Exam Bundle

That approach concerns a different situation: a mobile app stores unencrypted session tokens in a world-readable local database. Mobile client storage is not inherently confidential on compromised devices. The required result is that a controlled safety test produces no prohibited real training records. The relevant evidence is: A controlled safety test produces no prohibited real training records.

It would address an app asks for contact-list access even though the business feature uses only a camera. The relevant reason in that case is: Unnecessary mobile permissions expand sensitive data exposure. Here the required success condition is a controlled safety test produces no prohibited real training records. The relevant evidence is: A controlled safety test produces no prohibited real training records.

This result applies to a different case: A security engineer needs to inspect BLE advertising data for an approved IoT sensor. Bluetooth advertisement fields can disclose device information passively. It does not establish the present requirement, where a controlled safety test produces no prohibited real training records. The relevant evidence is: A controlled safety test produces no prohibited real training records.

This action applies to a different case: A tester observes a weakness classified by CWE but needs an identifier for a specific published vulnerability. CWE describes weakness types; CVE identifies particular disclosed vulnerabilities. It does not establish the present requirement, where the priority narrative distinguishes exploit probability from impact. The appropriate action is: Consider EPSS and current threat intelligence alongside base severity.

That relates to a different issue: A customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. That is not a direct remedy for the requested outcome: The priority narrative distinguishes exploit probability from impact. The appropriate action is: Consider EPSS and current threat intelligence alongside base severity.

It would address a cloud service is misconfigured but the contract forbids modification of production access policies. The relevant reason in that case is: Exploitation must respect both target scope and permitted change types. Here the required success condition is the priority narrative distinguishes exploit probability from impact. The appropriate action is: Consider EPSS and current threat intelligence alongside base severity.

It would address a security engineer needs to discover unmanaged assets visible at a site but cannot reach them from the test subnet. The relevant reason in that case is: Visibility boundaries can limit an active scanner's completeness. Here the required success condition is the report states the observed ICMP code and its qualified interpretation. The relevant evidence is: The report states the observed ICMP code and its qualified interpretation.

That approach concerns a different situation: a service exposes multiple ports associated with different application protocols. Nonstandard port assignments are common and port numbers are only initial clues. The required result is that the report states the observed ICMP code and its qualified interpretation. The relevant evidence is: The report states the observed ICMP code and its qualified interpretation.

That relates to a different issue: A reverse proxy presents a server header claiming a particular web product version. Response headers may be hidden, modified, or deliberately misleading. That is not a direct remedy for the requested outcome: The report states the observed ICMP code and its qualified interpretation. The relevant evidence is: The report states the observed ICMP code and its qualified interpretation.

That relates to a different issue: An assessor discovers credential samples in a third-party breach corpus mentioning the client's email domain. Leaked credentials are sensitive evidence, not blanket authorization to log in. That is not a direct remedy for the requested outcome: The case records only minimal redacted evidence and alerts the owner. The appropriate action is: Inspect repository history under agreed passive rules and report suspected secret exposure securely.

It would address a client wants to discover previously published but now removed endpoint documentation. The relevant reason in that case is: Web caches may preserve older public information no longer linked. Here the required success condition is the case records only minimal redacted evidence and alerts the owner. The appropriate action is: Inspect repository history under agreed passive rules and report suspected secret exposure securely.

This action applies to a different case: A company cannot explain why an old DNS mail exchanger still appears in public records. Current DNS answers identify public mail routing independently of internal diagrams. It does not establish the present requirement, where the case records only minimal redacted evidence and alerts the owner. The appropriate action is: Inspect repository history under agreed passive rules and report suspected secret exposure securely.

That relates to a different issue: A test account reaches a Windows management endpoint through WinRM from an unexpected subnet. WinRM provides remote Windows management under authenticated privileges. That is not a direct remedy for the requested outcome: The timeline links the route change to an authorized or unapproved process. The relevant evidence is: The timeline links the route change to an authorized or unapproved process.

It would address an authorized lab shows remote administrative tasks created through WMI. The relevant reason in that case is: WMI supports legitimate management as well as remote execution activity. Here the required success condition is the timeline links the route change to an authorized or unapproved process. The relevant evidence is: The timeline links the route change to an authorized or unapproved process.

This result applies to a different case: A Linux test lab uses an SSH jump server and the team must ensure only the signed target is reachable. Jump infrastructure can expand reach if left unrestricted. It does not establish the present requirement, where the timeline links the route change to an authorized or unapproved process. The relevant evidence is: The timeline links the route change to an authorized or unapproved process.

This action applies to a different case: A theme installer accepts an external URL that is included into server-side code execution. Server execution should not import untrusted remote code. It does not establish the present requirement, where a controlled special-character filename cannot invoke an extra command. The appropriate action is: Identify OS command injection and remove shell interpretation of user input.

