Exam Bundle

That relates to a different issue: A data center relies on a turnstile that permits multiple people to pass behind one badge. One-factor door systems may fail to enforce one-person admission. That is not a direct remedy for the requested outcome: A safe observation confirms whether identity verification occurs for all entrants. The relevant evidence is: A safe observation confirms whether identity verification occurs for all entrants.

It would address a visitor uses an authorized staff member's badge replica in a test access system. The relevant reason in that case is: Copied credentials can bypass physical identity checks if unprotected. Here the required success condition is a safe observation confirms whether identity verification occurs for all entrants. The relevant evidence is: A safe observation confirms whether identity verification occurs for all entrants.

This result applies to a different case: A client wants to determine whether an employee can remotely open a door with another person's proximity badge. Authentication properties must be demonstrated without using actual employee identifiers. It does not establish the present requirement, where a safe observation confirms whether identity verification occurs for all entrants. The relevant evidence is: A safe observation confirms whether identity verification occurs for all entrants.

This result applies to a different case: A tester selects an attack tool because it is familiar, not because it matches target protocol. Tool choice should be threat-led and technically appropriate. It does not establish the present requirement, where the attack plan avoids unapproved availability or containment events. The relevant evidence is: The attack plan avoids unapproved availability or containment events.

That approach concerns a different situation: a customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. The required result is that the attack plan avoids unapproved availability or containment events. The relevant evidence is: The attack plan avoids unapproved availability or containment events.

It would address a tester observes a weakness classified by CWE but needs an identifier for a specific published vulnerability. The relevant reason in that case is: CWE describes weakness types; CVE identifies particular disclosed vulnerabilities. Here the required success condition is the attack plan avoids unapproved availability or containment events. The relevant evidence is: The attack plan avoids unapproved availability or containment events.

This action applies to a different case: A scripted lab assessment stores authorized targets in a fixed text file but includes one malformed external domain. Automation magnifies the impact of input mistakes. It does not establish the present requirement, where the test fixture stops at its request limit and honors retry guidance. The appropriate action is: Respect bounded retry and backoff policies with defined maximum requests.

That approach concerns a different situation: a team plans to use Scapy to craft arbitrary network packets on a sensitive industrial segment. Packet crafting can bypass normal protocol safeguards and destabilize fragile systems. The required result is that the test fixture stops at its request limit and honors retry guidance. The appropriate action is: Respect bounded retry and backoff policies with defined maximum requests.

That relates to a different issue: A security analyst wants to run Atomic Red Team tests but production containment could be triggered. Breach-and-attack simulation must respect real business impact. That is not a direct remedy for the requested outcome: The test fixture stops at its request limit and honors retry guidance. The appropriate action is: Respect bounded retry and backoff policies with defined maximum requests.

That relates to a different issue: The client's network team publishes a list of routable and private subnets with overlapping names. Incorrect network arithmetic can accidentally scan unauthorized ranges. That is not a direct remedy for the requested outcome: The platform inference includes confidence and packet evidence rather than certainty. The appropriate action is: Use permitted passive traffic analysis for a qualified operating-system hypothesis.

It would address a service exposes multiple ports associated with different application protocols. The relevant reason in that case is: Nonstandard port assignments are common and port numbers are only initial clues. Here the required success condition is the platform inference includes confidence and packet evidence rather than certainty. The appropriate action is: Use permitted passive traffic analysis for a qualified operating-system hypothesis.

This action applies to a different case: A UDP application is suspected, but no response appears to a generic UDP probe. UDP scanning often lacks reliable positive replies without an application response. It does not establish the present requirement, where the platform inference includes confidence and packet evidence rather than certainty. The appropriate action is: Use permitted passive traffic analysis for a qualified operating-system hypothesis.

That relates to a different issue: An app downloads files based on a path parameter that accepts parent-directory components. Path normalization and authorization must prevent escaping a file root. That is not a direct remedy for the requested outcome: A reference to a protected local path cannot be loaded. The relevant evidence is: A reference to a protected local path cannot be loaded.

It would address a theme installer accepts an external URL that is included into server-side code execution. The relevant reason in that case is: Server execution should not import untrusted remote code. Here the required success condition is a reference to a protected local path cannot be loaded. The relevant evidence is: A reference to a protected local path cannot be loaded.

This result applies to a different case: An OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. It does not establish the present requirement, where a reference to a protected local path cannot be loaded. The relevant evidence is: A reference to a protected local path cannot be loaded.

This action applies to a different case: An assessor finds an apparently exposed cloud access key in a web app's client bundle. A visible string may be a test key, limited token, or revoked credential. It does not establish the present requirement, where the endpoint list includes owner-approved paths and access methods. The appropriate action is: Record descriptor routes and classify them against the authorized API scope.

That approach concerns a different situation: an external DNS zone permits public records but the client has not authorized zone-transfer testing against its provider. A DNS service may be third-party managed and subject to additional restrictions. The required result is that the endpoint list includes owner-approved paths and access methods. The appropriate action is: Record descriptor routes and classify them against the authorized API scope.

