Exam Bundle

That approach concerns a different situation: a service accepts a filename that resolves through a symlink to a protected system path. Text-based path checks can be bypassed by filesystem indirection. The required result is that a test URL targeting a prohibited internal endpoint is rejected. The relevant evidence is: A test URL targeting a prohibited internal endpoint is rejected.

It would address a report generator uses user input inside its server-side template expression parser. The relevant reason in that case is: Template engines may execute operators or expose objects when input is treated as syntax. Here the required success condition is a test URL targeting a prohibited internal endpoint is rejected. The relevant evidence is: A test URL targeting a prohibited internal endpoint is rejected.

This result applies to a different case: A web handler includes a local log file by user-supplied filename. Local file inclusion may expose protected files or interpret unexpected content. It does not establish the present requirement, where a test URL targeting a prohibited internal endpoint is rejected. The relevant evidence is: A test URL targeting a prohibited internal endpoint is rejected.

That approach concerns a different situation: a relying party accepts OpenID Connect identity tokens with a mismatched audience. An identity token intended for one client should not authenticate another. The required result is that an authorized review shows strong rotation and reduced standing access. The relevant evidence is: An authorized review shows strong rotation and reduced standing access.

That relates to a different issue: A client's lab shows a service accepts authentication using an old expired ticket. Kerberos security depends on correctly enforced validity intervals. That is not a direct remedy for the requested outcome: An authorized review shows strong rotation and reduced standing access. The relevant evidence is: An authorized review shows strong rotation and reduced standing access.

It would address a web application's LDAP filter directly concatenates a username field. The relevant reason in that case is: Unescaped filter meta-characters can alter directory query meaning. Here the required success condition is an authorized review shows strong rotation and reduced standing access. The relevant evidence is: An authorized review shows strong rotation and reduced standing access.

It would address a network weakness requires two earlier access conditions that are not present in the scoped lab. The relevant reason in that case is: An attack chain is limited by its unmet prerequisite steps. Here the required success condition is the prioritized target list identifies payment data and associated owners. The relevant evidence is: The prioritized target list identifies payment data and associated owners.

This result applies to a different case: A cloud service is misconfigured but the contract forbids modification of production access policies. Exploitation must respect both target scope and permitted change types. It does not establish the present requirement, where the prioritized target list identifies payment data and associated owners. The relevant evidence is: The prioritized target list identifies payment data and associated owners.

That approach concerns a different situation: a vulnerable host has multiple defensive sensors but the tester wants to use a payload likely to trip emergency shutdown. Defensive capabilities and production impacts shape permitted validation methods. The required result is that the prioritized target list identifies payment data and associated owners. The relevant evidence is: The prioritized target list identifies payment data and associated owners.

That relates to a different issue: A password audit uses fixed character positions with variable numeric suffixes on synthetic hashes. Mask attacks constrain guesses by a specified character pattern. That is not a direct remedy for the requested outcome: The login telemetry records repeated guesses against one test account. The appropriate action is: Classify the behavior as a targeted brute-force attempt.

It would address an approved lab shows NTLM network authentication may be accepted without a plaintext password. The relevant reason in that case is: Reusable password-derived authentication material can be abused in some NTLM flows. Here the required success condition is the login telemetry records repeated guesses against one test account. The appropriate action is: Classify the behavior as a targeted brute-force attempt.

This action applies to a different case: A password audit tests a curated wordlist against approved offline synthetic hashes. Dictionary attacks try likely words instead of exhaustive permutations. It does not establish the present requirement, where the login telemetry records repeated guesses against one test account. The appropriate action is: Classify the behavior as a targeted brute-force attempt.

That relates to a different issue: A theme installer accepts an external URL that is included into server-side code execution. Server execution should not import untrusted remote code. That is not a direct remedy for the requested outcome: An unapproved external redirect is blocked. The relevant evidence is: An unapproved external redirect is blocked.

It would address a web scanner claims SQL injection because a quote produces an HTTP 500 response. The relevant reason in that case is: Generic server errors do not prove attacker-controlled SQL execution. Here the required success condition is an unapproved external redirect is blocked. The relevant evidence is: An unapproved external redirect is blocked.

This result applies to a different case: A picture import URL is fetched by a server with access to internal service endpoints. User-supplied destinations can redirect server trust to internal resources. It does not establish the present requirement, where an unapproved external redirect is blocked. The relevant evidence is: An unapproved external redirect is blocked.

This result applies to a different case: An authorized tester is invited to inspect an adjacent subsidiary that is absent from the signed contract. Corporate affiliation does not automatically extend scoped legal permission. It does not establish the present requirement, where the engagement's permission matrix includes the partner-managed wireless assets. The relevant evidence is: The engagement's permission matrix includes the partner-managed wireless assets.

That approach concerns a different situation: a client lists 10.40.0.0/24 as the only authorized internal range, but an asset resolves to 10.41.0.8. A resolved IP outside the signed CIDR range is not automatically included. The required result is that the engagement's permission matrix includes the partner-managed wireless assets. The relevant evidence is: The engagement's permission matrix includes the partner-managed wireless assets.

