Exam Bundle

That approach concerns a different situation: a perimeter scanner reports only accessible services despite many privately hosted backend applications. An external scan cannot claim coverage of unreachable systems. The required result is that the output maps approved radios to their channels and signal levels. The appropriate action is: Perform a nontransmitting wireless site survey and record signal strength.

That relates to a different issue: A production application uses a library with an outdated version, but the build is opaque. A reliable component inventory is needed before asserting specific package risk. That is not a direct remedy for the requested outcome: The output maps approved radios to their channels and signal levels. The appropriate action is: Perform a nontransmitting wireless site survey and record signal strength.

It would address a vulnerability analyst needs to assess a publicly reachable web server's unsafe headers and default files. The relevant reason in that case is: Web configuration assessment targets service weaknesses distinct from full code review. Here the required success condition is the output maps approved radios to their channels and signal levels. The appropriate action is: Perform a nontransmitting wireless site survey and record signal strength.

This action applies to a different case: A PowerShell script exports internal usernames to a publicly writable diagnostics folder. Recon output can expose sensitive client information beyond the testing system. It does not establish the present requirement, where the report labels timeout results as uncertain rather than closed. The appropriate action is: Handle timeout and refusal as separate states in its result parser.

That relates to a different issue: A shell script checks whether a discovered address is inside a permitted CIDR range using string prefixes. Textual prefix matching is not correct network arithmetic. That is not a direct remedy for the requested outcome: The report labels timeout results as uncertain rather than closed. The appropriate action is: Handle timeout and refusal as separate states in its result parser.

It would address a PowerShell lookup script hard-codes a client password in its source file. The relevant reason in that case is: Hard-coded secrets can leak through code repositories and logs. Here the required success condition is the report labels timeout results as uncertain rather than closed. The appropriate action is: Handle timeout and refusal as separate states in its result parser.

It would address a public Git repository contains a historical path resembling a cloud access key. The relevant reason in that case is: Source histories can retain credentials removed from current file versions. Here the required success condition is the finding contains redacted exposure proof and no unauthorized sign-ins. The appropriate action is: Report the exposure and avoid attempting unapproved credential reuse.

That approach concerns a different situation: a security team asks whether public profile data exposes names and organizational roles of privileged employees. Public role disclosures can inform social-engineering exposure without active contact. The required result is that the finding contains redacted exposure proof and no unauthorized sign-ins. The appropriate action is: Report the exposure and avoid attempting unapproved credential reuse.

That relates to a different issue: A client wants to discover previously published but now removed endpoint documentation. Web caches may preserve older public information no longer linked. That is not a direct remedy for the requested outcome: The finding contains redacted exposure proof and no unauthorized sign-ins. The appropriate action is: Report the exposure and avoid attempting unapproved credential reuse.

That relates to a different issue: A lab connection initiated from a controlled host stays available through outbound egress. Reverse shells initiate the control connection from the compromised host. That is not a direct remedy for the requested outcome: Controlled logs correlate agent identifier and scheduled check-in intervals. The relevant evidence is: Controlled logs correlate agent identifier and scheduled check-in intervals.

This result applies to a different case: A web server begins making outbound connections even after the original test session ends. Server-side scripts can maintain remote control outside initial access. It does not establish the present requirement, where controlled logs correlate agent identifier and scheduled check-in intervals. The relevant evidence is: Controlled logs correlate agent identifier and scheduled check-in intervals.

That approach concerns a different situation: a lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. Scheduled execution can restore a foothold without an interactive login. The required result is that controlled logs correlate agent identifier and scheduled check-in intervals. The relevant evidence is: Controlled logs correlate agent identifier and scheduled check-in intervals.

That approach concerns a different situation: a switch port is configured to accept tags from an untrusted endpoint. Incorrect trunk or native VLAN settings can break intended network segregation. The required result is that the assessment record shows a vetted safe test or explicit deferral. The relevant evidence is: The assessment record shows a vetted safe test or explicit deferral.

That relates to a different issue: A network appliance's HTTP admin login is open on a management VLAN shared with guests. Guest-to-admin reachability increases risk irrespective of password strength. That is not a direct remedy for the requested outcome: The assessment record shows a vetted safe test or explicit deferral. The relevant evidence is: The assessment record shows a vetted safe test or explicit deferral.

This result applies to a different case: A client asks whether Netcat or Nmap is better for a quick in-scope service handshake versus mapping many ports. Tool function must match whether the goal is a single connection or discovery. It does not establish the present requirement, where the assessment record shows a vetted safe test or explicit deferral. The relevant evidence is: The assessment record shows a vetted safe test or explicit deferral.

This result applies to a different case: A client shares a URL containing a deep path but excludes the administrative console on the same host. URL-level exclusions can narrow a host-level test authorization. It does not establish the present requirement, where the evidence sample is redacted and securely transferred to the named contact. The relevant evidence is: The evidence sample is redacted and securely transferred to the named contact.

That relates to a different issue: A cloud customer expects a penetration tester to patch provider-managed hypervisor vulnerabilities. The infrastructure provider retains responsibility for managed platform layers. That is not a direct remedy for the requested outcome: The evidence sample is redacted and securely transferred to the named contact. The relevant evidence is: The evidence sample is redacted and securely transferred to the named contact.

