Exam Bundle

It would address an assessor wants to enumerate external records but cannot use a product requiring active client network contact. The relevant reason in that case is: Tool mode is more important than product name for scope compliance. Here the required success condition is every historical configuration has an archive date and uncertainty note. The appropriate action is: Consult the Wayback Machine and distinguish archived content from live state.

This action applies to a different case: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. It does not establish the present requirement, where every historical configuration has an archive date and uncertainty note. The appropriate action is: Consult the Wayback Machine and distinguish archived content from live state.

That relates to a different issue: An assessor needs to query current A, MX, and TXT records for a customer's domain. DNS command-line tools retrieve authoritative or resolver responses. That is not a direct remedy for the requested outcome: Every historical configuration has an archive date and uncertainty note. The appropriate action is: Consult the Wayback Machine and distinguish archived content from live state.

That relates to a different issue: A network weakness requires two earlier access conditions that are not present in the scoped lab. An attack chain is limited by its unmet prerequisite steps. That is not a direct remedy for the requested outcome: The plan documents why the selected method fits the verified target. The appropriate action is: Match capability and expected evidence to the observed protocol and weakness.

It would address a team is about to test a service containing a safety-critical industrial controller. The relevant reason in that case is: Fragile and safety-related services need tailored test restrictions. Here the required success condition is the plan documents why the selected method fits the verified target. The appropriate action is: Match capability and expected evidence to the observed protocol and weakness.

This action applies to a different case: A cloud service is misconfigured but the contract forbids modification of production access policies. Exploitation must respect both target scope and permitted change types. It does not establish the present requirement, where the plan documents why the selected method fits the verified target. The appropriate action is: Match capability and expected evidence to the observed protocol and weakness.

That approach concerns a different situation: a tester sees an employee hold open a restricted office door for a visitor without checking credentials. Tailgating involves following an authorized entrant through a secured access point. The required result is that the staff member follows the established verification and escort process. The relevant evidence is: The staff member follows the established verification and escort process.

That relates to a different issue: Employees frequently enter a controlled warehouse door by carrying boxes that obstruct badge presentation. Operational processes can unintentionally defeat physical control design. That is not a direct remedy for the requested outcome: The staff member follows the established verification and escort process. The relevant evidence is: The staff member follows the established verification and escort process.

It would address a factory prohibits onsite photography but a tester wants to document an unmonitored side gate. The relevant reason in that case is: Physical evidence collection remains bound by facility security policy. Here the required success condition is the staff member follows the established verification and escort process. The relevant evidence is: The staff member follows the established verification and escort process.

This action applies to a different case: An audit discovers cloud activity logging disabled for a sensitive storage resource. Missing logs undermine validation of cloud resource abuse. It does not establish the present requirement, where the incident has attributable token issuer, principal, and API activity. The appropriate action is: Correlate identity session, API event, and resource context in approved logs.

That relates to a different issue: A container image is pulled from an untrusted registry without signature validation. Supply-chain tampering may insert unauthorized code before deployment. That is not a direct remedy for the requested outcome: The incident has attributable token issuer, principal, and API activity. The appropriate action is: Correlate identity session, API event, and resource context in approved logs.

It would address a test account can invoke a cloud API because identity policies allow access but an organization policy should deny it. The relevant reason in that case is: Cloud authorization layers may impose boundaries beyond principal permissions. Here the required success condition is the incident has attributable token issuer, principal, and API activity. The appropriate action is: Correlate identity session, API event, and resource context in approved logs.

It would address a tester copied a synthetic data set to a controlled staging container. The relevant reason in that case is: Even synthetic test data should follow documented lifecycle cleanup. Here the required success condition is the test principal cannot perform the previously elevated operation. The appropriate action is: Revert role bindings and verify namespace rights against the baseline.

That approach concerns a different situation: a test changed a DNS entry to direct a synthetic domain toward a lab server. Incomplete restoration can disrupt normal routing after the test. The required result is that the test principal cannot perform the previously elevated operation. The appropriate action is: Revert role bindings and verify namespace rights against the baseline.

That relates to a different issue: An assessor created a temporary directory account to validate scoped identity permissions. Tester-created identities can become lingering access paths. That is not a direct remedy for the requested outcome: The test principal cannot perform the previously elevated operation. The appropriate action is: Revert role bindings and verify namespace rights against the baseline.

That relates to a different issue: A Windows host maps a cloud-backed virtual drive through an unauthorized sync client. Mapped storage can move data outside conventional removable drives. That is not a direct remedy for the requested outcome: An approved test client cannot upload synthetic data to the prohibited endpoint. The relevant evidence is: An approved test client cannot upload synthetic data to the prohibited endpoint.

It would address a data movement alert reports a compressed archive but its creation may belong to normal backups. The relevant reason in that case is: Legitimate backups also compress and move files. Here the required success condition is an approved test client cannot upload synthetic data to the prohibited endpoint. The relevant evidence is: An approved test client cannot upload synthetic data to the prohibited endpoint.

