Exam Bundle

That approach concerns a different situation: a web application team wants a prioritized list of common application security risk categories. OWASP Top 10 groups frequent web application security risks. The required result is that the design maps IT and process-control assets to appropriate levels. The relevant evidence is: The design maps IT and process-control assets to appropriate levels.

It would address a tester needs a structured penetration testing workflow from pre-engagement to reporting. The relevant reason in that case is: PTES explicitly addresses preparation, discovery, exploitation, and reporting. Here the required success condition is the design maps IT and process-control assets to appropriate levels. The relevant evidence is: The design maps IT and process-control assets to appropriate levels.

This result applies to a different case: A SOC wants observed adversary behavior mapped to detection technique identifiers. ATT&CK classifies adversary behavior rather than providing a full test contract. It does not establish the present requirement, where the design maps IT and process-control assets to appropriate levels. The relevant evidence is: The design maps IT and process-control assets to appropriate levels.

This action applies to a different case: A social engineer watches a staff member type a badge PIN from behind. Visual observation can disclose authentication secrets without network contact. It does not establish the present requirement, where a controlled visitor is challenged before entering restricted areas. The appropriate action is: Identify tailgating risk and recommend escort and access control enforcement.

That approach concerns a different situation: a malicious message is tailored to a financial executive's current acquisition project. Role-specific pretexts can increase credibility with high-value individuals. The required result is that a controlled visitor is challenged before entering restricted areas. The appropriate action is: Identify tailgating risk and recommend escort and access control enforcement.

That relates to a different issue: A security team wants to evaluate whether staff report suspicious phone calls instead of obeying them. Social testing measures human response while protecting staff privacy and safety. That is not a direct remedy for the requested outcome: A controlled visitor is challenged before entering restricted areas. The appropriate action is: Identify tailgating risk and recommend escort and access control enforcement.

It would address an engagement installed a scheduled laboratory test task that remains after testing is complete. The relevant reason in that case is: Persistence artifacts must not survive beyond signed testing authorization. Here the required success condition is the approved evidence bundle remains accessible with integrity verification. The appropriate action is: Preserve required artifacts using encrypted storage and retention controls before cleaning working copies.

This action applies to a different case: An application security exercise saved a proof-of-concept script in an application document root. Residual files in a web root can become unintended access points. It does not establish the present requirement, where the approved evidence bundle remains accessible with integrity verification. The appropriate action is: Preserve required artifacts using encrypted storage and retention controls before cleaning working copies.

That relates to a different issue: A temporary firewall exception was added to a test subnet under approved change control. Testing changes must not weaken production controls after the engagement. That is not a direct remedy for the requested outcome: The approved evidence bundle remains accessible with integrity verification. The appropriate action is: Preserve required artifacts using encrypted storage and retention controls before cleaning working copies.

That relates to a different issue: A file-conversion service passes filenames directly to a system shell. Shell metacharacters can change command execution when inputs are concatenated. That is not a direct remedy for the requested outcome: The resolved target outside the approved directory is denied. The appropriate action is: Apply canonical path resolution and validate the final target before file access.

This action applies to a different case: A theme installer accepts an external URL that is included into server-side code execution. Server execution should not import untrusted remote code. It does not establish the present requirement, where the resolved target outside the approved directory is denied. The appropriate action is: Apply canonical path resolution and validate the final target before file access.

That approach concerns a different situation: a web gateway trusts an unsigned JWT claim that a user is an administrator. Untrusted token content must never grant privileged API access. The required result is that the resolved target outside the approved directory is denied. The appropriate action is: Apply canonical path resolution and validate the final target before file access.

That approach concerns a different situation: an approved web spider repeatedly follows logout links and invalidates its own session. Automated crawling must maintain authentication safely and avoid unwanted state changes. The required result is that evidence includes permitted service details, not copied protected credentials. The relevant evidence is: Evidence includes permitted service details, not copied protected credentials.

That relates to a different issue: A permitted SMB account lists a share with write permission although the business expected read-only access. Authorization may differ between share and filesystem permission layers. That is not a direct remedy for the requested outcome: Evidence includes permitted service details, not copied protected credentials. The relevant evidence is: Evidence includes permitted service details, not copied protected credentials.

It would address a tester needs to discover running operating system services using only a read-only endpoint account. The relevant reason in that case is: Authenticated enumeration can identify services without exploiting them. Here the required success condition is evidence includes permitted service details, not copied protected credentials. The relevant evidence is: Evidence includes permitted service details, not copied protected credentials.

That approach concerns a different situation: a Linux container image should be checked against known CVE advisory databases. Image scanners map packaged components to known vulnerability records. The required result is that a policy test flags the privileged mount in the intended workload. The appropriate action is: Review the manifest using container security assessment tooling.

That relates to a different issue: An assessment finds a web service protected by a WAF that blocks many scanner patterns. WAF responses can mask vulnerabilities and reduce scan completeness. That is not a direct remedy for the requested outcome: A policy test flags the privileged mount in the intended workload. The appropriate action is: Review the manifest using container security assessment tooling.

