Exam Bundle

That relates to a different issue: A report needs proof that no unauthorized modification remained after a system-level assessment. Restoration requires verification, not a verbal cleanup statement. That is not a direct remedy for the requested outcome: Process and service inventories show no active test agent. The relevant evidence is: Process and service inventories show no active test agent.

It would address an assessment deployed a temporary cloud VM and associated public IP for a controlled attack simulation. The relevant reason in that case is: Temporary test resources can create ongoing cost and exposure. Here the required success condition is process and service inventories show no active test agent. The relevant evidence is: Process and service inventories show no active test agent.

This result applies to a different case: An assessor created a temporary directory account to validate scoped identity permissions. Tester-created identities can become lingering access paths. It does not establish the present requirement, where process and service inventories show no active test agent. The relevant evidence is: Process and service inventories show no active test agent.

This action applies to a different case: A Windows endpoint contains a newly created service with a binary path outside approved software folders. Services can restart unwanted binaries during boot. It does not establish the present requirement, where trusted offline analysis confirms or rejects unauthorized modification. The appropriate action is: Treat possible rootkit behavior as a hypothesis needing offline integrity verification.

That relates to a different issue: A lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. Scheduled execution can restore a foothold without an interactive login. That is not a direct remedy for the requested outcome: Trusted offline analysis confirms or rejects unauthorized modification. The appropriate action is: Treat possible rootkit behavior as a hypothesis needing offline integrity verification.

It would address a lab connection initiated from a controlled host stays available through outbound egress. The relevant reason in that case is: Reverse shells initiate the control connection from the compromised host. Here the required success condition is trusted offline analysis confirms or rejects unauthorized modification. The appropriate action is: Treat possible rootkit behavior as a hypothesis needing offline integrity verification.

It would address a file-conversion service passes filenames directly to a system shell. The relevant reason in that case is: Shell metacharacters can change command execution when inputs are concatenated. Here the required success condition is the report describes encoding context and test behavior accurately. The appropriate action is: Distinguish input reflection from demonstrated cross-site scripting.

That approach concerns a different situation: a password-change API accepts simultaneous requests but applies different validation rules depending on timing. Race conditions can bypass checks when state is updated nonatomically. The required result is that the report describes encoding context and test behavior accurately. The appropriate action is: Distinguish input reflection from demonstrated cross-site scripting.

That relates to a different issue: A profile page places input directly into a JavaScript string literal without encoding. Encoding suitable for HTML text is not automatically sufficient inside script strings. That is not a direct remedy for the requested outcome: The report describes encoding context and test behavior accurately. The appropriate action is: Distinguish input reflection from demonstrated cross-site scripting.

That relates to a different issue: A route hidden from the site's navigation remains in the XML sitemap. Sitemaps are inventory aids and not access permissions. That is not a direct remedy for the requested outcome: The results note referrals without automatically following them. The appropriate action is: Confirm each referenced host's scope before enumerating its interfaces.

It would address a cloud project exposes a service principal name but not evidence of its active privileges. The relevant reason in that case is: Identity existence alone does not determine effective cloud permission. Here the required success condition is the results note referrals without automatically following them. The appropriate action is: Confirm each referenced host's scope before enumerating its interfaces.

That approach concerns a different situation: a service responds with a detailed stack trace that names its web framework and local file path. Verbose errors can expose implementation details useful for attack planning. The required result is that the results note referrals without automatically following them. The appropriate action is: Confirm each referenced host's scope before enumerating its interfaces.

That relates to a different issue: A printer fleet retains manufacturer default passwords on its administrative pages. Default credentials can expose management functions without any software exploit. That is not a direct remedy for the requested outcome: The test account is accepted only by authorized service endpoints. The relevant evidence is: The test account is accepted only by authorized service endpoints.

It would address a client wants to assess relay susceptibility without capturing employee credentials. The relevant reason in that case is: Proof of authentication relay must avoid collection of unrelated secrets. Here the required success condition is the test account is accepted only by authorized service endpoints. The relevant evidence is: The test account is accepted only by authorized service endpoints.

This result applies to a different case: A tester sees port 445 on an authorized server but has no credentials to enumerate its shares. Service availability is not the same as permission to enumerate protected resources. It does not establish the present requirement, where the test account is accepted only by authorized service endpoints. The relevant evidence is: The test account is accepted only by authorized service endpoints.

This action applies to a different case: A route hidden from the site's navigation remains in the XML sitemap. Sitemaps are inventory aids and not access permissions. It does not establish the present requirement, where out-of-scope destinations are excluded until separately approved. The appropriate action is: Verify the final host's ownership before active requests.

That approach concerns a different situation: a website publishes robots.txt paths for a legacy backup directory. Robots exclusions are crawler advice, not an authorization boundary. The required result is that out-of-scope destinations are excluded until separately approved. The appropriate action is: Verify the final host's ownership before active requests.