This result applies to a different case: A security engineer suspects steganography in images uploaded to an external content site. Hidden payloads may exist within apparently benign media files. It does not establish the present requirement, where an approved test client cannot upload synthetic data to the prohibited endpoint. The relevant evidence is: An approved test client cannot upload synthetic data to the prohibited endpoint.

That approach concerns a different situation: an app downloads files based on a path parameter that accepts parent-directory components. Path normalization and authorization must prevent escaping a file root. The required result is that the finding includes interpreter-level evidence or a qualified unconfirmed status. The relevant evidence is: The finding includes interpreter-level evidence or a qualified unconfirmed status.

That relates to a different issue: A website allows a cross-site form to change an authenticated user's email without an anti-CSRF check. An authenticated browser can carry session cookies for unintended state-changing requests. That is not a direct remedy for the requested outcome: The finding includes interpreter-level evidence or a qualified unconfirmed status. The relevant evidence is: The finding includes interpreter-level evidence or a qualified unconfirmed status.

This result applies to a different case: A service accepts a filename that resolves through a symlink to a protected system path. Text-based path checks can be bypassed by filesystem indirection. It does not establish the present requirement, where the finding includes interpreter-level evidence or a qualified unconfirmed status. The relevant evidence is: The finding includes interpreter-level evidence or a qualified unconfirmed status.

This result applies to a different case: A shell script checks whether a discovered address is inside a permitted CIDR range using string prefixes. Textual prefix matching is not correct network arithmetic. It does not establish the present requirement, where a permanently failing test endpoint stops after the configured retry budget. The relevant evidence is: A permanently failing test endpoint stops after the configured retry budget.

That relates to a different issue: A Python extractor sometimes misclassifies ports because values arrive as strings. Structured input still requires type checking before comparisons. That is not a direct remedy for the requested outcome: A permanently failing test endpoint stops after the configured retry budget. The relevant evidence is: A permanently failing test endpoint stops after the configured retry budget.

It would address a Python reconnaissance script stops after the first page of API results. The relevant reason in that case is: APIs commonly limit each response and require explicit continuation. Here the required success condition is a permanently failing test endpoint stops after the configured retry budget. The relevant evidence is: A permanently failing test endpoint stops after the configured retry budget.

It would address a password audit tests a curated wordlist against approved offline synthetic hashes. The relevant reason in that case is: Dictionary attacks try likely words instead of exhaustive permutations. Here the required success condition is a controlled test proves the app detects reused credential attempts. The relevant evidence is: A controlled test proves the app detects reused credential attempts.

This result applies to a different case: A website returns a different error for nonexisting usernames even when all passwords fail. Error consistency prevents disclosure of valid account identities. It does not establish the present requirement, where a controlled test proves the app detects reused credential attempts. The relevant evidence is: A controlled test proves the app detects reused credential attempts.

That approach concerns a different situation: an application accepts arbitrary SAML assertions lacking strict issuer verification. Federation trust requires correct issuer, audience, expiry, and signatures. The required result is that a controlled test proves the app detects reused credential attempts. The relevant evidence is: A controlled test proves the app detects reused credential attempts.

It would address an organization wants publicly exposed SSL certificate history for a retired hostname. The relevant reason in that case is: Certificates can reveal previously registered names and issuance chronology. Here the required success condition is each candidate host has source citations and an approved next step. The appropriate action is: Correlate the names with passive DNS before selecting any active probes.

This action applies to a different case: A tester's passive source lists an IP as belonging to a vendor, but the contract targets the customer only. Internet intelligence results may have stale service ownership attribution. It does not establish the present requirement, where each candidate host has source citations and an approved next step. The appropriate action is: Correlate the names with passive DNS before selecting any active probes.

That approach concerns a different situation: a client wants to discover previously published but now removed endpoint documentation. Web caches may preserve older public information no longer linked. The required result is that each candidate host has source citations and an approved next step. The appropriate action is: Correlate the names with passive DNS before selecting any active probes.

That relates to a different issue: A security team asks whether public profile data exposes names and organizational roles of privileged employees. Public role disclosures can inform social-engineering exposure without active contact. That is not a direct remedy for the requested outcome: A list of candidate names includes timestamps and ownership verification notes. The relevant evidence is: A list of candidate names includes timestamps and ownership verification notes.

It would address a cloud team worries that an old object storage endpoint is indexed in search results. The relevant reason in that case is: Search indices can disclose public paths even after application navigation changes. Here the required success condition is a list of candidate names includes timestamps and ownership verification notes. The relevant evidence is: A list of candidate names includes timestamps and ownership verification notes.

This result applies to a different case: A tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. Reverse names provide attribution hints but are not reliable proof of asset ownership. It does not establish the present requirement, where a list of candidate names includes timestamps and ownership verification notes. The relevant evidence is: A list of candidate names includes timestamps and ownership verification notes.