Exam Bundle

That approach concerns a different situation: a cloud provider permits vulnerability scanning only under defined acceptable-use conditions. A customer's permission cannot override a hosting provider's contractual constraints. The required result is that counsel confirms the MSA governs the recurring testing relationship. The relevant evidence is: Counsel confirms the MSA governs the recurring testing relationship.

That relates to a different issue: Two companies need confidentiality protection before testers receive internal network diagrams. An NDA governs handling of confidential information prior to technical access. That is not a direct remedy for the requested outcome: Counsel confirms the MSA governs the recurring testing relationship. The relevant evidence is: Counsel confirms the MSA governs the recurring testing relationship.

This result applies to a different case: A client and supplier agree on ongoing terms, but the current test's exact hosts and dates are unrecorded. The statement of work defines this particular engagement's operational boundaries. It does not establish the present requirement, where counsel confirms the MSA governs the recurring testing relationship. The relevant evidence is: Counsel confirms the MSA governs the recurring testing relationship.

This action applies to a different case: A Trojan-labeled binary claims to be a legitimate installer but performs unauthorized background operations. A Trojan conceals unwanted activity behind an apparently useful program. It does not establish the present requirement, where removal of the test task prevents the process from restarting. The appropriate action is: Classify the behavior as scheduled-task persistence and inspect authorized task metadata.

That approach concerns a different situation: a lab host has a process listening locally for remote command connections. Bind shells expose a local listening endpoint. The required result is that removal of the test task prevents the process from restarting. The appropriate action is: Classify the behavior as scheduled-task persistence and inspect authorized task metadata.

That relates to a different issue: A C2 simulation in a sandbox uses periodic HTTP check-ins from an agent. Periodic callbacks can sustain remote tasking between interactions. That is not a direct remedy for the requested outcome: Removal of the test task prevents the process from restarting. The appropriate action is: Classify the behavior as scheduled-task persistence and inspect authorized task metadata.

It would address a security pipeline may contain private API tokens in committed history. The relevant reason in that case is: Secret detection should avoid creating new exposure in logs. Here the required success condition is the report states which routes were blocked and not verified. The appropriate action is: Document filtering limitations and use approved app-level or code review evidence.

This action applies to a different case: An IoT controller is sensitive to unexpected network packets during a vulnerability assessment. Industrial and embedded systems can fail under ordinary IT scan traffic. It does not establish the present requirement, where the report states which routes were blocked and not verified. The appropriate action is: Document filtering limitations and use approved app-level or code review evidence.

That approach concerns a different situation: a mobile app's locally stored credentials may be exposed in its compiled bundle. Mobile packages can contain hard-coded material that is not visible in server scans. The required result is that the report states which routes were blocked and not verified. The appropriate action is: Document filtering limitations and use approved app-level or code review evidence.

That relates to a different issue: A user-controlled account ID in a billing API returns another synthetic customer's invoice. Guessing or changing object identifiers must not bypass ownership enforcement. That is not a direct remedy for the requested outcome: A synthetic client exceeds its quota and receives a controlled rate-limit response. The relevant evidence is: A synthetic client exceeds its quota and receives a controlled rate-limit response.

It would address a website allows a cross-site form to change an authenticated user's email without an anti-CSRF check. The relevant reason in that case is: An authenticated browser can carry session cookies for unintended state-changing requests. Here the required success condition is a synthetic client exceeds its quota and receives a controlled rate-limit response. The relevant evidence is: A synthetic client exceeds its quota and receives a controlled rate-limit response.

That approach concerns a different situation: an OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. The required result is that a synthetic client exceeds its quota and receives a controlled rate-limit response. The relevant evidence is: A synthetic client exceeds its quota and receives a controlled rate-limit response.

That approach concerns a different situation: a cloud project has a cross-account role trust that permits principals outside the expected partner organization. Cross-account trust can expand reach beyond intended organizational boundaries. The required result is that a modified unsigned test image is rejected. The relevant evidence is: A modified unsigned test image is rejected.

It would address a cloud service exposes an administrative dashboard on a public endpoint despite an internal-only design. The relevant reason in that case is: Cloud service public access settings can override intended network trust boundaries. Here the required success condition is a modified unsigned test image is rejected. The relevant evidence is: A modified unsigned test image is rejected.

This result applies to a different case: A cloud VM snapshot is shared with another account unintentionally. Data snapshots can disclose sensitive disk content outside running systems. It does not establish the present requirement, where a modified unsigned test image is rejected. The relevant evidence is: A modified unsigned test image is rejected.

That approach concerns a different situation: a host exposes a remote printing service on a restricted subnet and testers want to enumerate it. Print services may bridge operating-system privileges and network segments. The required result is that a synthetic unrelated account cannot write to the share. The relevant evidence is: A synthetic unrelated account cannot write to the share.