It would address an authorized tester is invited to inspect an adjacent subsidiary that is absent from the signed contract. The relevant reason in that case is: Corporate affiliation does not automatically extend scoped legal permission. Here the required success condition is the evidence sample is redacted and securely transferred to the named contact. The relevant evidence is: The evidence sample is redacted and securely transferred to the named contact.

This result applies to a different case: A tester is given permission to assess one management jump host but finds cached connections to other clients. Existing routes or credentials cannot grant authorization over unrelated customers. It does not establish the present requirement, where the access graph no longer includes the unnecessary database grant. The relevant evidence is: The access graph no longer includes the unnecessary database grant.

That approach concerns a different situation: an approved lab account accesses a second Windows host using a remote service management channel. Valid credentials and remote management can bridge compromised systems. The required result is that the access graph no longer includes the unnecessary database grant. The relevant evidence is: The access graph no longer includes the unnecessary database grant.

That relates to a different issue: A host contains a copy of a credential dump but the tester is not authorized to open real user secrets. Credential dumps can enable lateral access but are sensitive forensic evidence. That is not a direct remedy for the requested outcome: The access graph no longer includes the unnecessary database grant. The relevant evidence is: The access graph no longer includes the unnecessary database grant.

That relates to a different issue: A security agent is disabled by an ordinary user with local permissions. Endpoint safeguards must resist unauthorized security-control changes. That is not a direct remedy for the requested outcome: An unprivileged lab user can modify only the unsafe path in a controlled test. The relevant evidence is: An unprivileged lab user can modify only the unsafe path in a controlled test.

It would address a Windows application runs from a writable directory but claims its installer is signed. The relevant reason in that case is: Signed installers do not guarantee continued integrity after deployment. Here the required success condition is an unprivileged lab user can modify only the unsafe path in a controlled test. The relevant evidence is: An unprivileged lab user can modify only the unsafe path in a controlled test.

This result applies to a different case: A Windows endpoint uses an overly broad service account that can install services on many servers. Service creation rights can enable privileged code execution. It does not establish the present requirement, where an unprivileged lab user can modify only the unsafe path in a controlled test. The relevant evidence is: An unprivileged lab user can modify only the unsafe path in a controlled test.

That approach concerns a different situation: a production OT controller uses plaintext commands, but safety rules prohibit live command injection. Unencrypted industrial traffic can reveal operations while active tests create safety risk. The required result is that an unrelated synthetic NFC tag cannot trigger privileged behavior. The relevant evidence is: An unrelated synthetic NFC tag cannot trigger privileged behavior.

It would address a factory PLC accepts unauthenticated writes to process registers on a lab Modbus network. The relevant reason in that case is: Legacy industrial protocols may not enforce message authorization. Here the required success condition is an unrelated synthetic NFC tag cannot trigger privileged behavior. The relevant evidence is: An unrelated synthetic NFC tag cannot trigger privileged behavior.

This result applies to a different case: A mobile app behaves differently when installed on a rooted or jailbroken test phone. Rooting removes some platform isolation guarantees and changes test conditions. It does not establish the present requirement, where an unrelated synthetic NFC tag cannot trigger privileged behavior. The relevant evidence is: An unrelated synthetic NFC tag cannot trigger privileged behavior.

This action applies to a different case: An LDAP directory query returns fewer user records than the account inventory provided by the owner. Enumeration completeness depends on query filters and directory permissions. It does not establish the present requirement, where evidence includes permitted service details, not copied protected credentials. The appropriate action is: Enumerate accessible services and respect filesystem permission boundaries.

That approach concerns a different situation: a cloud project exposes a service principal name but not evidence of its active privileges. Identity existence alone does not determine effective cloud permission. The required result is that evidence includes permitted service details, not copied protected credentials. The appropriate action is: Enumerate accessible services and respect filesystem permission boundaries.

It would address a permitted SMB account lists a share with write permission although the business expected read-only access. The relevant reason in that case is: Authorization may differ between share and filesystem permission layers. Here the required success condition is evidence includes permitted service details, not copied protected credentials. The appropriate action is: Enumerate accessible services and respect filesystem permission boundaries.

This result applies to a different case: A scanner discovers a cloud service tag matching a vulnerable product but no accessible resource endpoint. Product labels do not alone prove exploitability. It does not establish the present requirement, where the coverage statement identifies the omitted protected routes. The relevant evidence is: The coverage statement identifies the omitted protected routes.

That approach concerns a different situation: a scanner's authenticated credential was disabled during the test with no alert in the output summary. Credentials can silently fail and create false negative coverage. The required result is that the coverage statement identifies the omitted protected routes. The relevant evidence is: The coverage statement identifies the omitted protected routes.

That relates to a different issue: A credentialed scan finds no missing patches but several hosts never accepted the scan account. Unscanned hosts cannot be treated as confirmed patched. That is not a direct remedy for the requested outcome: The coverage statement identifies the omitted protected routes. The relevant evidence is: The coverage statement identifies the omitted protected routes.