Exam Bundle

That approach concerns a different situation: a malicious process appears to send compressed data archives to external cloud storage. Compression can stage data for transfer but is not itself proof of theft. The required result is that the investigation documents contextual evidence for the final classification. The relevant evidence is: The investigation documents contextual evidence for the final classification.

That relates to a different issue: An application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. Encrypted transport can conceal unauthorized data transfer. That is not a direct remedy for the requested outcome: The investigation documents contextual evidence for the final classification. The relevant evidence is: The investigation documents contextual evidence for the final classification.

It would address a compromised process uses a covert channel but the defender has only firewall allow/deny logs. The relevant reason in that case is: Allowed protocols may still carry anomalous information. Here the required success condition is the investigation documents contextual evidence for the final classification. The relevant evidence is: The investigation documents contextual evidence for the final classification.

This result applies to a different case: A Linux container image should be checked against known CVE advisory databases. Image scanners map packaged components to known vulnerability records. It does not establish the present requirement, where the audit lists sanitized token findings and confirmed revocation status. The relevant evidence is: The audit lists sanitized token findings and confirmed revocation status.

That relates to a different issue: A small wireless network has neighboring SSIDs that must not be included in the client's assessment. SSID alone does not establish radio identity or scope ownership. That is not a direct remedy for the requested outcome: The audit lists sanitized token findings and confirmed revocation status. The relevant evidence is: The audit lists sanitized token findings and confirmed revocation status.

It would address a vulnerability analyst needs to assess a publicly reachable web server's unsafe headers and default files. The relevant reason in that case is: Web configuration assessment targets service weaknesses distinct from full code review. Here the required success condition is the audit lists sanitized token findings and confirmed revocation status. The relevant evidence is: The audit lists sanitized token findings and confirmed revocation status.

It would address a team wants to correlate results from Bash, Python, and PowerShell utilities. The relevant reason in that case is: Consistent output fields support reproducible, attributable analysis. Here the required success condition is a fixture with missing fields completes and marks the value unknown. The appropriate action is: Guard optional lookups and use a documented default or unknown value.

That approach concerns a different situation: a Python reconnaissance script stops after the first page of API results. APIs commonly limit each response and require explicit continuation. The required result is that a fixture with missing fields completes and marks the value unknown. The appropriate action is: Guard optional lookups and use a documented default or unknown value.

That relates to a different issue: A Bash parser confuses space-delimited columns when service banners include spaces. Human-readable tool output is unsafe as an implicit fixed-column schema. That is not a direct remedy for the requested outcome: A fixture with missing fields completes and marks the value unknown. The appropriate action is: Guard optional lookups and use a documented default or unknown value.

That relates to a different issue: An automated scanner reports weak ciphers but the test client proposed unsupported suites. Incorrect scanner handshake behavior can create misleading conclusions. That is not a direct remedy for the requested outcome: The recommendation states the evidence behind the risk adjustment. The appropriate action is: Combine observed exposure, exploitation evidence, and business criticality in prioritization.

This action applies to a different case: A host reports UDP ports as open-or-filtered and the analyst marks them definitely exploitable. Silence does not prove a UDP listener exists. It does not establish the present requirement, where the recommendation states the evidence behind the risk adjustment. The appropriate action is: Combine observed exposure, exploitation evidence, and business criticality in prioritization.

That approach concerns a different situation: a scanner's authenticated credential was disabled during the test with no alert in the output summary. Credentials can silently fail and create false negative coverage. The required result is that the recommendation states the evidence behind the risk adjustment. The appropriate action is: Combine observed exposure, exploitation evidence, and business criticality in prioritization.

That relates to a different issue: A security team asks whether public profile data exposes names and organizational roles of privileged employees. Public role disclosures can inform social-engineering exposure without active contact. That is not a direct remedy for the requested outcome: The report labels technology inferences as unconfirmed until supported by other evidence. The appropriate action is: Review job postings as passive technology intelligence and corroborate findings.

It would address a client wants the passive discovery of hosts from public certificate names and DNS records. The relevant reason in that case is: Multiple passive sources reduce the chance of relying on a stale artifact. Here the required success condition is the report labels technology inferences as unconfirmed until supported by other evidence. The appropriate action is: Review job postings as passive technology intelligence and corroborate findings.

This action applies to a different case: A cloud team worries that an old object storage endpoint is indexed in search results. Search indices can disclose public paths even after application navigation changes. It does not establish the present requirement, where the report labels technology inferences as unconfirmed until supported by other evidence. The appropriate action is: Review job postings as passive technology intelligence and corroborate findings.

That approach concerns a different situation: a model endpoint outputs confidential training examples when prompted with generic cues. Model behavior can expose sensitive memorized data. The required result is that the test handset blocks unapproved messages while normal pairing works. The relevant evidence is: The test handset blocks unapproved messages while normal pairing works.

That relates to a different issue: A testing team uses Mobile Security Framework to inspect a permitted app package. Mobile-focused tooling identifies application configuration and code issues. That is not a direct remedy for the requested outcome: The test handset blocks unapproved messages while normal pairing works. The relevant evidence is: The test handset blocks unapproved messages while normal pairing works.

