Exam Bundle

This action applies to a different case: A test account can invoke a cloud API because identity policies allow access but an organization policy should deny it. Cloud authorization layers may impose boundaries beyond principal permissions. It does not establish the present requirement, where a function operates without exposing reusable passwords in its configuration. The appropriate action is: Use managed identity or approved secrets references with lifecycle controls.

That approach concerns a different situation: a public artifact repository accepts uploads under a shared build identity with no review process. Unsigned or unauthorized artifacts can contaminate downstream releases. The required result is that a function operates without exposing reusable passwords in its configuration. The appropriate action is: Use managed identity or approved secrets references with lifecycle controls.

That relates to a different issue: A workload pod mounts the host filesystem and runs privileged with no operational need. Weak container isolation increases opportunities for host-level impact. That is not a direct remedy for the requested outcome: A function operates without exposing reusable passwords in its configuration. The appropriate action is: Use managed identity or approved secrets references with lifecycle controls.

That relates to a different issue: An administrator can reach production backups using the same broad privileges as developers. Privilege separation limits destructive access from routine accounts. That is not a direct remedy for the requested outcome: A transferred employee loses old privileges after an approved review. The appropriate action is: Automate role lifecycle reviews and remove unjustified standing grants.

This action applies to a different case: A customer has stale machine account certificates with expired owners. Key and certificate hygiene prevents service interruption and untrusted identity reuse. It does not establish the present requirement, where a transferred employee loses old privileges after an approved review. The appropriate action is: Automate role lifecycle reviews and remove unjustified standing grants.

That approach concerns a different situation: physical testing shows unauthorized visitors can follow staff into a secure data center. Anti-tailgating controls reduce unauthorized physical entry. The required result is that a transferred employee loses old privileges after an approved review. The appropriate action is: Automate role lifecycle reviews and remove unjustified standing grants.

That approach concerns a different situation: a search endpoint concatenates raw query text into SQL statements. Data must not be interpreted as SQL syntax during query construction. The required result is that the finding includes interpreter-level evidence or a qualified unconfirmed status. The appropriate action is: Confirm code path and query semantics in a controlled staging test before claiming SQLi.

That relates to a different issue: A JSON Web Token API accepts tokens with an unexpected algorithm or mismatched audience. JWT validation requires more than decoding a base64 payload. That is not a direct remedy for the requested outcome: The finding includes interpreter-level evidence or a qualified unconfirmed status. The appropriate action is: Confirm code path and query semantics in a controlled staging test before claiming SQLi.

This action applies to a different case: An OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. It does not establish the present requirement, where the finding includes interpreter-level evidence or a qualified unconfirmed status. The appropriate action is: Confirm code path and query semantics in a controlled staging test before claiming SQLi.

This result applies to a different case: An assessment needs an inventory of publicly accessible cloud buckets under the customer's account. Cloud access posture must be confirmed at both resource and data-plane levels. It does not establish the present requirement, where the route list excludes synthetic paths producing identical fallback pages. The relevant evidence is: The route list excludes synthetic paths producing identical fallback pages.

That approach concerns a different situation: a target's apparent firewall gateway presents a branded error page instead of backend responses. Security intermediaries can mask backend versions and path behavior. The required result is that the route list excludes synthetic paths producing identical fallback pages. The relevant evidence is: The route list excludes synthetic paths producing identical fallback pages.

It would address a wireless survey sees several access points broadcasting the same SSID. The relevant reason in that case is: SSID is a network name shared by multiple radios. Here the required success condition is the route list excludes synthetic paths producing identical fallback pages. The relevant evidence is: The route list excludes synthetic paths producing identical fallback pages.

It would address an internal team finds unexpected use of PsExec on an accounting server. The relevant reason in that case is: PsExec-style remote execution creates traceable service and process artifacts. Here the required success condition is only designated management sources can authenticate to SSH. The appropriate action is: Restrict SSH ingress by network and identity authorization.

This action applies to a different case: An analyst observes a new route entry on a test workstation during a suspected pivot. Routing changes can create paths to otherwise isolated hosts. It does not establish the present requirement, where only designated management sources can authenticate to SSH. The appropriate action is: Restrict SSH ingress by network and identity authorization.

That approach concerns a different situation: a file server presents an SMB share writable by an account used across unrelated hosts. Shared writable resources and reused credentials can connect trust zones. The required result is that only designated management sources can authenticate to SSH. The appropriate action is: Restrict SSH ingress by network and identity authorization.

It would address a malicious process appears to send compressed data archives to external cloud storage. The relevant reason in that case is: Compression can stage data for transfer but is not itself proof of theft. Here the required success condition is a synthetic embedded marker is detected in an approved sample image. The relevant evidence is: A synthetic embedded marker is detected in an approved sample image.