That relates to a different issue: An approved lab account accesses a second Windows host using a remote service management channel. Valid credentials and remote management can bridge compromised systems. That is not a direct remedy for the requested outcome: A synthetic unrelated account cannot write to the share. The relevant evidence is: A synthetic unrelated account cannot write to the share.

It would address a network policy allows RDP from every employee laptop into a protected application server. The relevant reason in that case is: Broad RDP exposure can facilitate cross-host movement. Here the required success condition is a synthetic unrelated account cannot write to the share. The relevant evidence is: A synthetic unrelated account cannot write to the share.

It would address a container build reveals a secret-like value in a public manifest but production service accounts are out of scope. The relevant reason in that case is: Found credentials do not authorize use beyond signed targets. Here the required success condition is the report records observed version evidence or uncertainty. The relevant evidence is: The report records observed version evidence or uncertainty.

That approach concerns a different situation: a cloud endpoint returns a metadata document with instance identifiers visible only from inside the instance. Instance metadata normally has context-specific network access boundaries. The required result is that the report records observed version evidence or uncertainty. The relevant evidence is: The report records observed version evidence or uncertainty.

That relates to a different issue: An assessment needs an inventory of publicly accessible cloud buckets under the customer's account. Cloud access posture must be confirmed at both resource and data-plane levels. That is not a direct remedy for the requested outcome: The report records observed version evidence or uncertainty. The relevant evidence is: The report records observed version evidence or uncertainty.

That relates to a different issue: A company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. Service-disruption methods require explicit risk and impact authorization. That is not a direct remedy for the requested outcome: The report explains the observed risk without causing a production outage. The relevant evidence is: The report explains the observed risk without causing a production outage.

It would address a lab capture suggests a client can be redirected to an attacker-controlled proxy by wireless discovery settings. The relevant reason in that case is: Proxy auto-discovery can create traffic interception opportunities. Here the required success condition is the report explains the observed risk without causing a production outage. The relevant evidence is: The report explains the observed risk without causing a production outage.

This result applies to a different case: A wireless router is configured for obsolete open authentication on an employee network. Unauthenticated radio access exposes business network traffic and services. It does not establish the present requirement, where the report explains the observed risk without causing a production outage. The relevant evidence is: The report explains the observed risk without causing a production outage.

That relates to a different issue: A team plans to use Scapy to craft arbitrary network packets on a sensitive industrial segment. Packet crafting can bypass normal protocol safeguards and destabilize fragile systems. That is not a direct remedy for the requested outcome: The resulting alerts occur only in the authorized test environment. The relevant evidence is: The resulting alerts occur only in the authorized test environment.

It would address a Bash assessment script prints every environment variable while troubleshooting. The relevant reason in that case is: Script output can leak sensitive keys into persistent records. Here the required success condition is the resulting alerts occur only in the authorized test environment. The relevant evidence is: The resulting alerts occur only in the authorized test environment.

This result applies to a different case: A tester wants to use PowerShell functions for recurring approved AD inventory steps. Reusable scripted functions improve repeatability and limit accidental actions. It does not establish the present requirement, where the resulting alerts occur only in the authorized test environment. The relevant evidence is: The resulting alerts occur only in the authorized test environment.

This action applies to a different case: An exercise used a dedicated cloud API key that remains active after delivery. Leaving tester credentials active creates unnecessary future access. It does not establish the present requirement, where authoritative DNS and permitted resolvers report the pre-test value. The appropriate action is: Restore original DNS and confirm resolver propagation.

That relates to a different issue: An assessment delivered a security finding while the last test proxy still listens on a public address. Temporary test infrastructure can itself become an internet exposure. That is not a direct remedy for the requested outcome: Authoritative DNS and permitted resolvers report the pre-test value. The appropriate action is: Restore original DNS and confirm resolver propagation.

It would address a tester copied a synthetic data set to a controlled staging container. The relevant reason in that case is: Even synthetic test data should follow documented lifecycle cleanup. Here the required success condition is authoritative DNS and permitted resolvers report the pre-test value. The appropriate action is: Restore original DNS and confirm resolver propagation.

It would address an architect needs to categorize a forged authenticated principal in a design diagram. The relevant reason in that case is: Spoofing concerns impersonating an identity or authentication claim. Here the required success condition is the proposal identifies applicable CREST requirements without claiming certification improperly. The appropriate action is: Assess CREST-aligned practices and applicable personnel or company requirements.

That approach concerns a different situation: an industrial plant needs a diagram of enterprise, supervisory, and process-control zones. Purdue levels organize industrial control network functions and boundaries. The required result is that the proposal identifies applicable CREST requirements without claiming certification improperly. The appropriate action is: Assess CREST-aligned practices and applicable personnel or company requirements.

That relates to a different issue: A threat model asks which category covers an attacker changing stored invoice values. STRIDE describes six threat classes, including unauthorized modification. That is not a direct remedy for the requested outcome: The proposal identifies applicable CREST requirements without claiming certification improperly. The appropriate action is: Assess CREST-aligned practices and applicable personnel or company requirements.