Exam Bundle

This action applies to a different case: A test host's ARP poisoning protection rejects an untrusted gateway claim. Network access checks can prevent an on-path position before application traffic. It does not establish the present requirement, where a lab segmentation test shows untrusted frames cannot reach protected VLANs. The appropriate action is: Assess VLAN hopping risk within a dedicated lab switch and avoid production disruption.

That approach concerns a different situation: a network appliance's HTTP admin login is open on a management VLAN shared with guests. Guest-to-admin reachability increases risk irrespective of password strength. The required result is that a lab segmentation test shows untrusted frames cannot reach protected VLANs. The appropriate action is: Assess VLAN hopping risk within a dedicated lab switch and avoid production disruption.

That relates to a different issue: A captured lab TCP session reveals an intermediary can see unencrypted application data. Traffic traversing an attacker-controlled segment can expose plaintext. That is not a direct remedy for the requested outcome: A lab segmentation test shows untrusted frames cannot reach protected VLANs. The appropriate action is: Assess VLAN hopping risk within a dedicated lab switch and avoid production disruption.

That relates to a different issue: A client wants to determine whether an employee can remotely open a door with another person's proximity badge. Authentication properties must be demonstrated without using actual employee identifiers. That is not a direct remedy for the requested outcome: A controlled observation shows an unverified visitor passed the door. The appropriate action is: Classify the observed social entry weakness as tailgating.

It would address a secure room's access logs show one badge opened the door repeatedly during an unoccupied shift. The relevant reason in that case is: Access anomaly evidence is stronger when multiple sources agree. Here the required success condition is a controlled observation shows an unverified visitor passed the door. The appropriate action is: Classify the observed social entry weakness as tailgating.

That approach concerns a different situation: a data center relies on a turnstile that permits multiple people to pass behind one badge. One-factor door systems may fail to enforce one-person admission. The required result is that a controlled observation shows an unverified visitor passed the door. The appropriate action is: Classify the observed social entry weakness as tailgating.

That approach concerns a different situation: a server sends an ICMP destination-unreachable response during a UDP assessment. Certain ICMP unreachable codes are evidence of blocked or unavailable UDP destinations. The required result is that every resolved target is classified for in-scope approval. The relevant evidence is: Every resolved target is classified for in-scope approval.

That relates to a different issue: A tester wants to infer whether an address is active while ICMP echo replies are blocked. Firewalls can suppress ping despite active TCP listeners. That is not a direct remedy for the requested outcome: Every resolved target is classified for in-scope approval. The relevant evidence is: Every resolved target is classified for in-scope approval.

This result applies to a different case: A service exposes multiple ports associated with different application protocols. Nonstandard port assignments are common and port numbers are only initial clues. It does not establish the present requirement, where every resolved target is classified for in-scope approval. The relevant evidence is: Every resolved target is classified for in-scope approval.

This action applies to a different case: An assessor needs to query current A, MX, and TXT records for a customer's domain. DNS command-line tools retrieve authoritative or resolver responses. It does not establish the present requirement, where the results show a protocol observation and version confidence. The appropriate action is: Use Nmap's safe approved service-detection settings.

That approach concerns a different situation: a tester needs broad public-domain subdomain candidates without hitting customer hosts. Passive subdomain enumeration collects third-party DNS and certificate evidence. The required result is that the results show a protocol observation and version confidence. The appropriate action is: Use Nmap's safe approved service-detection settings.

It would address a research team needs to inspect whether a host has unsafe publicly disclosed service banners. The relevant reason in that case is: NSE has scripts with varied impact; safe category selection matters. Here the required success condition is the results show a protocol observation and version confidence. The appropriate action is: Use Nmap's safe approved service-detection settings.

It would address a test account reaches a Windows management endpoint through WinRM from an unexpected subnet. The relevant reason in that case is: WinRM provides remote Windows management under authenticated privileges. Here the required success condition is the analyst identifies malicious intent from context rather than filename alone. The relevant evidence is: The analyst identifies malicious intent from context rather than filename alone.

That approach concerns a different situation: an approved lab account accesses a second Windows host using a remote service management channel. Valid credentials and remote management can bridge compromised systems. The required result is that the analyst identifies malicious intent from context rather than filename alone. The relevant evidence is: The analyst identifies malicious intent from context rather than filename alone.

That relates to a different issue: A service uses LDAP to locate accounts that are also local administrators of other machines. Directory relationships can suggest a lateral path but require actual access conditions. That is not a direct remedy for the requested outcome: The analyst identifies malicious intent from context rather than filename alone. The relevant evidence is: The analyst identifies malicious intent from context rather than filename alone.

It would address the technical report mentions high severity but does not state what business process would fail. The relevant reason in that case is: Business stakeholders need consequence-based interpretation, not just severity labels. Here the required success condition is the revised plan includes approved priorities and delivery changes. The appropriate action is: Document the reprioritization and obtain stakeholder approval before reallocating work.