It would address a security engineer needs to inspect BLE advertising data for an approved IoT sensor. The relevant reason in that case is: Bluetooth advertisement fields can disclose device information passively. Here the required success condition is the test handset blocks unapproved messages while normal pairing works. The relevant evidence is: The test handset blocks unapproved messages while normal pairing works.

It would address a threat model asks which category covers an attacker changing stored invoice values. The relevant reason in that case is: STRIDE describes six threat classes, including unauthorized modification. Here the required success condition is each emulated behavior has an accurate ATT&CK technique and observed detection. The appropriate action is: Map test actions to MITRE ATT&CK tactics and techniques.

This action applies to a different case: A client wants a recognized penetration-testing service accreditation model. CREST provides professional testing standards and assurance mechanisms. It does not establish the present requirement, where each emulated behavior has an accurate ATT&CK technique and observed detection. The appropriate action is: Map test actions to MITRE ATT&CK tactics and techniques.

That relates to a different issue: A web application team wants a prioritized list of common application security risk categories. OWASP Top 10 groups frequent web application security risks. That is not a direct remedy for the requested outcome: Each emulated behavior has an accurate ATT&CK technique and observed detection. The appropriate action is: Map test actions to MITRE ATT&CK tactics and techniques.

That relates to a different issue: An internal admin portal accepts a password alone for privileged access. Strong second-factor binding reduces credential theft and replay risk. That is not a direct remedy for the requested outcome: The server reports the fixed version and the prior finding no longer reproduces. The relevant evidence is: The server reports the fixed version and the prior finding no longer reproduces.

It would address a staff member can plug unknown USB devices into a sensitive workstation. The relevant reason in that case is: Technical device restrictions supplement awareness training. Here the required success condition is the server reports the fixed version and the prior finding no longer reproduces. The relevant evidence is: The server reports the fixed version and the prior finding no longer reproduces.

That approach concerns a different situation: a testing team finds a public storage share containing unencrypted customer exports. Access control and cryptography address separate disclosure paths. The required result is that the server reports the fixed version and the prior finding no longer reproduces. The relevant evidence is: The server reports the fixed version and the prior finding no longer reproduces.

That approach concerns a different situation: an internal application requires a comparison of its dependencies before and after a release. Changed packages alter exposure even if application source appears unchanged. The required result is that the graph identifies a documented misconfigured permission chain. The relevant evidence is: The graph identifies a documented misconfigured permission chain.

That relates to a different issue: A test engineer wishes to find vulnerable applications in managed serverless services. Serverless resources lack direct host scanning but still have code and identity risks. That is not a direct remedy for the requested outcome: The graph identifies a documented misconfigured permission chain. The relevant evidence is: The graph identifies a documented misconfigured permission chain.

It would address an analyst must assess an ICS network that lacks safe active vulnerability scanning windows. The relevant reason in that case is: Live probing can create safety and availability risk to industrial equipment. Here the required success condition is the graph identifies a documented misconfigured permission chain. The relevant evidence is: The graph identifies a documented misconfigured permission chain.

This result applies to a different case: A user enumeration test sees different errors for existing and nonexistent accounts. Authentication responses can leak account existence even when login fails. It does not establish the present requirement, where the survey distinguishes radios by BSSID and frequency. The relevant evidence is: The survey distinguishes radios by BSSID and frequency.

That approach concerns a different situation: a public application exposes an API descriptor that lists endpoints not reachable by the standard UI. API documentation can reveal functionality but does not establish exploitability. The required result is that the survey distinguishes radios by BSSID and frequency. The relevant evidence is: The survey distinguishes radios by BSSID and frequency.

It would address an office Wi-Fi assessment records a strong signal from a neighbor-owned access point. The relevant reason in that case is: Physical proximity does not establish authorization to test a wireless asset. Here the required success condition is the survey distinguishes radios by BSSID and frequency. The relevant evidence is: The survey distinguishes radios by BSSID and frequency.

This action applies to a different case: A test account can invoke a cloud API because identity policies allow access but an organization policy should deny it. Cloud authorization layers may impose boundaries beyond principal permissions. It does not establish the present requirement, where a function operates without exposing reusable passwords in its configuration. The appropriate action is: Use managed identity or approved secrets references with lifecycle controls.

That approach concerns a different situation: a public artifact repository accepts uploads under a shared build identity with no review process. Unsigned or unauthorized artifacts can contaminate downstream releases. The required result is that a function operates without exposing reusable passwords in its configuration. The appropriate action is: Use managed identity or approved secrets references with lifecycle controls.

That relates to a different issue: A workload pod mounts the host filesystem and runs privileged with no operational need. Weak container isolation increases opportunities for host-level impact. That is not a direct remedy for the requested outcome: A function operates without exposing reusable passwords in its configuration. The appropriate action is: Use managed identity or approved secrets references with lifecycle controls.