Exam Bundle

That approach concerns a different situation: a wireless sensor records repeated malformed management frames near a permitted client test area. Malformed frames can stress wireless implementations. The required result is that a controlled client rejects an unapproved proxy configuration. The relevant evidence is: A controlled client rejects an unapproved proxy configuration.

That relates to a different issue: A wireless network allows unauthenticated access to sensitive IoT controls via an isolated SSID. Wireless network names do not enforce data-plane isolation. That is not a direct remedy for the requested outcome: A controlled client rejects an unapproved proxy configuration. The relevant evidence is: A controlled client rejects an unapproved proxy configuration.

It would address a company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. The relevant reason in that case is: Service-disruption methods require explicit risk and impact authorization. Here the required success condition is a controlled client rejects an unapproved proxy configuration. The relevant evidence is: A controlled client rejects an unapproved proxy configuration.

This action applies to a different case: A Windows estate needs a structured credentialed inventory of missing patches and weak configuration. Credentialed assessment improves version and local-setting coverage. It does not establish the present requirement, where the result cites observed missing headers or exposed files, not an assumed exploit. The appropriate action is: Use a scoped web server configuration scanner such as Nikto.

That approach concerns a different situation: a security pipeline may contain private API tokens in committed history. Secret detection should avoid creating new exposure in logs. The required result is that the result cites observed missing headers or exposed files, not an assumed exploit. The appropriate action is: Use a scoped web server configuration scanner such as Nikto.

That relates to a different issue: An analyst must assess an ICS network that lacks safe active vulnerability scanning windows. Live probing can create safety and availability risk to industrial equipment. That is not a direct remedy for the requested outcome: The result cites observed missing headers or exposed files, not an assumed exploit. The appropriate action is: Use a scoped web server configuration scanner such as Nikto.

It would address a cloud service is misconfigured but the contract forbids modification of production access policies. The relevant reason in that case is: Exploitation must respect both target scope and permitted change types. Here the required success condition is the test plan records why the gateway is handled first within scope. The relevant evidence is: The test plan records why the gateway is handled first within scope.

This result applies to a different case: An assessment uses only a CVSS number to estimate the likelihood of active exploitation. EPSS estimates exploitation likelihood rather than vulnerability impact. It does not establish the present requirement, where the test plan records why the gateway is handled first within scope. The relevant evidence is: The test plan records why the gateway is handled first within scope.

That relates to a different issue: A customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. That is not a direct remedy for the requested outcome: The test plan records why the gateway is handled first within scope. The relevant evidence is: The test plan records why the gateway is handled first within scope.

That relates to a different issue: Operations permits active scans only after midnight, while the tester finds an exposed service in the afternoon. Rules of engagement control test timing independently of technical urgency. That is not a direct remedy for the requested outcome: The incident log identifies the halt time, owner notification, and recovery outcome. The relevant evidence is: The incident log identifies the halt time, owner notification, and recovery outcome.

This result applies to a different case: A rules-of-engagement document allows web requests but explicitly forbids denial-of-service tests. A permitted web scope does not imply authorization for availability attacks. It does not establish the present requirement, where the incident log identifies the halt time, owner notification, and recovery outcome. The relevant evidence is: The incident log identifies the halt time, owner notification, and recovery outcome.

That approach concerns a different situation: an assessor wants to use credential spraying although the signed rules prohibit account lockouts. Potential lockouts violate explicit testing restrictions without changed authorization. The required result is that the incident log identifies the halt time, owner notification, and recovery outcome. The relevant evidence is: The incident log identifies the halt time, owner notification, and recovery outcome.

That relates to a different issue: An authorized lab needs to test data staging without triggering production record changes. Controlled artifacts allow measurement of transfer behavior without real data exposure. That is not a direct remedy for the requested outcome: The lab shows synthetic bytes crossed the approved boundary only. The appropriate action is: Use a pre-agreed synthetic file and bounded transfer limit.

It would address a service sends files to an external mailbox instead of a sanctioned business archive. The relevant reason in that case is: Email offers a familiar outbound path that may bypass specialized DLP controls. Here the required success condition is the lab shows synthetic bytes crossed the approved boundary only. The appropriate action is: Use a pre-agreed synthetic file and bounded transfer limit.

This action applies to a different case: An application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. Encrypted transport can conceal unauthorized data transfer. It does not establish the present requirement, where the lab shows synthetic bytes crossed the approved boundary only. The appropriate action is: Use a pre-agreed synthetic file and bounded transfer limit.

That approach concerns a different situation: a tester's temporary agent service remains installed after a sandbox demonstration. Removing the installer alone does not terminate active service components. The required result is that a reviewed policy diff matches the approved baseline. The appropriate action is: Revert the exception to the pre-test configuration after validation.

That relates to a different issue: A test team performed controlled changes to a lab Kubernetes role assignment. Temporary elevated cluster roles can outlive the exercise. That is not a direct remedy for the requested outcome: A reviewed policy diff matches the approved baseline. The appropriate action is: Revert the exception to the pre-test configuration after validation.

