Exam Bundle

That relates to a different issue: A team wants to correlate results from Bash, Python, and PowerShell utilities. Consistent output fields support reproducible, attributable analysis. That is not a direct remedy for the requested outcome: A test token is absent from all generated log files. The appropriate action is: Redact authorization headers and restrict debug log content.

It would address a shell loop sends every possible path to a fragile production app at full speed. The relevant reason in that case is: Rate and volume controls are required to respect engagement limits. Here the required success condition is a test token is absent from all generated log files. The appropriate action is: Redact authorization headers and restrict debug log content.

This action applies to a different case: A Bash host inventory script silently processes blank lines as targets. Input sanitation prevents accidental or malformed probe targets. It does not establish the present requirement, where a test token is absent from all generated log files. The appropriate action is: Redact authorization headers and restrict debug log content.

This action applies to a different case: A Windows endpoint uses an overly broad service account that can install services on many servers. Service creation rights can enable privileged code execution. It does not establish the present requirement, where a lab timeline attributes the service to an approved operator identity. The appropriate action is: Correlate service creation and process launch logs rather than assuming legitimate administration.

That approach concerns a different situation: a Windows event log unexpectedly stops recording privileged actions during a test. Audit integrity is required to detect and investigate host compromise. The required result is that a lab timeline attributes the service to an approved operator identity. The appropriate action is: Correlate service creation and process launch logs rather than assuming legitimate administration.

That relates to a different issue: A Windows service launches an executable using an unquoted path containing spaces. Ambiguous executable paths matter only when lower-privilege users control a candidate location. That is not a direct remedy for the requested outcome: A lab timeline attributes the service to an approved operator identity. The appropriate action is: Correlate service creation and process launch logs rather than assuming legitimate administration.

This result applies to a different case: An attacker places a plausible company-branded Wi-Fi login page in a public lobby. Impersonated access portals can collect user authentication data. It does not establish the present requirement, where the test PIN is shielded and unapproved observation cannot recover it. The relevant evidence is: The test PIN is shielded and unapproved observation cannot recover it.

That approach concerns a different situation: a security team wants to evaluate whether staff report suspicious phone calls instead of obeying them. Social testing measures human response while protecting staff privacy and safety. The required result is that the test PIN is shielded and unapproved observation cannot recover it. The relevant evidence is: The test PIN is shielded and unapproved observation cannot recover it.

That relates to a different issue: A telephone caller impersonates a helpdesk employee and demands a one-time authentication code. Voice pretexts can solicit secrets or bypass verification procedures. That is not a direct remedy for the requested outcome: The test PIN is shielded and unapproved observation cannot recover it. The relevant evidence is: The test PIN is shielded and unapproved observation cannot recover it.

That relates to a different issue: A security team wants to evaluate whether staff report suspicious phone calls instead of obeying them. Social testing measures human response while protecting staff privacy and safety. That is not a direct remedy for the requested outcome: Messages go only to the permitted synthetic or opt-in recipients. The appropriate action is: Use an approved Gophish or SET campaign configured for safe objectives.

This action applies to a different case: A compromised community website frequently used by a particular department redirects users to unsafe content. Trusted browsing habits can expose targeted groups to hostile sites. It does not establish the present requirement, where messages go only to the permitted synthetic or opt-in recipients. The appropriate action is: Use an approved Gophish or SET campaign configured for safe objectives.

That approach concerns a different situation: a malicious message is tailored to a financial executive's current acquisition project. Role-specific pretexts can increase credibility with high-value individuals. The required result is that messages go only to the permitted synthetic or opt-in recipients. The appropriate action is: Use an approved Gophish or SET campaign configured for safe objectives.

That approach concerns a different situation: an executive questions why a seemingly low-scored issue was escalated immediately. Contextual risk may exceed a scanner's default severity estimate. The required result is that published screenshots contain no prohibited identifiers or secrets. The appropriate action is: Use approved redacted evidence and stakeholder-approved distribution permissions.

That relates to a different issue: A service owner reports unexpected instability that might be unrelated to a recent scan. Temporal correlation alone is insufficient proof of test-caused outage. That is not a direct remedy for the requested outcome: Published screenshots contain no prohibited identifiers or secrets. The appropriate action is: Use approved redacted evidence and stakeholder-approved distribution permissions.

It would address operations and security disagree about whether a fragile server may be actively scanned. The relevant reason in that case is: Cross-team agreement is needed when testing could disrupt business services. Here the required success condition is published screenshots contain no prohibited identifiers or secrets. The appropriate action is: Use approved redacted evidence and stakeholder-approved distribution permissions.

This action applies to a different case: A scanner reports a critical flaw based solely on an HTTP banner with a potentially spoofed version. Banner-only matching can produce false positives. It does not establish the present requirement, where the report documents the evidence proving the component is absent. The appropriate action is: Classify the result as a false positive after confirming package absence.

