Exam Bundle

This result applies to a different case: A company wants measurable technical security testing of network and physical channels. OSSTMM focuses on methodical operational security testing and measurement. It does not establish the present requirement, where the model maps the forged identity to spoofing mitigations. The relevant evidence is: The model maps the forged identity to spoofing mitigations.

That approach concerns a different situation: an industrial plant needs a diagram of enterprise, supervisory, and process-control zones. Purdue levels organize industrial control network functions and boundaries. The required result is that the model maps the forged identity to spoofing mitigations. The relevant evidence is: The model maps the forged identity to spoofing mitigations.

That relates to a different issue: A mobile team needs verification criteria for client-side storage and authentication controls. MASVS defines mobile application security verification requirements. That is not a direct remedy for the requested outcome: The model maps the forged identity to spoofing mitigations. The relevant evidence is: The model maps the forged identity to spoofing mitigations.

It would address a profile page places input directly into a JavaScript string literal without encoding. The relevant reason in that case is: Encoding suitable for HTML text is not automatically sufficient inside script strings. Here the required success condition is a cross-origin synthetic update fails without the required valid token. The appropriate action is: Report cross-site request forgery and require anti-CSRF and origin protections.

This action applies to a different case: An OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. It does not establish the present requirement, where a cross-origin synthetic update fails without the required valid token. The appropriate action is: Report cross-site request forgery and require anti-CSRF and origin protections.

That approach concerns a different situation: a service accepts a filename that resolves through a symlink to a protected system path. Text-based path checks can be bypassed by filesystem indirection. The required result is that a cross-origin synthetic update fails without the required valid token. The appropriate action is: Report cross-site request forgery and require anti-CSRF and origin protections.

That relates to a different issue: A network team wants safe evidence that its service account cannot authenticate to unrelated SMB hosts. A service account's trust scope affects lateral movement potential. That is not a direct remedy for the requested outcome: The evidence distinguishes exposed port from authenticated share rights. The appropriate action is: Report the reachable SMB service and request approved access for share-level testing.

It would address a client wants to assess relay susceptibility without capturing employee credentials. The relevant reason in that case is: Proof of authentication relay must avoid collection of unrelated secrets. Here the required success condition is the evidence distinguishes exposed port from authenticated share rights. The appropriate action is: Report the reachable SMB service and request approved access for share-level testing.

This action applies to a different case: A lab server accepts SMB authentication relayed from another service without enforcing signing. Unsigned authentication flows can be replayed or relayed across trust boundaries. It does not establish the present requirement, where the evidence distinguishes exposed port from authenticated share rights. The appropriate action is: Report the reachable SMB service and request approved access for share-level testing.

This result applies to a different case: Two scans report conflicting CVEs for the same package after a patch rollout. Patch state and scanner signatures may change between observations. It does not establish the present requirement, where a repeat scan completes with successful name resolution. The relevant evidence is: A repeat scan completes with successful name resolution.

That relates to a different issue: An automated scanner reports weak ciphers but the test client proposed unsupported suites. Incorrect scanner handshake behavior can create misleading conclusions. That is not a direct remedy for the requested outcome: A repeat scan completes with successful name resolution. The relevant evidence is: A repeat scan completes with successful name resolution.

It would address the same web path returns 403 to scanners but 200 to an authorized test account. The relevant reason in that case is: Authenticated routes require appropriate evaluation context. Here the required success condition is a repeat scan completes with successful name resolution. The relevant evidence is: A repeat scan completes with successful name resolution.

This action applies to a different case: A client's lab shows a service accepts authentication using an old expired ticket. Kerberos security depends on correctly enforced validity intervals. It does not establish the present requirement, where unsolicited test prompts cannot complete authentication without user-approved context. The appropriate action is: Identify MFA fatigue and require number matching or phishing-resistant authentication.

That approach concerns a different situation: an approved lab shows NTLM network authentication may be accepted without a plaintext password. Reusable password-derived authentication material can be abused in some NTLM flows. The required result is that unsolicited test prompts cannot complete authentication without user-approved context. The appropriate action is: Identify MFA fatigue and require number matching or phishing-resistant authentication.

That relates to a different issue: A web login receives credentials from a known external breach list. Credential stuffing reuses previously leaked username-password combinations. That is not a direct remedy for the requested outcome: Unsolicited test prompts cannot complete authentication without user-approved context. The appropriate action is: Identify MFA fatigue and require number matching or phishing-resistant authentication.

That relates to a different issue: An employee repeatedly follows strangers through secure doors during a role-play exercise. Physical social engineering can bypass identity checkpoints. That is not a direct remedy for the requested outcome: The test PIN is shielded and unapproved observation cannot recover it. The appropriate action is: Classify shoulder surfing and recommend privacy shielding and awareness.