It would address a requester claims to own a customer-facing app but cannot prove authority to authorize testing. The relevant reason in that case is: A verbal request from an unverified party is insufficient legal approval. Here the required success condition is the engagement's permission matrix includes the partner-managed wireless assets. The relevant evidence is: The engagement's permission matrix includes the partner-managed wireless assets.

It would address a compromised community website frequently used by a particular department redirects users to unsafe content. The relevant reason in that case is: Trusted browsing habits can expose targeted groups to hostile sites. Here the required success condition is the assessment contains no unapproved disposal-site collection. The appropriate action is: Stop and request new explicit physical test authorization.

This action applies to a different case: A client wants a social-engineering platform to deliver simulated emails at low volume. Dedicated tools can manage controlled phishing simulation and reporting. It does not establish the present requirement, where the assessment contains no unapproved disposal-site collection. The appropriate action is: Stop and request new explicit physical test authorization.

That approach concerns a different situation: a telephone caller impersonates a helpdesk employee and demands a one-time authentication code. Voice pretexts can solicit secrets or bypass verification procedures. The required result is that the assessment contains no unapproved disposal-site collection. The appropriate action is: Stop and request new explicit physical test authorization.

That relates to a different issue: A tester uses ADB to inspect a test Android device but production phones are excluded. Mobile debugging bridges can expose privileged device state if misused. That is not a direct remedy for the requested outcome: The app operates without contacts permission. The appropriate action is: Report overbroad mobile permission requests and implement least privilege.

This action applies to a different case: A factory PLC accepts unauthenticated writes to process registers on a lab Modbus network. Legacy industrial protocols may not enforce message authorization. It does not establish the present requirement, where the app operates without contacts permission. The appropriate action is: Report overbroad mobile permission requests and implement least privilege.

That approach concerns a different situation: an AI assistant retrieves an untrusted web page that contains instructions to send private documents. Untrusted source data must not gain authority over tool operations. The required result is that the app operates without contacts permission. The appropriate action is: Report overbroad mobile permission requests and implement least privilege.

That relates to a different issue: An assessor wants to use credential spraying although the signed rules prohibit account lockouts. Potential lockouts violate explicit testing restrictions without changed authorization. That is not a direct remedy for the requested outcome: Active scanner timestamps fall inside the signed testing window. The relevant evidence is: Active scanner timestamps fall inside the signed testing window.

It would address a production database crashes after low-rate probes during an authorized assessment. The relevant reason in that case is: Availability risk triggers the agreed stop condition even during permitted work. Here the required success condition is active scanner timestamps fall inside the signed testing window. The relevant evidence is: Active scanner timestamps fall inside the signed testing window.

This result applies to a different case: A rules-of-engagement document allows web requests but explicitly forbids denial-of-service tests. A permitted web scope does not imply authorization for availability attacks. It does not establish the present requirement, where active scanner timestamps fall inside the signed testing window. The relevant evidence is: Active scanner timestamps fall inside the signed testing window.

This action applies to a different case: A public artifact repository accepts uploads under a shared build identity with no review process. Unsigned or unauthorized artifacts can contaminate downstream releases. It does not establish the present requirement, where an unsafe test manifest fails admission while the hardened workload starts. The appropriate action is: Remove privileged flags and host mounts, enforcing pod security controls.

That approach concerns a different situation: a web server can reach instance metadata with broad credentials accessible to its application identity. Metadata-derived temporary credentials may confer excessive cloud authority. The required result is that an unsafe test manifest fails admission while the hardened workload starts. The appropriate action is: Remove privileged flags and host mounts, enforcing pod security controls.

It would address a serverless function's environment variables contain long-lived database passwords. The relevant reason in that case is: Serverless deployment does not make plaintext configuration secrets safe. Here the required success condition is an unsafe test manifest fails admission while the hardened workload starts. The appropriate action is: Remove privileged flags and host mounts, enforcing pod security controls.

It would address a security engineer suspects steganography in images uploaded to an external content site. The relevant reason in that case is: Hidden payloads may exist within apparently benign media files. Here the required success condition is transferred test content matches the approved hash and byte limit. The appropriate action is: Create a synthetic artifact repository with fixed size and integrity hashes.

This action applies to a different case: A test team wants to assess whether confidential files could be moved to personal web text storage. Public paste sites may provide an outbound data path not intended for business use. It does not establish the present requirement, where transferred test content matches the approved hash and byte limit. The appropriate action is: Create a synthetic artifact repository with fixed size and integrity hashes.

That approach concerns a different situation: a penetration tester wants to prove data exfiltration but the contract forbids copying personal information. Exfiltration tests should avoid moving real sensitive client content. The required result is that transferred test content matches the approved hash and byte limit. The appropriate action is: Create a synthetic artifact repository with fixed size and integrity hashes.