It would address a team wants an assessment of a Kubernetes cluster while its production workloads cannot tolerate attack simulation. The relevant reason in that case is: Kubernetes posture assessment can identify weak RBAC and workloads without disrupting them. Here the required success condition is a policy test flags the privileged mount in the intended workload. The appropriate action is: Review the manifest using container security assessment tooling.

It would address an assessment produces many identical findings from hosts sharing one vulnerable image. The relevant reason in that case is: Single-image remediation may close multiple host findings. Here the required success condition is one root finding documents affected routes and a representative safe proof. The appropriate action is: Deduplicate at the vulnerable parameter and code path while preserving request examples.

This action applies to a different case: A scanner labels a host unreachable while a jump system sees it available. Network visibility differs by source segment. It does not establish the present requirement, where one root finding documents affected routes and a representative safe proof. The appropriate action is: Deduplicate at the vulnerable parameter and code path while preserving request examples.

That relates to a different issue: The same web path returns 403 to scanners but 200 to an authorized test account. Authenticated routes require appropriate evaluation context. That is not a direct remedy for the requested outcome: One root finding documents affected routes and a representative safe proof. The appropriate action is: Deduplicate at the vulnerable parameter and code path while preserving request examples.

That relates to a different issue: A test team wants to assess whether confidential files could be moved to personal web text storage. Public paste sites may provide an outbound data path not intended for business use. That is not a direct remedy for the requested outcome: An approved test client cannot upload synthetic data to the prohibited endpoint. The appropriate action is: Recommend destination policy and egress monitoring rather than relying only on encrypted transport.

It would address a compromised process uses a covert channel but the defender has only firewall allow/deny logs. The relevant reason in that case is: Allowed protocols may still carry anomalous information. Here the required success condition is an approved test client cannot upload synthetic data to the prohibited endpoint. The appropriate action is: Recommend destination policy and egress monitoring rather than relying only on encrypted transport.

This action applies to a different case: An application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. Encrypted transport can conceal unauthorized data transfer. It does not establish the present requirement, where an approved test client cannot upload synthetic data to the prohibited endpoint. The appropriate action is: Recommend destination policy and egress monitoring rather than relying only on encrypted transport.

That approach concerns a different situation: a sandboxed application allows launching an unrestricted terminal through a helper menu. Process spawning can bypass an application's intended restricted environment. The required result is that a standard user cannot introduce a new loaded plugin. The relevant evidence is: A standard user cannot introduce a new loaded plugin.

It would address a Windows event log unexpectedly stops recording privileged actions during a test. The relevant reason in that case is: Audit integrity is required to detect and investigate host compromise. Here the required success condition is a standard user cannot introduce a new loaded plugin. The relevant evidence is: A standard user cannot introduce a new loaded plugin.

This result applies to a different case: A Windows kiosk permits access to a general command shell through a settings shortcut. Single-purpose devices should not expose general operating-system controls. It does not establish the present requirement, where a standard user cannot introduce a new loaded plugin. The relevant evidence is: A standard user cannot introduce a new loaded plugin.

This action applies to a different case: An exposed web server accepts deprecated TLS algorithms. Modern cryptographic configuration reduces downgrade and interception risk. It does not establish the present requirement, where a developer cannot delete backups but the backup operator can run approved restores. The appropriate action is: Segment backup administration and apply minimum role permissions.

That approach concerns a different situation: an endpoint runs an exploitable version of a server component with an available vendor fix. Correcting the vulnerable version addresses the observed root cause. The required result is that a developer cannot delete backups but the backup operator can run approved restores. The appropriate action is: Segment backup administration and apply minimum role permissions.

That relates to a different issue: A service exposes its administrative interface to every network segment. Limiting reachability reduces opportunities for credential and service abuse. That is not a direct remedy for the requested outcome: A developer cannot delete backups but the backup operator can run approved restores. The appropriate action is: Segment backup administration and apply minimum role permissions.

It would address a report generator uses user input inside its server-side template expression parser. The relevant reason in that case is: Template engines may execute operators or expose objects when input is treated as syntax. Here the required success condition is a synthetic quote-bearing value remains inert in the rendered page. The appropriate action is: Use JavaScript-context output encoding and defensive templating.

This action applies to a different case: A customer message displays unsanitized HTML that executes inside another user's browser. Untrusted content can cross the browser's code/data boundary. It does not establish the present requirement, where a synthetic quote-bearing value remains inert in the rendered page. The appropriate action is: Use JavaScript-context output encoding and defensive templating.

That approach concerns a different situation: a login rate limit can be bypassed because it counts only a mutable client-provided header. Untrusted request headers should not control abuse enforcement. The required result is that a synthetic quote-bearing value remains inert in the rendered page. The appropriate action is: Use JavaScript-context output encoding and defensive templating.