That approach concerns a different situation: an app downloads files based on a path parameter that accepts parent-directory components. Path normalization and authorization must prevent escaping a file root. The required result is that a controlled special-character filename cannot invoke an extra command. The appropriate action is: Identify OS command injection and remove shell interpretation of user input.

That relates to a different issue: A web handler includes a local log file by user-supplied filename. Local file inclusion may expose protected files or interpret unexpected content. That is not a direct remedy for the requested outcome: A controlled special-character filename cannot invoke an extra command. The appropriate action is: Identify OS command injection and remove shell interpretation of user input.

This action applies to a different case: A company wants measurable technical security testing of network and physical channels. OSSTMM focuses on methodical operational security testing and measurement. It does not establish the present requirement, where the design maps IT and process-control assets to appropriate levels. The appropriate action is: Use the Purdue model to describe OT network hierarchy.

That approach concerns a different situation: a tester needs a structured penetration testing workflow from pre-engagement to reporting. PTES explicitly addresses preparation, discovery, exploitation, and reporting. The required result is that the design maps IT and process-control assets to appropriate levels. The appropriate action is: Use the Purdue model to describe OT network hierarchy.

That relates to a different issue: A web application team wants a prioritized list of common application security risk categories. OWASP Top 10 groups frequent web application security risks. That is not a direct remedy for the requested outcome: The design maps IT and process-control assets to appropriate levels. The appropriate action is: Use the Purdue model to describe OT network hierarchy.

That relates to a different issue: Employees frequently enter a controlled warehouse door by carrying boxes that obstruct badge presentation. Operational processes can unintentionally defeat physical control design. That is not a direct remedy for the requested outcome: A supervised drill permits safe egress without opening unauthorized ingress. The appropriate action is: Evaluate access control safety against life-safety egress requirements.

It would address a site survey finds two entrances to a data room, one with biometric checks and one with an unmonitored exit. The relevant reason in that case is: Security is limited by the least protected route into the same zone. Here the required success condition is a supervised drill permits safe egress without opening unauthorized ingress. The appropriate action is: Evaluate access control safety against life-safety egress requirements.

That approach concerns a different situation: an assessor finds a portable storage device labeled 'payroll' left in an office lobby. Lures can induce unauthorized device execution or data disclosure. The required result is that a supervised drill permits safe egress without opening unauthorized ingress. The appropriate action is: Evaluate access control safety against life-safety egress requirements.

That relates to a different issue: A lab connection initiated from a controlled host stays available through outbound egress. Reverse shells initiate the control connection from the compromised host. That is not a direct remedy for the requested outcome: The authorized cleanup removes the entry and verifies no later execution. The relevant evidence is: The authorized cleanup removes the entry and verifies no later execution.

It would address a C2 simulation in a sandbox uses periodic HTTP check-ins from an agent. The relevant reason in that case is: Periodic callbacks can sustain remote tasking between interactions. Here the required success condition is the authorized cleanup removes the entry and verifies no later execution. The relevant evidence is: The authorized cleanup removes the entry and verifies no later execution.

This result applies to a different case: A lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. Scheduled execution can restore a foothold without an interactive login. It does not establish the present requirement, where the authorized cleanup removes the entry and verifies no later execution. The relevant evidence is: The authorized cleanup removes the entry and verifies no later execution.

That approach concerns a different situation: a shared workstation allows users to write into a privileged application's plugin folder. Writable extension paths create opportunities for untrusted code under elevated context. The required result is that a scoped permission review confirms the unnecessary elevated bit. The relevant evidence is: A scoped permission review confirms the unnecessary elevated bit.

That relates to a different issue: A penetration tester identifies an accessible PowerShell script that imports a privileged module from a writable directory. Dynamic module loading can cross privilege boundaries if paths are user-controlled. That is not a direct remedy for the requested outcome: A scoped permission review confirms the unnecessary elevated bit. The relevant evidence is: A scoped permission review confirms the unnecessary elevated bit.

It would address a service startup configuration references an executable removed during a software upgrade. The relevant reason in that case is: Missing service executables are not exploitable without a controllable replacement path. Here the required success condition is a scoped permission review confirms the unnecessary elevated bit. The relevant evidence is: A scoped permission review confirms the unnecessary elevated bit.

It would address an assessor wants to enumerate external records but cannot use a product requiring active client network contact. The relevant reason in that case is: Tool mode is more important than product name for scope compliance. Here the required success condition is every historical configuration has an archive date and uncertainty note. The appropriate action is: Consult the Wayback Machine and distinguish archived content from live state.

This action applies to a different case: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. It does not establish the present requirement, where every historical configuration has an archive date and uncertainty note. The appropriate action is: Consult the Wayback Machine and distinguish archived content from live state.

That relates to a different issue: An assessor needs to query current A, MX, and TXT records for a customer's domain. DNS command-line tools retrieve authoritative or resolver responses. That is not a direct remedy for the requested outcome: Every historical configuration has an archive date and uncertainty note. The appropriate action is: Consult the Wayback Machine and distinguish archived content from live state.