This result applies to a different case: A project storage account is shared with an unrelated external cloud account. Cloud-native access may enable transfer without conventional internet downloads. It does not establish the present requirement, where a synthetic embedded marker is detected in an approved sample image. The relevant evidence is: A synthetic embedded marker is detected in an approved sample image.

That approach concerns a different situation: an attacker stages files in a hidden alternate data stream on an NTFS test volume. Alternate streams can hide data outside ordinary visible file content. The required result is that a synthetic embedded marker is detected in an approved sample image. The relevant evidence is: A synthetic embedded marker is detected in an approved sample image.

That relates to a different issue: An assessor wants to use credential spraying although the signed rules prohibit account lockouts. Potential lockouts violate explicit testing restrictions without changed authorization. That is not a direct remedy for the requested outcome: Evidence demonstrates the weakness without elevated load or service downtime. The appropriate action is: Perform non-disruptive validation rather than traffic saturation or resource exhaustion.

It would address operations permits active scans only after midnight, while the tester finds an exposed service in the afternoon. The relevant reason in that case is: Rules of engagement control test timing independently of technical urgency. Here the required success condition is evidence demonstrates the weakness without elevated load or service downtime. The appropriate action is: Perform non-disruptive validation rather than traffic saturation or resource exhaustion.

This action applies to a different case: A production database crashes after low-rate probes during an authorized assessment. Availability risk triggers the agreed stop condition even during permitted work. It does not establish the present requirement, where evidence demonstrates the weakness without elevated load or service downtime. The appropriate action is: Perform non-disruptive validation rather than traffic saturation or resource exhaustion.

This action applies to a different case: An automated scanner reports weak ciphers but the test client proposed unsupported suites. Incorrect scanner handshake behavior can create misleading conclusions. It does not establish the present requirement, where the final inventory reflects access differences for approved roles. The appropriate action is: Use permission-aware retesting before asserting the path is absent.

That approach concerns a different situation: an analyst relies on a CVE record without noting whether the affected function is enabled. Attack prerequisites determine relevance to a specific system. The required result is that the final inventory reflects access differences for approved roles. The appropriate action is: Use permission-aware retesting before asserting the path is absent.

That relates to a different issue: A plugin fails because the scanner host cannot resolve the target hostname. Tool errors are not target security findings. That is not a direct remedy for the requested outcome: The final inventory reflects access differences for approved roles. The appropriate action is: Use permission-aware retesting before asserting the path is absent.

It would address a client wants known public internet hosts indexed by certificate and service metadata. The relevant reason in that case is: Internet-wide indices provide exposure intelligence but not proof of asset ownership. Here the required success condition is the results list module, data source, and retrieval date. The relevant evidence is: The results list module, data source, and retrieval date.

This result applies to a different case: An assessor wants to enumerate external records but cannot use a product requiring active client network contact. Tool mode is more important than product name for scope compliance. It does not establish the present requirement, where the results list module, data source, and retrieval date. The relevant evidence is: The results list module, data source, and retrieval date.

That relates to a different issue: The engagement needs a passive mapping of email addresses published on customer sites. Public email discovery can reveal exposed identifiers without authentication. That is not a direct remedy for the requested outcome: The results list module, data source, and retrieval date. The relevant evidence is: The results list module, data source, and retrieval date.

That relates to a different issue: A test team needs a reusable OSINT collection workflow across public providers. A framework can automate repeatable public-data collection with source controls. That is not a direct remedy for the requested outcome: The report contains only approved public mailbox patterns. The appropriate action is: Use theHarvester within privacy and source restrictions.

It would address a test team has a PCAP but needs only a brief view of a suspicious DNS exchange. The relevant reason in that case is: Capture filters reduce noise while retaining original evidence. Here the required success condition is the report contains only approved public mailbox patterns. The appropriate action is: Use theHarvester within privacy and source restrictions.

That approach concerns a different situation: an authorized tester needs a bounded inventory of listening TCP services across specific approved hosts. Nmap supports controlled host and service discovery in an agreed scope. The required result is that the report contains only approved public mailbox patterns. The appropriate action is: Use theHarvester within privacy and source restrictions.

That approach concerns a different situation: a perimeter scanner reports only accessible services despite many privately hosted backend applications. An external scan cannot claim coverage of unreachable systems. The required result is that the output maps approved radios to their channels and signal levels. The appropriate action is: Perform a nontransmitting wireless site survey and record signal strength.

That relates to a different issue: A production application uses a library with an outdated version, but the build is opaque. A reliable component inventory is needed before asserting specific package risk. That is not a direct remedy for the requested outcome: The output maps approved radios to their channels and signal levels. The appropriate action is: Perform a nontransmitting wireless site survey and record signal strength.

It would address a vulnerability analyst needs to assess a publicly reachable web server's unsafe headers and default files. The relevant reason in that case is: Web configuration assessment targets service weaknesses distinct from full code review. Here the required success condition is the output maps approved radios to their channels and signal levels. The appropriate action is: Perform a nontransmitting wireless site survey and record signal strength.