Exam Bundle

This action applies to a different case: An internal team finds unexpected use of PsExec on an accounting server. PsExec-style remote execution creates traceable service and process artifacts. It does not establish the present requirement, where a test operation links originating principal to target machine events. The appropriate action is: Correlate WMI event traces, authentication, and target process creation.

That approach concerns a different situation: an internal service uses cleartext FTP to move administrative files between servers. Plaintext file transfer can reveal data and credentials to intermediate observers. The required result is that a test operation links originating principal to target machine events. The appropriate action is: Correlate WMI event traces, authentication, and target process creation.

That relates to a different issue: A test account reaches a Windows management endpoint through WinRM from an unexpected subnet. WinRM provides remote Windows management under authenticated privileges. That is not a direct remedy for the requested outcome: A test operation links originating principal to target machine events. The appropriate action is: Correlate WMI event traces, authentication, and target process creation.

That relates to a different issue: A vulnerability scan highlights a CVE in a dormant service not installed on the target. CVE matching must correspond to actual components. That is not a direct remedy for the requested outcome: The scan summary separates authenticated successes from failed logins. The relevant evidence is: The scan summary separates authenticated successes from failed logins.

This result applies to a different case: A scanner's authenticated credential was disabled during the test with no alert in the output summary. Credentials can silently fail and create false negative coverage. It does not establish the present requirement, where the scan summary separates authenticated successes from failed logins. The relevant evidence is: The scan summary separates authenticated successes from failed logins.

That approach concerns a different situation: a report lists identical web flaws under many query-string permutations. Multiple payload variants do not necessarily represent independent vulnerabilities. The required result is that the scan summary separates authenticated successes from failed logins. The relevant evidence is: The scan summary separates authenticated successes from failed logins.

That approach concerns a different situation: a company wants measurable technical security testing of network and physical channels. OSSTMM focuses on methodical operational security testing and measurement. The required result is that the test case traces to the applicable MASVS control area. The relevant evidence is: The test case traces to the applicable MASVS control area.

It would address a tester needs a structured penetration testing workflow from pre-engagement to reporting. The relevant reason in that case is: PTES explicitly addresses preparation, discovery, exploitation, and reporting. Here the required success condition is the test case traces to the applicable MASVS control area. The relevant evidence is: The test case traces to the applicable MASVS control area.

This result applies to a different case: A threat model asks which category covers an attacker changing stored invoice values. STRIDE describes six threat classes, including unauthorized modification. It does not establish the present requirement, where the test case traces to the applicable MASVS control area. The relevant evidence is: The test case traces to the applicable MASVS control area.

This action applies to a different case: A host reports UDP ports as open-or-filtered and the analyst marks them definitely exploitable. Silence does not prove a UDP listener exists. It does not establish the present requirement, where the scan summary separates authenticated successes from failed logins. The appropriate action is: Report a coverage gap and rerun safely with corrected permissions.

That approach concerns a different situation: a scanner discovers a cloud service tag matching a vulnerable product but no accessible resource endpoint. Product labels do not alone prove exploitability. The required result is that the scan summary separates authenticated successes from failed logins. The appropriate action is: Report a coverage gap and rerun safely with corrected permissions.

It would address a scan identifies a dangerous account permission but the permission is effectively denied by a higher-level policy. The relevant reason in that case is: Effective access can depend on multiple policy layers. Here the required success condition is the scan summary separates authenticated successes from failed logins. The appropriate action is: Report a coverage gap and rerun safely with corrected permissions.

It would address an organization needs to compare simulated adversary behavior across controlled lab systems. The relevant reason in that case is: Simulation frameworks automate observable behaviors and require careful scoping. Here the required success condition is lab captures demonstrate the intended parsing behavior without production traffic. The appropriate action is: Move packet construction to a permitted lab and limit live production analysis to passive observation.

This action applies to a different case: A tester wants to use PowerShell functions for recurring approved AD inventory steps. Reusable scripted functions improve repeatability and limit accidental actions. It does not establish the present requirement, where lab captures demonstrate the intended parsing behavior without production traffic. The appropriate action is: Move packet construction to a permitted lab and limit live production analysis to passive observation.

That relates to a different issue: A security analyst wants to run Atomic Red Team tests but production containment could be triggered. Breach-and-attack simulation must respect real business impact. That is not a direct remedy for the requested outcome: Lab captures demonstrate the intended parsing behavior without production traffic. The appropriate action is: Move packet construction to a permitted lab and limit live production analysis to passive observation.

That relates to a different issue: An assessment finds a web service protected by a WAF that blocks many scanner patterns. WAF responses can mask vulnerabilities and reduce scan completeness. That is not a direct remedy for the requested outcome: The final run clearly separates credentialed from unauthenticated coverage. The appropriate action is: Stop interpreting subsequent results as credentialed and investigate session expiry.

This action applies to a different case: A security pipeline may contain private API tokens in committed history. Secret detection should avoid creating new exposure in logs. It does not establish the present requirement, where the final run clearly separates credentialed from unauthenticated coverage. The appropriate action is: Stop interpreting subsequent results as credentialed and investigate session expiry.

