot. The relevant evidence is: The revoked unit cannot start after reboot.

That relates to a different issue: Employees frequently enter a controlled warehouse door by carrying boxes that obstruct badge presentation. Operational processes can unintentionally defeat physical control design. That is not a direct remedy for the requested outcome: The outcome shows whether unapproved badge duplication is prevented. The relevant evidence is: The outcome shows whether unapproved badge duplication is prevented.

It would address a reception area has cameras covering exits but not the badge reader at the server room. The relevant reason in that case is: Physical monitoring coverage determines visibility into unauthorized access. Here the required success condition is the outcome shows whether unapproved badge duplication is prevented. The relevant evidence is: The outcome shows whether unapproved badge duplication is prevented.

This result applies to a different case: A tester sees an employee hold open a restricted office door for a visitor without checking credentials. Tailgating involves following an authorized entrant through a secured access point. It does not establish the present requirement, where the outcome shows whether unapproved badge duplication is prevented. The relevant evidence is: The outcome shows whether unapproved badge duplication is prevented.

That approach concerns a different situation: a client asks whether Netcat or Nmap is better for a quick in-scope service handshake versus mapping many ports. Tool function must match whether the goal is a single connection or discovery. The required result is that the owner receives a specific baseline deviation and remediation test. The appropriate action is: Identify risky defaults and compare them with vendor hardening guidance.

It would address a switch port is configured to accept tags from an untrusted endpoint. The relevant reason in that case is: Incorrect trunk or native VLAN settings can break intended network segregation. Here the required success condition is the owner receives a specific baseline deviation and remediation test. The appropriate action is: Identify risky defaults and compare them with vendor hardening guidance.

This action applies to a different case: An assessor detects unsupported SMB dialects enabled for a legacy file service. Older dialects can lack modern session security features. It does not establish the present requirement, where the owner receives a specific baseline deviation and remediation test. The appropriate action is: Identify risky defaults and compare them with vendor hardening guidance.

This result applies to a different case: An external DNS zone permits public records but the client has not authorized zone-transfer testing against its provider. A DNS service may be third-party managed and subject to additional restrictions. It does not establish the present requirement, where the activity log distinguishes passive discovery from authorized API checks. The relevant evidence is: The activity log distinguishes passive discovery from authorized API checks.

That relates to a different issue: A public application exposes an API descriptor that lists endpoints not reachable by the standard UI. API documentation can reveal functionality but does not establish exploitability. That is not a direct remedy for the requested outcome: The activity log distinguishes passive discovery from authorized API checks. The relevant evidence is: The activity log distinguishes passive discovery from authorized API checks.

It would address an internet search engine lists a public RDP endpoint whose owner may have changed. The relevant reason in that case is: Search-engine indexes can lag infrastructure reassignment. Here the required success condition is the activity log distinguishes passive discovery from authorized API checks. The relevant evidence is: The activity log distinguishes passive discovery from authorized API checks.

This action applies to a different case: An internal team finds unexpected use of PsExec on an accounting server. PsExec-style remote execution creates traceable service and process artifacts. It does not establish the present requirement, where a test operation links originating principal to target machine events. The appropriate action is: Correlate WMI event traces, authentication, and target process creation.

That approach concerns a different situation: an internal service uses cleartext FTP to move administrative files between servers. Plaintext file transfer can reveal data and credentials to intermediate observers. The required result is that a test operation links originating principal to target machine events. The appropriate action is: Correlate WMI event traces, authentication, and target process creation.

That relates to a different issue: A test account reaches a Windows management endpoint through WinRM from an unexpected subnet. WinRM provides remote Windows management under authenticated privileges. That is not a direct remedy for the requested outcome: A test operation links originating principal to target machine events. The appropriate action is: Correlate WMI event traces, authentication, and target process creation.