Exam Bundle

It would address a test team needs a reusable OSINT collection workflow across public providers. The relevant reason in that case is: A framework can automate repeatable public-data collection with source controls. Here the required success condition is only permitted public addresses or patterns appear in the output. The relevant evidence is: Only permitted public addresses or patterns appear in the output.

This result applies to a different case: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. It does not establish the present requirement, where only permitted public addresses or patterns appear in the output. The relevant evidence is: Only permitted public addresses or patterns appear in the output.

That approach concerns a different situation: a tester needs to analyze 802.11 management frames from an authorized lab capture. Wireless tooling can inspect captures separately from active disruption. The required result is that only permitted public addresses or patterns appear in the output. The relevant evidence is: Only permitted public addresses or patterns appear in the output.

That relates to a different issue: A cloud project has a cross-account role trust that permits principals outside the expected partner organization. Cross-account trust can expand reach beyond intended organizational boundaries. That is not a direct remedy for the requested outcome: The integration performs required tasks without global administrative access. The relevant evidence is: The integration performs required tasks without global administrative access.

This result applies to a different case: A test account can invoke a cloud API because identity policies allow access but an organization policy should deny it. Cloud authorization layers may impose boundaries beyond principal permissions. It does not establish the present requirement, where the integration performs required tasks without global administrative access. The relevant evidence is: The integration performs required tasks without global administrative access.

That approach concerns a different situation: a workload pod mounts the host filesystem and runs privileged with no operational need. Weak container isolation increases opportunities for host-level impact. The required result is that the integration performs required tasks without global administrative access. The relevant evidence is: The integration performs required tasks without global administrative access.

That relates to a different issue: A service sends files to an external mailbox instead of a sanctioned business archive. Email offers a familiar outbound path that may bypass specialized DLP controls. That is not a direct remedy for the requested outcome: A separate synthetic account is denied access after the grant is removed. The appropriate action is: Review cross-account resource grants and remove unauthorized destinations.

It would address an application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. The relevant reason in that case is: Encrypted transport can conceal unauthorized data transfer. Here the required success condition is a separate synthetic account is denied access after the grant is removed. The appropriate action is: Review cross-account resource grants and remove unauthorized destinations.

This action applies to a different case: A penetration tester wants to prove data exfiltration but the contract forbids copying personal information. Exfiltration tests should avoid moving real sensitive client content. It does not establish the present requirement, where a separate synthetic account is denied access after the grant is removed. The appropriate action is: Review cross-account resource grants and remove unauthorized destinations.

This action applies to a different case: A client wants a Mimikatz demonstration but its authorization excludes any extraction of live credentials. Credential tools can expose sensitive data beyond the intended objective. It does not establish the present requirement, where the lab confirms only authorized maintainers can edit the scheduled file. The appropriate action is: Report the privileged scheduled-task trust boundary and remove unsafe write rights.

That relates to a different issue: A sandboxed application allows launching an unrestricted terminal through a helper menu. Process spawning can bypass an application's intended restricted environment. That is not a direct remedy for the requested outcome: The lab confirms only authorized maintainers can edit the scheduled file. The appropriate action is: Report the privileged scheduled-task trust boundary and remove unsafe write rights.

It would address a security agent is disabled by an ordinary user with local permissions. The relevant reason in that case is: Endpoint safeguards must resist unauthorized security-control changes. Here the required success condition is the lab confirms only authorized maintainers can edit the scheduled file. The appropriate action is: Report the privileged scheduled-task trust boundary and remove unsafe write rights.

It would address a service accepts a filename that resolves through a symlink to a protected system path. The relevant reason in that case is: Text-based path checks can be bypassed by filesystem indirection. Here the required success condition is synthetic known and unknown accounts receive comparable public responses. The appropriate action is: Normalize public responses and apply consistent timing/rate safeguards.

That approach concerns a different situation: a plugin upload endpoint permits executable scripts to be stored inside a public web root. File upload handling must prevent attacker-controlled server-side execution. The required result is that synthetic known and unknown accounts receive comparable public responses. The appropriate action is: Normalize public responses and apply consistent timing/rate safeguards.

That relates to a different issue: An OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. That is not a direct remedy for the requested outcome: Synthetic known and unknown accounts receive comparable public responses. The appropriate action is: Normalize public responses and apply consistent timing/rate safeguards.

That relates to a different issue: An authorized lab needs to test data staging without triggering production record changes. Controlled artifacts allow measurement of transfer behavior without real data exposure. That is not a direct remedy for the requested outcome: The test records show exactly the permitted data volume. The appropriate action is: Use an approved minimal canary file within the specified byte limit.