That approach concerns a different situation: a vulnerability analyst needs to assess a publicly reachable web server's unsafe headers and default files. Web configuration assessment targets service weaknesses distinct from full code review. The required result is that the final run clearly separates credentialed from unauthenticated coverage. The appropriate action is: Stop interpreting subsequent results as credentialed and investigate session expiry.

That approach concerns a different situation: a client disputes the report because screenshots reveal an uninvolved customer's record. Evidence must remain sufficient without leaking unnecessary information. The required result is that the limitations section states which assets and techniques were not exercised. The appropriate action is: Explicitly disclose methods, scope limitations, and testing exclusions.

That relates to a different issue: A report lists findings without distinguishing actual exploitation from inferred attack paths. Test limitations can materially affect the strength of a claim. That is not a direct remedy for the requested outcome: The limitations section states which assets and techniques were not exercised. The appropriate action is: Explicitly disclose methods, scope limitations, and testing exclusions.

This action applies to a different case: A team used an AI writing assistant and introduced an invented exploit claim into the draft. Generated narrative must not replace factual source observations. It does not establish the present requirement, where the limitations section states which assets and techniques were not exercised. The appropriate action is: Explicitly disclose methods, scope limitations, and testing exclusions.

This action applies to a different case: A tester wants to use PowerShell functions for recurring approved AD inventory steps. Reusable scripted functions improve repeatability and limit accidental actions. It does not establish the present requirement, where the report maps each operation to approved hosts and detections. The appropriate action is: Use MITRE Caldera or an approved BAS platform with an explicit operation plan.

That approach concerns a different situation: a Python test harness submits the same harmless API validation twice after a timeout. Retries must not produce duplicate state changes in a target app. The required result is that the report maps each operation to approved hosts and detections. The appropriate action is: Use MITRE Caldera or an approved BAS platform with an explicit operation plan.

It would address a PowerShell lab tool scans too many endpoints in parallel, triggering service health alarms. The relevant reason in that case is: Automation pacing is part of authorized test safety. Here the required success condition is the report maps each operation to approved hosts and detections. The appropriate action is: Use MITRE Caldera or an approved BAS platform with an explicit operation plan.

It would address an assessor needs a visual correlation of public information about a company's technology footprint. The relevant reason in that case is: Automated OSINT correlation must preserve provenance and avoid off-scope probing. Here the required success condition is the result differentiates live DNS from historical third-party observations. The appropriate action is: Use DNSdumpster or documented DNS lookups as passive evidence.

This action applies to a different case: A tester needs broad public-domain subdomain candidates without hitting customer hosts. Passive subdomain enumeration collects third-party DNS and certificate evidence. It does not establish the present requirement, where the result differentiates live DNS from historical third-party observations. The appropriate action is: Use DNSdumpster or documented DNS lookups as passive evidence.

That approach concerns a different situation: a team wants passive wireless access point geolocation candidates near a client site. Crowdsourced radio data is passive and may be stale or inaccurate. The required result is that the result differentiates live DNS from historical third-party observations. The appropriate action is: Use DNSdumpster or documented DNS lookups as passive evidence.

That relates to a different issue: A cloud endpoint returns a metadata document with instance identifiers visible only from inside the instance. Instance metadata normally has context-specific network access boundaries. That is not a direct remedy for the requested outcome: The report records observed version evidence or uncertainty. The appropriate action is: Use authorized read-only version discovery rather than assuming vulnerability from the path.

It would address a tester needs to discover running operating system services using only a read-only endpoint account. The relevant reason in that case is: Authenticated enumeration can identify services without exploiting them. Here the required success condition is the report records observed version evidence or uncertainty. The appropriate action is: Use authorized read-only version discovery rather than assuming vulnerability from the path.

That approach concerns a different situation: an in-scope Windows server advertises SMB but shares cannot be listed anonymously. Authentication boundaries limit accessible share inventories. The required result is that the report records observed version evidence or uncertainty. The appropriate action is: Use authorized read-only version discovery rather than assuming vulnerability from the path.

That approach concerns a different situation: a wireless sensor records repeated malformed management frames near a permitted client test area. Malformed frames can stress wireless implementations. The required result is that a controlled client rejects an unapproved proxy configuration. The relevant evidence is: A controlled client rejects an unapproved proxy configuration.

That relates to a different issue: A wireless network allows unauthenticated access to sensitive IoT controls via an isolated SSID. Wireless network names do not enforce data-plane isolation. That is not a direct remedy for the requested outcome: A controlled client rejects an unapproved proxy configuration. The relevant evidence is: A controlled client rejects an unapproved proxy configuration.

It would address a company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. The relevant reason in that case is: Service-disruption methods require explicit risk and impact authorization. Here the required success condition is a controlled client rejects an unapproved proxy configuration. The relevant evidence is: A controlled client rejects an unapproved proxy configuration.