Exam Bundle

It would address an architect needs to categorize a forged authenticated principal in a design diagram. The relevant reason in that case is: Spoofing concerns impersonating an identity or authentication claim. Here the required success condition is the proposal identifies applicable CREST requirements without claiming certification improperly. The appropriate action is: Assess CREST-aligned practices and applicable personnel or company requirements.

That approach concerns a different situation: an industrial plant needs a diagram of enterprise, supervisory, and process-control zones. Purdue levels organize industrial control network functions and boundaries. The required result is that the proposal identifies applicable CREST requirements without claiming certification improperly. The appropriate action is: Assess CREST-aligned practices and applicable personnel or company requirements.

That relates to a different issue: A threat model asks which category covers an attacker changing stored invoice values. STRIDE describes six threat classes, including unauthorized modification. That is not a direct remedy for the requested outcome: The proposal identifies applicable CREST requirements without claiming certification improperly. The appropriate action is: Assess CREST-aligned practices and applicable personnel or company requirements.

That relates to a different issue: A web scan reports no injection defects but excluded every authenticated API route. A negative result applies only to the surfaces actually tested. That is not a direct remedy for the requested outcome: The report shows newly introduced, persistent, and remediated findings. The appropriate action is: Store consistent asset IDs and dated scan snapshots for differential analysis.

It would address a scanner's authenticated credential was disabled during the test with no alert in the output summary. The relevant reason in that case is: Credentials can silently fail and create false negative coverage. Here the required success condition is the report shows newly introduced, persistent, and remediated findings. The appropriate action is: Store consistent asset IDs and dated scan snapshots for differential analysis.

This action applies to a different case: An analyst sees a high CVSS issue on an isolated lab host and a lower-scored actively exploited issue on a public gateway. CVSS alone omits environmental and current threat context. It does not establish the present requirement, where the report shows newly introduced, persistent, and remediated findings. The appropriate action is: Store consistent asset IDs and dated scan snapshots for differential analysis.

That approach concerns a different situation: an IoT controller is sensitive to unexpected network packets during a vulnerability assessment. Industrial and embedded systems can fail under ordinary IT scan traffic. The required result is that the finding identifies the role, permission scope, and owner. The relevant evidence is: The finding identifies the role, permission scope, and owner.

That relates to a different issue: A custom application service cannot be instrumented for IAST due to platform restrictions. Testing technique choice must fit runtime access and instrumentation limits. That is not a direct remedy for the requested outcome: The finding identifies the role, permission scope, and owner. The relevant evidence is: The finding identifies the role, permission scope, and owner.

This result applies to a different case: A CI pipeline contains an image registry scanner but scans only a mutable latest tag. Mutable tags can change between scan and deployment, invalidating evidence. It does not establish the present requirement, where the finding identifies the role, permission scope, and owner. The relevant evidence is: The finding identifies the role, permission scope, and owner.

That approach concerns a different situation: a service accepts a filename that resolves through a symlink to a protected system path. Text-based path checks can be bypassed by filesystem indirection. The required result is that synthetic known and unknown accounts receive comparable public responses. The relevant evidence is: Synthetic known and unknown accounts receive comparable public responses.

That relates to a different issue: A web gateway trusts an unsigned JWT claim that a user is an administrator. Untrusted token content must never grant privileged API access. That is not a direct remedy for the requested outcome: Synthetic known and unknown accounts receive comparable public responses. The relevant evidence is: Synthetic known and unknown accounts receive comparable public responses.

It would address a search endpoint concatenates raw query text into SQL statements. The relevant reason in that case is: Data must not be interpreted as SQL syntax during query construction. Here the required success condition is synthetic known and unknown accounts receive comparable public responses. The relevant evidence is: Synthetic known and unknown accounts receive comparable public responses.

It would address a wireless security review notes that unauthenticated traffic can trigger large retransmission storms. The relevant reason in that case is: Radio protocol abuse can affect availability without credential compromise. Here the required success condition is the evidence notes frame anomalies without active fuzzing on production equipment. The appropriate action is: Use passive packet analysis to identify possible protocol fuzzing indicators.

This action applies to a different case: An assessor needs the operating channel and encryption mode of approved access points. Beacon frames can reveal radio parameters without association. It does not establish the present requirement, where the evidence notes frame anomalies without active fuzzing on production equipment. The appropriate action is: Use passive packet analysis to identify possible protocol fuzzing indicators.

That approach concerns a different situation: a tester wants to map an organization's access points while driving around neighboring offices. Radio proximity does not establish permission for active testing. The required result is that the evidence notes frame anomalies without active fuzzing on production equipment. The appropriate action is: Use passive packet analysis to identify possible protocol fuzzing indicators.

That relates to a different issue: A Windows host maps a cloud-backed virtual drive through an unauthorized sync client. Mapped storage can move data outside conventional removable drives. That is not a direct remedy for the requested outcome: The test records show exactly the permitted data volume. The relevant evidence is: The test records show exactly the permitted data volume.

