Exam Bundle

That relates to a different issue: A security team asks whether public profile data exposes names and organizational roles of privileged employees. Public role disclosures can inform social-engineering exposure without active contact. That is not a direct remedy for the requested outcome: A list of candidate names includes timestamps and ownership verification notes. The relevant evidence is: A list of candidate names includes timestamps and ownership verification notes.

It would address a cloud team worries that an old object storage endpoint is indexed in search results. The relevant reason in that case is: Search indices can disclose public paths even after application navigation changes. Here the required success condition is a list of candidate names includes timestamps and ownership verification notes. The relevant evidence is: A list of candidate names includes timestamps and ownership verification notes.

This result applies to a different case: A tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. Reverse names provide attribution hints but are not reliable proof of asset ownership. It does not establish the present requirement, where a list of candidate names includes timestamps and ownership verification notes. The relevant evidence is: A list of candidate names includes timestamps and ownership verification notes.

This result applies to a different case: An AI assistant retrieves an untrusted web page that contains instructions to send private documents. Untrusted source data must not gain authority over tool operations. It does not establish the present requirement, where the controlled bench denies or detects unapproved control frames. The relevant evidence is: The controlled bench denies or detects unapproved control frames.

That relates to a different issue: A factory PLC accepts unauthenticated writes to process registers on a lab Modbus network. Legacy industrial protocols may not enforce message authorization. That is not a direct remedy for the requested outcome: The controlled bench denies or detects unapproved control frames. The relevant evidence is: The controlled bench denies or detects unapproved control frames.

It would address a point-of-sale device accepts unauthorized NFC interactions beyond its intended payment protocol. The relevant reason in that case is: Short-range communication still requires application-level authorization. Here the required success condition is the controlled bench denies or detects unapproved control frames. The relevant evidence is: The controlled bench denies or detects unapproved control frames.

This result applies to a different case: An assessment finds a web service protected by a WAF that blocks many scanner patterns. WAF responses can mask vulnerabilities and reduce scan completeness. It does not establish the present requirement, where the results classify code flaws separately from platform configuration. The relevant evidence is: The results classify code flaws separately from platform configuration.

That approach concerns a different situation: a team wants to detect weak API authorization in a running staging application. DAST evaluates behavior from the application's external interface. The required result is that the results classify code flaws separately from platform configuration. The relevant evidence is: The results classify code flaws separately from platform configuration.

That relates to a different issue: A small wireless network has neighboring SSIDs that must not be included in the client's assessment. SSID alone does not establish radio identity or scope ownership. That is not a direct remedy for the requested outcome: The results classify code flaws separately from platform configuration. The relevant evidence is: The results classify code flaws separately from platform configuration.

That relates to a different issue: A lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. Scheduled execution can restore a foothold without an interactive login. That is not a direct remedy for the requested outcome: Controlled logs correlate agent identifier and scheduled check-in intervals. The appropriate action is: Identify beaconing as command-and-control communication in the permitted exercise.

It would address a browser profile repeatedly reconnects to a suspicious host after the user closes all tabs. The relevant reason in that case is: Browser extensions can persist and run with user browsing context. Here the required success condition is controlled logs correlate agent identifier and scheduled check-in intervals. The appropriate action is: Identify beaconing as command-and-control communication in the permitted exercise.

That approach concerns a different situation: a Linux test host launches an unknown script daily from a root crontab. Cron entries provide recurring execution independent of user sessions. The required result is that controlled logs correlate agent identifier and scheduled check-in intervals. The appropriate action is: Identify beaconing as command-and-control communication in the permitted exercise.

That relates to a different issue: A web application's LDAP filter directly concatenates a username field. Unescaped filter meta-characters can alter directory query meaning. That is not a direct remedy for the requested outcome: An anonymous test query returns only approved public attributes. The relevant evidence is: An anonymous test query returns only approved public attributes.

It would address a privileged account can bypass MFA when authenticating through a legacy protocol. The relevant reason in that case is: Strong interactive MFA is undermined by weaker alternate sign-in routes. Here the required success condition is an anonymous test query returns only approved public attributes. The relevant evidence is: An anonymous test query returns only approved public attributes.

This result applies to a different case: A lab's Kerberos service accounts use weak reusable secrets with no rotation plan. Weak long-lived service account credentials expand ticket abuse risk. It does not establish the present requirement, where an anonymous test query returns only approved public attributes. The relevant evidence is: An anonymous test query returns only approved public attributes.

This result applies to a different case: A telephone caller impersonates a helpdesk employee and demands a one-time authentication code. Voice pretexts can solicit secrets or bypass verification procedures. It does not establish the present requirement, where a controlled visitor is challenged before entering restricted areas. The relevant evidence is: A controlled visitor is challenged before entering restricted areas.

That approach concerns a different situation: a tester proposes scraping discarded sensitive papers from an office dumpster after physical scope ended. Dumpster diving is physical reconnaissance and is not implied by web authorization. The required result is that a controlled visitor is challenged before entering restricted areas. The relevant evidence is: A controlled visitor is challenged before entering restricted areas.

