Exam Bundle

That approach concerns a different situation: a client wants to evaluate an old Telnet management interface without reading passwords. Telnet lacks built-in encrypted session protection. The required result is that a safe connectivity test confirms the unintended path is blocked. The relevant evidence is: A safe connectivity test confirms the unintended path is blocked.

That relates to a different issue: A lab server accepts SMB authentication relayed from another service without enforcing signing. Unsigned authentication flows can be replayed or relayed across trust boundaries. That is not a direct remedy for the requested outcome: A safe connectivity test confirms the unintended path is blocked. The relevant evidence is: A safe connectivity test confirms the unintended path is blocked.

It would address a tester is considering a public Metasploit module that attempts service disruption. The relevant reason in that case is: An available exploit module is not inherently appropriate for production testing. Here the required success condition is a safe connectivity test confirms the unintended path is blocked. The relevant evidence is: A safe connectivity test confirms the unintended path is blocked.

This result applies to a different case: An assessor attempts to correlate a domain's A, AAAA, and CNAME records before testing. DNS aliases and address families can point to differently owned endpoints. It does not establish the present requirement, where a follow-up safe connection confirms the exposed service. The relevant evidence is: A follow-up safe connection confirms the exposed service.

That approach concerns a different situation: a service exposes multiple ports associated with different application protocols. Nonstandard port assignments are common and port numbers are only initial clues. The required result is that a follow-up safe connection confirms the exposed service. The relevant evidence is: A follow-up safe connection confirms the exposed service.

That relates to a different issue: A limited-scope assessment needs the list of responding ports without overwhelming a fragile legacy gateway. Discovery intensity must reflect operational constraints and written permission. That is not a direct remedy for the requested outcome: A follow-up safe connection confirms the exposed service. The relevant evidence is: A follow-up safe connection confirms the exposed service.

It would address a security team wants to evaluate whether staff report suspicious phone calls instead of obeying them. The relevant reason in that case is: Social testing measures human response while protecting staff privacy and safety. Here the required success condition is a browser protection test blocks the laboratory redirection safely. The relevant evidence is: A browser protection test blocks the laboratory redirection safely.

This result applies to a different case: A telephone caller impersonates a helpdesk employee and demands a one-time authentication code. Voice pretexts can solicit secrets or bypass verification procedures. It does not establish the present requirement, where a browser protection test blocks the laboratory redirection safely. The relevant evidence is: A browser protection test blocks the laboratory redirection safely.

That approach concerns a different situation: a social engineer watches a staff member type a badge PIN from behind. Visual observation can disclose authentication secrets without network contact. The required result is that a browser protection test blocks the laboratory redirection safely. The relevant evidence is: A browser protection test blocks the laboratory redirection safely.

That relates to a different issue: A staff member encounters an unknown visitor attempting to enter a restricted work area. Policies require actual procedural enforcement, not only badge hardware. That is not a direct remedy for the requested outcome: The review identifies a legitimate maintenance event or escalates suspicious access. The relevant evidence is: The review identifies a legitimate maintenance event or escalates suspicious access.

It would address a reception area has cameras covering exits but not the badge reader at the server room. The relevant reason in that case is: Physical monitoring coverage determines visibility into unauthorized access. Here the required success condition is the review identifies a legitimate maintenance event or escalates suspicious access. The relevant evidence is: The review identifies a legitimate maintenance event or escalates suspicious access.

This result applies to a different case: A visitor uses an authorized staff member's badge replica in a test access system. Copied credentials can bypass physical identity checks if unprotected. It does not establish the present requirement, where the review identifies a legitimate maintenance event or escalates suspicious access. The relevant evidence is: The review identifies a legitimate maintenance event or escalates suspicious access.

That approach concerns a different situation: a tester needs an ownership hint for a domain's registration and delegated name servers. Registration metadata may identify contacts and service providers. The required result is that listed assets are separated into confirmed versus unconfirmed ownership. The appropriate action is: Use Shodan as an initial exposure lead and verify with owner inventory.

That relates to a different issue: A client requests exploration of public DNS records including delegated subdomain records. DNS intelligence services help build candidate domain inventories. That is not a direct remedy for the requested outcome: Listed assets are separated into confirmed versus unconfirmed ownership. The appropriate action is: Use Shodan as an initial exposure lead and verify with owner inventory.

This action applies to a different case: An assessor wants to enumerate external records but cannot use a product requiring active client network contact. Tool mode is more important than product name for scope compliance. It does not establish the present requirement, where listed assets are separated into confirmed versus unconfirmed ownership. The appropriate action is: Use Shodan as an initial exposure lead and verify with owner inventory.

This result applies to a different case: A client wants the passive discovery of hosts from public certificate names and DNS records. Multiple passive sources reduce the chance of relying on a stale artifact. It does not establish the present requirement, where only positively confirmed customer assets progress to active reconnaissance. The relevant evidence is: Only positively confirmed customer assets progress to active reconnaissance.