This action applies to a different case: An executive questions why a seemingly low-scored issue was escalated immediately. Contextual risk may exceed a scanner's default severity estimate. It does not establish the present requirement, where the revised plan includes approved priorities and delivery changes. The appropriate action is: Document the reprioritization and obtain stakeholder approval before reallocating work.

That approach concerns a different situation: a service owner reports unexpected instability that might be unrelated to a recent scan. Temporal correlation alone is insufficient proof of test-caused outage. The required result is that the revised plan includes approved priorities and delivery changes. The appropriate action is: Document the reprioritization and obtain stakeholder approval before reallocating work.

That approach concerns a different situation: a draft describes a five-stage intrusion but has no chronological sequence. A chronological narrative explains causal progression and potential impact. The required result is that severity and likelihood are applied consistently to similar findings. The appropriate action is: Use a stated, consistent risk methodology with environmental context.

That relates to a different issue: The customer cannot reproduce a finding because no affected endpoint or observation time is included. Reproducible reporting supports client verification and remediation. That is not a direct remedy for the requested outcome: Severity and likelihood are applied consistently to similar findings. The appropriate action is: Use a stated, consistent risk methodology with environmental context.

It would address the final report mixes low-level findings and management decisions with no consistent layout. The relevant reason in that case is: Consistent formatting supports audiences with different needs. Here the required success condition is severity and likelihood are applied consistently to similar findings. The appropriate action is: Use a stated, consistent risk methodology with environmental context.

This action applies to a different case: A lab capture suggests a client can be redirected to an attacker-controlled proxy by wireless discovery settings. Proxy auto-discovery can create traffic interception opportunities. It does not establish the present requirement, where the access point no longer permits PIN-based enrollment. The appropriate action is: Disable vulnerable PIN enrollment and prefer stronger approved onboarding.

That approach concerns a different situation: a test employee connects to a public-looking access point that offers the corporate SSID with a different certificate. Enterprise Wi-Fi trust should bind authentication to known infrastructure. The required result is that the access point no longer permits PIN-based enrollment. The appropriate action is: Disable vulnerable PIN enrollment and prefer stronger approved onboarding.

That relates to a different issue: A company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. Service-disruption methods require explicit risk and impact authorization. That is not a direct remedy for the requested outcome: The access point no longer permits PIN-based enrollment. The appropriate action is: Disable vulnerable PIN enrollment and prefer stronger approved onboarding.

It would address a tester sees port 445 on an authorized server but has no credentials to enumerate its shares. The relevant reason in that case is: Service availability is not the same as permission to enumerate protected resources. Here the required success condition is an approved resolver test shows the intended name-to-address binding. The relevant evidence is: An approved resolver test shows the intended name-to-address binding.

This result applies to a different case: A switch port is configured to accept tags from an untrusted endpoint. Incorrect trunk or native VLAN settings can break intended network segregation. It does not establish the present requirement, where an approved resolver test shows the intended name-to-address binding. The relevant evidence is: An approved resolver test shows the intended name-to-address binding.

That approach concerns a different situation: a network appliance's HTTP admin login is open on a management VLAN shared with guests. Guest-to-admin reachability increases risk irrespective of password strength. The required result is that an approved resolver test shows the intended name-to-address binding. The relevant evidence is: An approved resolver test shows the intended name-to-address binding.

That relates to a different issue: An assessor created a temporary directory account to validate scoped identity permissions. Tester-created identities can become lingering access paths. That is not a direct remedy for the requested outcome: The task inventory and post-reboot check confirm its removal. The appropriate action is: Remove the task and verify it cannot run again.

This action applies to a different case: A report needs proof that no unauthorized modification remained after a system-level assessment. Restoration requires verification, not a verbal cleanup statement. It does not establish the present requirement, where the task inventory and post-reboot check confirm its removal. The appropriate action is: Remove the task and verify it cannot run again.

That approach concerns a different situation: an assessment deployed a temporary cloud VM and associated public IP for a controlled attack simulation. Temporary test resources can create ongoing cost and exposure. The required result is that the task inventory and post-reboot check confirm its removal. The appropriate action is: Remove the task and verify it cannot run again.

That approach concerns a different situation: a service accepts a filename that resolves through a symlink to a protected system path. Text-based path checks can be bypassed by filesystem indirection. The required result is that a test URL targeting a prohibited internal endpoint is rejected. The relevant evidence is: A test URL targeting a prohibited internal endpoint is rejected.

It would address a report generator uses user input inside its server-side template expression parser. The relevant reason in that case is: Template engines may execute operators or expose objects when input is treated as syntax. Here the required success condition is a test URL targeting a prohibited internal endpoint is rejected. The relevant evidence is: A test URL targeting a prohibited internal endpoint is rejected.

This result applies to a different case: A web handler includes a local log file by user-supplied filename. Local file inclusion may expose protected files or interpret unexpected content. It does not establish the present requirement, where a test URL targeting a prohibited internal endpoint is rejected. The relevant evidence is: A test URL targeting a prohibited internal endpoint is rejected.