It would address an assessment delivered a security finding while the last test proxy still listens on a public address. The relevant reason in that case is: Temporary test infrastructure can itself become an internet exposure. Here the required success condition is a reviewed policy diff matches the approved baseline. The appropriate action is: Revert the exception to the pre-test configuration after validation.

It would address an OAuth API lets a read-only token change a different user's account settings. The relevant reason in that case is: A valid token is insufficient when it lacks the required action or object access. Here the required success condition is a bounded synthetic query over complexity limits is rejected. The relevant evidence is: A bounded synthetic query over complexity limits is rejected.

This result applies to a different case: A server presents user profile data from a shared cache keyed only by URL. Cross-user cache leakage can bypass application-level access policy. It does not establish the present requirement, where a bounded synthetic query over complexity limits is rejected. The relevant evidence is: A bounded synthetic query over complexity limits is rejected.

That relates to a different issue: A REST API silently processes unsupported HTTP methods as privileged operations. Method confusion can expose operations not covered by UI controls. That is not a direct remedy for the requested outcome: A bounded synthetic query over complexity limits is rejected. The relevant evidence is: A bounded synthetic query over complexity limits is rejected.

That relates to a different issue: A login portal sees a few guesses for one password across many different usernames. Spraying tests one or few common secrets against many identities. That is not a direct remedy for the requested outcome: Controlled logs attribute the ticket to an unexpected host. The appropriate action is: Recognize pass-the-ticket behavior and assess ticket protection controls.

This action applies to a different case: An application accepts arbitrary SAML assertions lacking strict issuer verification. Federation trust requires correct issuer, audience, expiry, and signatures. It does not establish the present requirement, where controlled logs attribute the ticket to an unexpected host. The appropriate action is: Recognize pass-the-ticket behavior and assess ticket protection controls.

That approach concerns a different situation: an analyst needs an offline password strength assessment but policy prohibits online guessing. Offline password auditing can measure weakness without account lockouts. The required result is that controlled logs attribute the ticket to an unexpected host. The appropriate action is: Recognize pass-the-ticket behavior and assess ticket protection controls.

That approach concerns a different situation: a temporary password was set on an approved test account during a proof. Temporary authentication changes can create lingering security risk. The required result is that a scoped connectivity check confirms the proxy endpoint is closed. The relevant evidence is: A scoped connectivity check confirms the proxy endpoint is closed.

That relates to a different issue: A report needs proof that no unauthorized modification remained after a system-level assessment. Restoration requires verification, not a verbal cleanup statement. That is not a direct remedy for the requested outcome: A scoped connectivity check confirms the proxy endpoint is closed. The relevant evidence is: A scoped connectivity check confirms the proxy endpoint is closed.

It would address a temporary firewall exception was added to a test subnet under approved change control. The relevant reason in that case is: Testing changes must not weaken production controls after the engagement. Here the required success condition is a scoped connectivity check confirms the proxy endpoint is closed. The relevant evidence is: A scoped connectivity check confirms the proxy endpoint is closed.

This result applies to a different case: A script assumes a TCP connection timeout means a port is closed. Filtering, routing loss, and explicit rejection have distinct meanings. It does not establish the present requirement, where only approved reviewers can read the exported inventory. The relevant evidence is: Only approved reviewers can read the exported inventory.

That approach concerns a different situation: a Bash parser confuses space-delimited columns when service banners include spaces. Human-readable tool output is unsafe as an implicit fixed-column schema. The required result is that only approved reviewers can read the exported inventory. The relevant evidence is: Only approved reviewers can read the exported inventory.

That relates to a different issue: A team wants to correlate results from Bash, Python, and PowerShell utilities. Consistent output fields support reproducible, attributable analysis. That is not a direct remedy for the requested outcome: Only approved reviewers can read the exported inventory. The relevant evidence is: Only approved reviewers can read the exported inventory.

This action applies to a different case: A test host's ARP poisoning protection rejects an untrusted gateway claim. Network access checks can prevent an on-path position before application traffic. It does not establish the present requirement, where a lab segmentation test shows untrusted frames cannot reach protected VLANs. The appropriate action is: Assess VLAN hopping risk within a dedicated lab switch and avoid production disruption.

That approach concerns a different situation: a network appliance's HTTP admin login is open on a management VLAN shared with guests. Guest-to-admin reachability increases risk irrespective of password strength. The required result is that a lab segmentation test shows untrusted frames cannot reach protected VLANs. The appropriate action is: Assess VLAN hopping risk within a dedicated lab switch and avoid production disruption.

That relates to a different issue: A captured lab TCP session reveals an intermediary can see unencrypted application data. Traffic traversing an attacker-controlled segment can expose plaintext. That is not a direct remedy for the requested outcome: A lab segmentation test shows untrusted frames cannot reach protected VLANs. The appropriate action is: Assess VLAN hopping risk within a dedicated lab switch and avoid production disruption.