That approach concerns a different situation: an organization wants publicly exposed SSL certificate history for a retired hostname. Certificates can reveal previously registered names and issuance chronology. The required result is that only positively confirmed customer assets progress to active reconnaissance. The relevant evidence is: Only positively confirmed customer assets progress to active reconnaissance.

That relates to a different issue: A company cannot explain why an old DNS mail exchanger still appears in public records. Current DNS answers identify public mail routing independently of internal diagrams. That is not a direct remedy for the requested outcome: Only positively confirmed customer assets progress to active reconnaissance. The relevant evidence is: Only positively confirmed customer assets progress to active reconnaissance.

It would address a test employee connects to a public-looking access point that offers the corporate SSID with a different certificate. The relevant reason in that case is: Enterprise Wi-Fi trust should bind authentication to known infrastructure. Here the required success condition is the final map includes only approved organizational access points. The appropriate action is: Limit wardriving observations to permitted public signals and exclude unrelated radios.

That approach concerns a different situation: a corporate access point sends users to a captive portal that allows arbitrary external form pages. Captive portals can be impersonated to harvest user credentials. The required result is that the final map includes only approved organizational access points. The appropriate action is: Limit wardriving observations to permitted public signals and exclude unrelated radios.

That relates to a different issue: A company finds a rogue access point advertising the same SSID as its legitimate Wi-Fi. Impersonated wireless infrastructure can redirect or harvest client connections. That is not a direct remedy for the requested outcome: The final map includes only approved organizational access points. The appropriate action is: Limit wardriving observations to permitted public signals and exclude unrelated radios.

It would address a production application uses a library with an outdated version, but the build is opaque. The relevant reason in that case is: A reliable component inventory is needed before asserting specific package risk. Here the required success condition is the audit lists the actual techniques applied and residual visibility gaps. The relevant evidence is: The audit lists the actual techniques applied and residual visibility gaps.

This result applies to a different case: A team wants to identify weak settings on a test container but cannot inspect its internals. Container vulnerability analysis depends on the specific image and runtime conditions. It does not establish the present requirement, where the audit lists the actual techniques applied and residual visibility gaps. The relevant evidence is: The audit lists the actual techniques applied and residual visibility gaps.

That approach concerns a different situation: an IoT controller is sensitive to unexpected network packets during a vulnerability assessment. Industrial and embedded systems can fail under ordinary IT scan traffic. The required result is that the audit lists the actual techniques applied and residual visibility gaps. The relevant evidence is: The audit lists the actual techniques applied and residual visibility gaps.

That approach concerns a different situation: a shared workstation allows users to write into a privileged application's plugin folder. Writable extension paths create opportunities for untrusted code under elevated context. The required result is that a lab timeline attributes the service to an approved operator identity. The relevant evidence is: A lab timeline attributes the service to an approved operator identity.

That relates to a different issue: A Windows application runs from a writable directory but claims its installer is signed. Signed installers do not guarantee continued integrity after deployment. That is not a direct remedy for the requested outcome: A lab timeline attributes the service to an approved operator identity. The relevant evidence is: A lab timeline attributes the service to an approved operator identity.

This result applies to a different case: A Linux server grants passwordless sudo for a broad interpreter rather than one intended task. Broad interpreter rights can approximate unrestricted root access. It does not establish the present requirement, where a lab timeline attributes the service to an approved operator identity. The relevant evidence is: A lab timeline attributes the service to an approved operator identity.

This result applies to a different case: A testing team finds a public storage share containing unencrypted customer exports. Access control and cryptography address separate disclosure paths. It does not establish the present requirement, where the old key fails and the application retrieves an approved secret securely. The relevant evidence is: The old key fails and the application retrieves an approved secret securely.

That approach concerns a different situation: an exposed web server accepts deprecated TLS algorithms. Modern cryptographic configuration reduces downgrade and interception risk. The required result is that the old key fails and the application retrieves an approved secret securely. The relevant evidence is: The old key fails and the application retrieves an approved secret securely.

It would address a customer has stale machine account certificates with expired owners. The relevant reason in that case is: Key and certificate hygiene prevents service interruption and untrusted identity reuse. Here the required success condition is the old key fails and the application retrieves an approved secret securely. The relevant evidence is: The old key fails and the application retrieves an approved secret securely.

It would address a test team wants to assess whether confidential files could be moved to personal web text storage. The relevant reason in that case is: Public paste sites may provide an outbound data path not intended for business use. Here the required success condition is a simulated restricted attachment is blocked and produces a logged alert. The relevant evidence is: A simulated restricted attachment is blocked and produces a logged alert.

This result applies to a different case: An application sends staged content through an unapproved HTTPS endpoint but network controls permit all egress. Confidentiality of transit does not establish transfer authorization. It does not establish the present requirement, where a simulated restricted attachment is blocked and produces a logged alert. The relevant evidence is: A simulated restricted attachment is blocked and produces a logged alert.

That approach concerns a different situation: an authorized lab needs to test data staging without triggering production record changes. Controlled artifacts allow measurement of transfer behavior without real data exposure. The required result is that a simulated restricted attachment is blocked and produces a logged alert. The relevant evidence is: A simulated restricted attachment is blocked and produces a logged alert.