It would address a route hidden from the site's navigation remains in the XML sitemap. The relevant reason in that case is: Sitemaps are inventory aids and not access permissions. Here the required success condition is the endpoint list includes owner-approved paths and access methods. The appropriate action is: Record descriptor routes and classify them against the authorized API scope.

It would address a host exposes a remote printing service on a restricted subnet and testers want to enumerate it. The relevant reason in that case is: Print services may bridge operating-system privileges and network segments. Here the required success condition is the graph distinguishes observed group rights from hypothetical execution. The relevant evidence is: The graph distinguishes observed group rights from hypothetical execution.

This result applies to a different case: An internal service uses cleartext FTP to move administrative files between servers. Plaintext file transfer can reveal data and credentials to intermediate observers. It does not establish the present requirement, where the graph distinguishes observed group rights from hypothetical execution. The relevant evidence is: The graph distinguishes observed group rights from hypothetical execution.

That approach concerns a different situation: an approved lab account accesses a second Windows host using a remote service management channel. Valid credentials and remote management can bridge compromised systems. The required result is that the graph distinguishes observed group rights from hypothetical execution. The relevant evidence is: The graph distinguishes observed group rights from hypothetical execution.

It would address an architect needs to categorize a forged authenticated principal in a design diagram. The relevant reason in that case is: Spoofing concerns impersonating an identity or authentication claim. Here the required success condition is the test plan identifies deliverables for each agreed methodology phase. The appropriate action is: Use PTES phases to organize the end-to-end assessment lifecycle.

This action applies to a different case: A SOC wants observed adversary behavior mapped to detection technique identifiers. ATT&CK classifies adversary behavior rather than providing a full test contract. It does not establish the present requirement, where the test plan identifies deliverables for each agreed methodology phase. The appropriate action is: Use PTES phases to organize the end-to-end assessment lifecycle.

That approach concerns a different situation: a web application team wants a prioritized list of common application security risk categories. OWASP Top 10 groups frequent web application security risks. The required result is that the test plan identifies deliverables for each agreed methodology phase. The appropriate action is: Use PTES phases to organize the end-to-end assessment lifecycle.

That approach concerns a different situation: an organization wants to identify potential service exposure from an approved public perimeter capture. Traffic analysis can reveal services not documented in current asset inventory. The required result is that a verified service inventory identifies observed protocol behavior. The appropriate action is: Correlate port hints with safe service identification rather than assuming protocol from numbers alone.

That relates to a different issue: A server sends an ICMP destination-unreachable response during a UDP assessment. Certain ICMP unreachable codes are evidence of blocked or unavailable UDP destinations. That is not a direct remedy for the requested outcome: A verified service inventory identifies observed protocol behavior. The appropriate action is: Correlate port hints with safe service identification rather than assuming protocol from numbers alone.

This action applies to a different case: A UDP application is suspected, but no response appears to a generic UDP probe. UDP scanning often lacks reliable positive replies without an application response. It does not establish the present requirement, where a verified service inventory identifies observed protocol behavior. The appropriate action is: Correlate port hints with safe service identification rather than assuming protocol from numbers alone.

That approach concerns a different situation: an exercise used a dedicated cloud API key that remains active after delivery. Leaving tester credentials active creates unnecessary future access. The required result is that the old test password and tokens no longer authenticate. The relevant evidence is: The old test password and tokens no longer authenticate.

That relates to a different issue: An assessor created a temporary directory account to validate scoped identity permissions. Tester-created identities can become lingering access paths. That is not a direct remedy for the requested outcome: The old test password and tokens no longer authenticate. The relevant evidence is: The old test password and tokens no longer authenticate.

It would address a tester copied a synthetic data set to a controlled staging container. The relevant reason in that case is: Even synthetic test data should follow documented lifecycle cleanup. Here the required success condition is the old test password and tokens no longer authenticate. The relevant evidence is: The old test password and tokens no longer authenticate.

It would address the customer cannot reproduce a finding because no affected endpoint or observation time is included. The relevant reason in that case is: Reproducible reporting supports client verification and remediation. Here the required success condition is the conclusion avoids a guarantee beyond assessed assets. The appropriate action is: Limit the conclusion to observed evidence and the authorized test scope.

This action applies to a different case: A report lists findings without distinguishing actual exploitation from inferred attack paths. Test limitations can materially affect the strength of a claim. It does not establish the present requirement, where the conclusion avoids a guarantee beyond assessed assets. The appropriate action is: Limit the conclusion to observed evidence and the authorized test scope.

That approach concerns a different situation: a team used an AI writing assistant and introduced an invented exploit claim into the draft. Generated narrative must not replace factual source observations. The required result is that the conclusion avoids a guarantee beyond assessed assets. The appropriate action is: Limit the conclusion to observed evidence and the authorized test scope.