This result applies to a different case: A compromised process uses a covert channel but the defender has only firewall allow/deny logs. Allowed protocols may still carry anomalous information. It does not establish the present requirement, where the test records show exactly the permitted data volume. The relevant evidence is: The test records show exactly the permitted data volume.

That approach concerns a different situation: a penetration tester wants to prove data exfiltration but the contract forbids copying personal information. Exfiltration tests should avoid moving real sensitive client content. The required result is that the test records show exactly the permitted data volume. The relevant evidence is: The test records show exactly the permitted data volume.

That approach concerns a different situation: a limited-scope assessment needs the list of responding ports without overwhelming a fragile legacy gateway. Discovery intensity must reflect operational constraints and written permission. The required result is that the scan record reflects closed states for the observed resets. The relevant evidence is: The scan record reflects closed states for the observed resets.

It would address a service exposes multiple ports associated with different application protocols. The relevant reason in that case is: Nonstandard port assignments are common and port numbers are only initial clues. Here the required success condition is the scan record reflects closed states for the observed resets. The relevant evidence is: The scan record reflects closed states for the observed resets.

This result applies to a different case: A tester wants to infer whether an address is active while ICMP echo replies are blocked. Firewalls can suppress ping despite active TCP listeners. It does not establish the present requirement, where the scan record reflects closed states for the observed resets. The relevant evidence is: The scan record reflects closed states for the observed resets.

That approach concerns a different situation: a client asks testers to discover public subdomains without sending packets to the client's servers. Certificate issuance logs expose hostnames passively but do not prove current ownership. The required result is that the PTR result is explicitly treated as a candidate until validated by the owner. The relevant evidence is: The PTR result is explicitly treated as a candidate until validated by the owner.

That relates to a different issue: A client wants the passive discovery of hosts from public certificate names and DNS records. Multiple passive sources reduce the chance of relying on a stale artifact. That is not a direct remedy for the requested outcome: The PTR result is explicitly treated as a candidate until validated by the owner. The relevant evidence is: The PTR result is explicitly treated as a candidate until validated by the owner.

It would address a security team asks whether public profile data exposes names and organizational roles of privileged employees. The relevant reason in that case is: Public role disclosures can inform social-engineering exposure without active contact. Here the required success condition is the PTR result is explicitly treated as a candidate until validated by the owner. The relevant evidence is: The PTR result is explicitly treated as a candidate until validated by the owner.

This action applies to a different case: An assessor created a temporary directory account to validate scoped identity permissions. Tester-created identities can become lingering access paths. It does not establish the present requirement, where the old test password and tokens no longer authenticate. The appropriate action is: Reset credentials and invalidate surviving sessions under owner supervision.

That approach concerns a different situation: a test team performed controlled changes to a lab Kubernetes role assignment. Temporary elevated cluster roles can outlive the exercise. The required result is that the old test password and tokens no longer authenticate. The appropriate action is: Reset credentials and invalidate surviving sessions under owner supervision.

That relates to a different issue: An assessment delivered a security finding while the last test proxy still listens on a public address. Temporary test infrastructure can itself become an internet exposure. That is not a direct remedy for the requested outcome: The old test password and tokens no longer authenticate. The appropriate action is: Reset credentials and invalidate surviving sessions under owner supervision.

That relates to a different issue: A firewall sends TCP RST responses to selected ports during discovery. TCP resets distinguish a rejected connection from a no-response condition. That is not a direct remedy for the requested outcome: New service candidates are reported with source and destination metadata. The appropriate action is: Compare expected protocol destinations with observed TCP and UDP conversations.

It would address a UDP application is suspected, but no response appears to a generic UDP probe. The relevant reason in that case is: UDP scanning often lacks reliable positive replies without an application response. Here the required success condition is new service candidates are reported with source and destination metadata. The appropriate action is: Compare expected protocol destinations with observed TCP and UDP conversations.

That approach concerns a different situation: a customer wants evidence that a network capture could expose plaintext application credentials. Plaintext transport makes credential material observable to network participants. The required result is that new service candidates are reported with source and destination metadata. The appropriate action is: Compare expected protocol destinations with observed TCP and UDP conversations.

That relates to a different issue: A data center relies on a turnstile that permits multiple people to pass behind one badge. One-factor door systems may fail to enforce one-person admission. That is not a direct remedy for the requested outcome: A safe observation confirms whether identity verification occurs for all entrants. The relevant evidence is: A safe observation confirms whether identity verification occurs for all entrants.

It would address a visitor uses an authorized staff member's badge replica in a test access system. The relevant reason in that case is: Copied credentials can bypass physical identity checks if unprotected. Here the required success condition is a safe observation confirms whether identity verification occurs for all entrants. The relevant evidence is: A safe observation confirms whether identity verification occurs for all entrants.

This result applies to a different case: A client wants to determine whether an employee can remotely open a door with another person's proximity badge. Authentication properties must be demonstrated without using actual employee identifiers. It does not establish the present requirement, where a safe observation confirms whether identity verification occurs for all entrants. The relevant evidence is: A safe observation confirms whether identity verification occurs for all entrants.