That relates to a different issue: A security team wants to evaluate whether staff report suspicious phone calls instead of obeying them. Social testing measures human response while protecting staff privacy and safety. That is not a direct remedy for the requested outcome: A controlled visitor is challenged before entering restricted areas. The relevant evidence is: A controlled visitor is challenged before entering restricted areas.

It would address an analyst sees a high CVSS issue on an isolated lab host and a lower-scored actively exploited issue on a public gateway. The relevant reason in that case is: CVSS alone omits environmental and current threat context. Here the required success condition is the finding is supported by real asset configuration and scope evidence. The appropriate action is: Verify deployment existence and reachable attack prerequisites.

This action applies to a different case: A scheduled assessment identifies fewer hosts than last month, but subnet routing has changed. Fewer findings may indicate lost visibility, not improved security. It does not establish the present requirement, where the finding is supported by real asset configuration and scope evidence. The appropriate action is: Verify deployment existence and reachable attack prerequisites.

That relates to a different issue: A scanner detects a self-signed certificate on a test-only internal service. A self-signed certificate can be appropriate in controlled trust contexts. That is not a direct remedy for the requested outcome: The finding is supported by real asset configuration and scope evidence. The appropriate action is: Verify deployment existence and reachable attack prerequisites.

That relates to a different issue: An app asks for contact-list access even though the business feature uses only a camera. Unnecessary mobile permissions expand sensitive data exposure. That is not a direct remedy for the requested outcome: A synthetic malicious document cannot trigger an unauthorized export. The appropriate action is: Identify prompt injection and enforce separation of retrieved content from trusted instructions.

It would address nearby phones receive unsolicited Bluetooth messages from an unknown device. The relevant reason in that case is: Unsolicited proximity-based messages do not require classic network compromise. Here the required success condition is a synthetic malicious document cannot trigger an unauthorized export. The appropriate action is: Identify prompt injection and enforce separation of retrieved content from trusted instructions.

That approach concerns a different situation: a production OT controller uses plaintext commands, but safety rules prohibit live command injection. Unencrypted industrial traffic can reveal operations while active tests create safety risk. The required result is that a synthetic malicious document cannot trigger an unauthorized export. The appropriate action is: Identify prompt injection and enforce separation of retrieved content from trusted instructions.

That approach concerns a different situation: a tester needs an ownership hint for a domain's registration and delegated name servers. Registration metadata may identify contacts and service providers. The required result is that a filter returns the expected DNS conversations from the immutable capture. The relevant evidence is: A filter returns the expected DNS conversations from the immutable capture.

That relates to a different issue: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. That is not a direct remedy for the requested outcome: A filter returns the expected DNS conversations from the immutable capture. The relevant evidence is: A filter returns the expected DNS conversations from the immutable capture.

It would address a research team needs to inspect whether a host has unsafe publicly disclosed service banners. The relevant reason in that case is: NSE has scripts with varied impact; safe category selection matters. Here the required success condition is a filter returns the expected DNS conversations from the immutable capture. The relevant evidence is: A filter returns the expected DNS conversations from the immutable capture.

This action applies to a different case: A tester selects an attack tool because it is familiar, not because it matches target protocol. Tool choice should be threat-led and technically appropriate. It does not establish the present requirement, where the attack plan avoids unapproved availability or containment events. The appropriate action is: Select a lower-impact demonstration compatible with the agreed rules.

That approach concerns a different situation: a customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. The required result is that the attack plan avoids unapproved availability or containment events. The appropriate action is: Select a lower-impact demonstration compatible with the agreed rules.

That relates to a different issue: An assessment uses only a CVSS number to estimate the likelihood of active exploitation. EPSS estimates exploitation likelihood rather than vulnerability impact. That is not a direct remedy for the requested outcome: The attack plan avoids unapproved availability or containment events. The appropriate action is: Select a lower-impact demonstration compatible with the agreed rules.

It would address a 24-hour assessment has only a two-hour approved production change window for exploitation. The relevant reason in that case is: Operational windows may differ by activity and production sensitivity. Here the required success condition is the test record flags the asset as excluded and records the owner's decision. The appropriate action is: Hold testing against the resolved out-of-range address and seek scope clarification.

This action applies to a different case: A production database crashes after low-rate probes during an authorized assessment. Availability risk triggers the agreed stop condition even during permitted work. It does not establish the present requirement, where the test record flags the asset as excluded and records the owner's decision. The appropriate action is: Hold testing against the resolved out-of-range address and seek scope clarification.

That approach concerns a different situation: a signed asset list contains both public DNS names and a private VPN address range. Identifiers describe scope but DNS mappings and ownership can change. The required result is that the test record flags the asset as excluded and records the owner's decision. The appropriate action is: Hold testing against the resolved out-of-range address and seek scope clarification.