It would address a data movement alert reports a compressed archive but its creation may belong to normal backups. The relevant reason in that case is: Legitimate backups also compress and move files. Here the required success condition is the test records show exactly the permitted data volume. The appropriate action is: Use an approved minimal canary file within the specified byte limit.

That approach concerns a different situation: a service sends files to an external mailbox instead of a sanctioned business archive. Email offers a familiar outbound path that may bypass specialized DLP controls. The required result is that the test records show exactly the permitted data volume. The appropriate action is: Use an approved minimal canary file within the specified byte limit.

That approach concerns a different situation: a team wants to correlate results from Bash, Python, and PowerShell utilities. Consistent output fields support reproducible, attributable analysis. The required result is that the source contains no reusable password and test authentication still works. The appropriate action is: Replace the inline secret with approved protected credential retrieval.

That relates to a different issue: A PowerShell script exports internal usernames to a publicly writable diagnostics folder. Recon output can expose sensitive client information beyond the testing system. That is not a direct remedy for the requested outcome: The source contains no reusable password and test authentication still works. The appropriate action is: Replace the inline secret with approved protected credential retrieval.

This action applies to a different case: A script retries failed probes indefinitely when an endpoint is unavailable. Retry storms can cause avoidable service impact and unreliable results. It does not establish the present requirement, where the source contains no reusable password and test authentication still works. The appropriate action is: Replace the inline secret with approved protected credential retrieval.

This result applies to a different case: A wireless network allows unauthenticated access to sensitive IoT controls via an isolated SSID. Wireless network names do not enforce data-plane isolation. It does not establish the present requirement, where the access point no longer permits PIN-based enrollment. The relevant evidence is: The access point no longer permits PIN-based enrollment.

That approach concerns a different situation: a company finds a rogue access point advertising the same SSID as its legitimate Wi-Fi. Impersonated wireless infrastructure can redirect or harvest client connections. The required result is that the access point no longer permits PIN-based enrollment. The relevant evidence is: The access point no longer permits PIN-based enrollment.

That relates to a different issue: A wireless sensor records repeated malformed management frames near a permitted client test area. Malformed frames can stress wireless implementations. That is not a direct remedy for the requested outcome: The access point no longer permits PIN-based enrollment. The relevant evidence is: The access point no longer permits PIN-based enrollment.

It would address a team wants an assessment of a Kubernetes cluster while its production workloads cannot tolerate attack simulation. The relevant reason in that case is: Kubernetes posture assessment can identify weak RBAC and workloads without disrupting them. Here the required success condition is the report explains added and removed affected components by build. The relevant evidence is: The report explains added and removed affected components by build.

This result applies to a different case: An IoT controller is sensitive to unexpected network packets during a vulnerability assessment. Industrial and embedded systems can fail under ordinary IT scan traffic. It does not establish the present requirement, where the report explains added and removed affected components by build. The relevant evidence is: The report explains added and removed affected components by build.

That relates to a different issue: An application repository could contain command-construction flaws before deployment. SAST analyzes source patterns without requiring a running app. That is not a direct remedy for the requested outcome: The report explains added and removed affected components by build. The relevant evidence is: The report explains added and removed affected components by build.

It would address an app downloads files based on a path parameter that accepts parent-directory components. The relevant reason in that case is: Path normalization and authorization must prevent escaping a file root. Here the required success condition is an unauthorized method receives an appropriate rejection. The appropriate action is: Allowlist intended methods and verify authorization per method.

This action applies to a different case: A customer message displays unsanitized HTML that executes inside another user's browser. Untrusted content can cross the browser's code/data boundary. It does not establish the present requirement, where an unauthorized method receives an appropriate rejection. The appropriate action is: Allowlist intended methods and verify authorization per method.

That approach concerns a different situation: a web scanner claims SQL injection because a quote produces an HTTP 500 response. Generic server errors do not prove attacker-controlled SQL execution. The required result is that an unauthorized method receives an appropriate rejection. The appropriate action is: Allowlist intended methods and verify authorization per method.

That approach concerns a different situation: a malicious process appears to send compressed data archives to external cloud storage. Compression can stage data for transfer but is not itself proof of theft. The required result is that the investigation documents contextual evidence for the final classification. The relevant evidence is: The investigation documents contextual evidence for the final classification.

That relates to a different issue: An application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. Encrypted transport can conceal unauthorized data transfer. That is not a direct remedy for the requested outcome: The investigation documents contextual evidence for the final classification. The relevant evidence is: The investigation documents contextual evidence for the final classification.

It would address a compromised process uses a covert channel but the defender has only firewall allow/deny logs. The relevant reason in that case is: Allowed protocols may still carry anomalous information. Here the required success condition is the investigation documents contextual evidence for the final classification. The relevant evidence is: The investigation documents contextual evidence for the final classification.