That relates to a different issue: A scan identifies a dangerous account permission but the permission is effectively denied by a higher-level policy. Effective access can depend on multiple policy layers. That is not a direct remedy for the requested outcome: The report documents the evidence proving the component is absent. The appropriate action is: Classify the result as a false positive after confirming package absence.

It would address a threat intelligence feed marks a package as exploited but the application team calls its severity moderate. The relevant reason in that case is: Exploitability and external exposure may elevate practical risk. Here the required success condition is the report documents the evidence proving the component is absent. The appropriate action is: Classify the result as a false positive after confirming package absence.

It would address an approved lab shows NTLM network authentication may be accepted without a plaintext password. The relevant reason in that case is: Reusable password-derived authentication material can be abused in some NTLM flows. Here the required success condition is the login telemetry records repeated guesses against one test account. The relevant evidence is: The login telemetry records repeated guesses against one test account.

This result applies to a different case: A website returns a different error for nonexisting usernames even when all passwords fail. Error consistency prevents disclosure of valid account identities. It does not establish the present requirement, where the login telemetry records repeated guesses against one test account. The relevant evidence is: The login telemetry records repeated guesses against one test account.

That approach concerns a different situation: a login portal sees a few guesses for one password across many different usernames. Spraying tests one or few common secrets against many identities. The required result is that the login telemetry records repeated guesses against one test account. The relevant evidence is: The login telemetry records repeated guesses against one test account.

That relates to a different issue: The engagement needs a passive mapping of email addresses published on customer sites. Public email discovery can reveal exposed identifiers without authentication. That is not a direct remedy for the requested outcome: The report records the requested record types and observed values. The relevant evidence is: The report records the requested record types and observed values.

It would address a tester needs broad public-domain subdomain candidates without hitting customer hosts. The relevant reason in that case is: Passive subdomain enumeration collects third-party DNS and certificate evidence. Here the required success condition is the report records the requested record types and observed values. The relevant evidence is: The report records the requested record types and observed values.

That approach concerns a different situation: an assessor needs a visual correlation of public information about a company's technology footprint. Automated OSINT correlation must preserve provenance and avoid off-scope probing. The required result is that the report records the requested record types and observed values. The relevant evidence is: The report records the requested record types and observed values.

That approach concerns a different situation: a client wants a recognized penetration-testing service accreditation model. CREST provides professional testing standards and assurance mechanisms. The required result is that the model maps the forged identity to spoofing mitigations. The appropriate action is: Classify the scenario under STRIDE spoofing.

That relates to a different issue: A web application team wants a prioritized list of common application security risk categories. OWASP Top 10 groups frequent web application security risks. That is not a direct remedy for the requested outcome: The model maps the forged identity to spoofing mitigations. The appropriate action is: Classify the scenario under STRIDE spoofing.

It would address a threat model asks which category covers an attacker changing stored invoice values. The relevant reason in that case is: STRIDE describes six threat classes, including unauthorized modification. Here the required success condition is the model maps the forged identity to spoofing mitigations. The appropriate action is: Classify the scenario under STRIDE spoofing.

This result applies to a different case: A lab server accepts SMB authentication relayed from another service without enforcing signing. Unsigned authentication flows can be replayed or relayed across trust boundaries. It does not establish the present requirement, where the path diagram marks confirmed in-scope and out-of-scope endpoints. The relevant evidence is: The path diagram marks confirmed in-scope and out-of-scope endpoints.

That approach concerns a different situation: a network team wants safe evidence that its service account cannot authenticate to unrelated SMB hosts. A service account's trust scope affects lateral movement potential. The required result is that the path diagram marks confirmed in-scope and out-of-scope endpoints. The relevant evidence is: The path diagram marks confirmed in-scope and out-of-scope endpoints.

It would address a Windows domain has AD Certificate Services templates granting enrollment privileges to unintended users. The relevant reason in that case is: Misconfigured certificate templates can grant unintended authentication capabilities. Here the required success condition is the path diagram marks confirmed in-scope and out-of-scope endpoints. The relevant evidence is: The path diagram marks confirmed in-scope and out-of-scope endpoints.

This result applies to a different case: A company wants measurable technical security testing of network and physical channels. OSSTMM focuses on methodical operational security testing and measurement. It does not establish the present requirement, where the model maps the forged identity to spoofing mitigations. The relevant evidence is: The model maps the forged identity to spoofing mitigations.

That approach concerns a different situation: an industrial plant needs a diagram of enterprise, supervisory, and process-control zones. Purdue levels organize industrial control network functions and boundaries. The required result is that the model maps the forged identity to spoofing mitigations. The relevant evidence is: The model maps the forged identity to spoofing mitigations.

That relates to a different issue: A mobile team needs verification criteria for client-side storage and authentication controls. MASVS defines mobile application security verification requirements. That is not a direct remedy for the requested outcome: The model maps the forged identity to spoofing mitigations. The relevant evidence is: The model maps the forged identity to spoofing mitigations.