That relates to a different issue: A target's CDN returns the same default page for every unknown URL. Uniform fallback responses can make missing endpoints appear valid. That is not a direct remedy for the requested outcome: Out-of-scope destinations are excluded until separately approved. The appropriate action is: Verify the final host's ownership before active requests.

It would address an application sends staged content through an unapproved HTTPS endpoint but network controls permit all egress. The relevant reason in that case is: Confidentiality of transit does not establish transfer authorization. Here the required success condition is the permitted lab test shows sync is blocked for unapproved cloud providers. The relevant evidence is: The permitted lab test shows sync is blocked for unapproved cloud providers.

This result applies to a different case: A service sends files to an external mailbox instead of a sanctioned business archive. Email offers a familiar outbound path that may bypass specialized DLP controls. It does not establish the present requirement, where the permitted lab test shows sync is blocked for unapproved cloud providers. The relevant evidence is: The permitted lab test shows sync is blocked for unapproved cloud providers.

That approach concerns a different situation: an organization sees regular ICMP echo requests containing nonstandard data payloads. Network control protocols can carry hidden data in payload fields. The required result is that the permitted lab test shows sync is blocked for unapproved cloud providers. The relevant evidence is: The permitted lab test shows sync is blocked for unapproved cloud providers.

That relates to a different issue: A tester sees an employee hold open a restricted office door for a visitor without checking credentials. Tailgating involves following an authorized entrant through a secured access point. That is not a direct remedy for the requested outcome: The report uses redacted evidence and verifies disposal control ownership. The relevant evidence is: The report uses redacted evidence and verifies disposal control ownership.

It would address a visitor uses an authorized staff member's badge replica in a test access system. The relevant reason in that case is: Copied credentials can bypass physical identity checks if unprotected. Here the required success condition is the report uses redacted evidence and verifies disposal control ownership. The relevant evidence is: The report uses redacted evidence and verifies disposal control ownership.

This result applies to a different case: A client wants to determine whether an employee can remotely open a door with another person's proximity badge. Authentication properties must be demonstrated without using actual employee identifiers. It does not establish the present requirement, where the report uses redacted evidence and verifies disposal control ownership. The relevant evidence is: The report uses redacted evidence and verifies disposal control ownership.

That approach concerns a different situation: a scheduled assessment identifies fewer hosts than last month, but subnet routing has changed. Fewer findings may indicate lost visibility, not improved security. The required result is that a repeat scan completes with successful name resolution. The appropriate action is: Repair DNS resolution or use the approved IP mapping before interpreting the scan.

That relates to a different issue: A web scan reports no injection defects but excluded every authenticated API route. A negative result applies only to the surfaces actually tested. That is not a direct remedy for the requested outcome: A repeat scan completes with successful name resolution. The appropriate action is: Repair DNS resolution or use the approved IP mapping before interpreting the scan.

It would address a scan identifies a dangerous account permission but the permission is effectively denied by a higher-level policy. The relevant reason in that case is: Effective access can depend on multiple policy layers. Here the required success condition is a repeat scan completes with successful name resolution. The appropriate action is: Repair DNS resolution or use the approved IP mapping before interpreting the scan.

This result applies to a different case: An application security exercise saved a proof-of-concept script in an application document root. Residual files in a web root can become unintended access points. It does not establish the present requirement, where the resource inventory has no unmanaged test VM, IP, or disk. The relevant evidence is: The resource inventory has no unmanaged test VM, IP, or disk.

That approach concerns a different situation: a temporary password was set on an approved test account during a proof. Temporary authentication changes can create lingering security risk. The required result is that the resource inventory has no unmanaged test VM, IP, or disk. The relevant evidence is: The resource inventory has no unmanaged test VM, IP, or disk.

It would address a test team performed controlled changes to a lab Kubernetes role assignment. The relevant reason in that case is: Temporary elevated cluster roles can outlive the exercise. Here the required success condition is the resource inventory has no unmanaged test VM, IP, or disk. The relevant evidence is: The resource inventory has no unmanaged test VM, IP, or disk.

It would address a test user's reset flow issues single-use tokens that remain valid after consumption. The relevant reason in that case is: One-time recovery tokens should be invalidated after successful use. Here the required success condition is the activity record shows no live authentication requests. The relevant evidence is: The activity record shows no live authentication requests.

That approach concerns a different situation: one account receives hundreds of password guesses in a short period. Brute force concentrates many guesses against one identity. The required result is that the activity record shows no live authentication requests. The relevant evidence is: The activity record shows no live authentication requests.

That relates to a different issue: An assessment sees valid Kerberos tickets used on another system outside their intended workflow. Kerberos tickets are bearer-like credentials within their valid scope. That is not a direct remedy for the requested outcome: The activity record shows no live authentication requests. The relevant evidence is: The activity record shows no live authentication requests.