This action applies to a different case: An attacker places a plausible company-branded Wi-Fi login page in a public lobby. Impersonated access portals can collect user authentication data. It does not establish the present requirement, where the test PIN is shielded and unapproved observation cannot recover it. The appropriate action is: Classify shoulder surfing and recommend privacy shielding and awareness.

That approach concerns a different situation: a tester proposes scraping discarded sensitive papers from an office dumpster after physical scope ended. Dumpster diving is physical reconnaissance and is not implied by web authorization. The required result is that the test PIN is shielded and unapproved observation cannot recover it. The appropriate action is: Classify shoulder surfing and recommend privacy shielding and awareness.

That approach concerns a different situation: a Windows domain has AD Certificate Services templates granting enrollment privileges to unintended users. Misconfigured certificate templates can grant unintended authentication capabilities. The required result is that the report records safe authentication evidence and the required reset control. The appropriate action is: Demonstrate the default-credential risk only on a designated test printer.

That relates to a different issue: A captured lab TCP session reveals an intermediary can see unencrypted application data. Traffic traversing an attacker-controlled segment can expose plaintext. That is not a direct remedy for the requested outcome: The report records safe authentication evidence and the required reset control. The appropriate action is: Demonstrate the default-credential risk only on a designated test printer.

It would address a client wants to assess relay susceptibility without capturing employee credentials. The relevant reason in that case is: Proof of authentication relay must avoid collection of unrelated secrets. Here the required success condition is the report records safe authentication evidence and the required reset control. The appropriate action is: Demonstrate the default-credential risk only on a designated test printer.

That approach concerns a different situation: a scheduled assessment identifies fewer hosts than last month, but subnet routing has changed. Fewer findings may indicate lost visibility, not improved security. The required result is that the analyst confirms vendor patch status using the installed package revision. The appropriate action is: Compare vendor security advisory and installed build rather than upstream version alone.

That relates to a different issue: A web security tool claims a URL is injectable based on reflected marker text alone. Reflection is not equivalent to SQL command execution. That is not a direct remedy for the requested outcome: The analyst confirms vendor patch status using the installed package revision. The appropriate action is: Compare vendor security advisory and installed build rather than upstream version alone.

It would address a vulnerability scan highlights a CVE in a dormant service not installed on the target. The relevant reason in that case is: CVE matching must correspond to actual components. Here the required success condition is the analyst confirms vendor patch status using the installed package revision. The appropriate action is: Compare vendor security advisory and installed build rather than upstream version alone.

This action applies to a different case: A cloud VM snapshot is shared with another account unintentionally. Data snapshots can disclose sensitive disk content outside running systems. It does not establish the present requirement, where a modified unsigned test image is rejected. The appropriate action is: Enforce verified image provenance and signed-artifact admission.

That approach concerns a different situation: a private cloud endpoint resolves to a public address because the DNS zone is misconfigured. Private endpoint creation alone does not ensure clients use private routes. The required result is that a modified unsigned test image is rejected. The appropriate action is: Enforce verified image provenance and signed-artifact admission.

That relates to a different issue: A cloud identity policy grants wildcard actions on all resources to an automation job. Overly broad IAM permissions expand compromise impact. That is not a direct remedy for the requested outcome: A modified unsigned test image is rejected. The appropriate action is: Enforce verified image provenance and signed-artifact admission.

That relates to a different issue: A cloud service exposes an administrative dashboard on a public endpoint despite an internal-only design. Cloud service public access settings can override intended network trust boundaries. That is not a direct remedy for the requested outcome: An approved workload resolves the endpoint privately; external access is denied. The relevant evidence is: An approved workload resolves the endpoint privately; external access is denied.

This result applies to a different case: A container image is pulled from an untrusted registry without signature validation. Supply-chain tampering may insert unauthorized code before deployment. It does not establish the present requirement, where an approved workload resolves the endpoint privately; external access is denied. The relevant evidence is: An approved workload resolves the endpoint privately; external access is denied.

That approach concerns a different situation: a cloud storage bucket allows unauthenticated reads although business records are private. Public object permissions can expose data independently of infrastructure firewall rules. The required result is that an approved workload resolves the endpoint privately; external access is denied. The relevant evidence is: An approved workload resolves the endpoint privately; external access is denied.

That relates to a different issue: A report needs proof that no unauthorized modification remained after a system-level assessment. Restoration requires verification, not a verbal cleanup statement. That is not a direct remedy for the requested outcome: Process and service inventories show no active test agent. The relevant evidence is: Process and service inventories show no active test agent.

It would address an assessment deployed a temporary cloud VM and associated public IP for a controlled attack simulation. The relevant reason in that case is: Temporary test resources can create ongoing cost and exposure. Here the required success condition is process and service inventories show no active test agent. The relevant evidence is: Process and service inventories show no active test agent.

This result applies to a different case: An assessor created a temporary directory account to validate scoped identity permissions. Tester-created identities can become lingering access paths. It does not establish the present requirement, where process and service inventories show no active test agent. The relevant evidence is: Process and service inventories show no active test agent.