Exam Bundle

That approach concerns a different situation: a client wants to evaluate an old Telnet management interface without reading passwords. Telnet lacks built-in encrypted session protection. The required result is that a lab segmentation test shows untrusted frames cannot reach protected VLANs. The relevant evidence is: A lab segmentation test shows untrusted frames cannot reach protected VLANs.

It would address a tester sees port 445 on an authorized server but has no credentials to enumerate its shares. The relevant reason in that case is: Service availability is not the same as permission to enumerate protected resources. Here the required success condition is a lab segmentation test shows untrusted frames cannot reach protected VLANs. The relevant evidence is: A lab segmentation test shows untrusted frames cannot reach protected VLANs.

This result applies to a different case: A tester is considering a public Metasploit module that attempts service disruption. An available exploit module is not inherently appropriate for production testing. It does not establish the present requirement, where a lab segmentation test shows untrusted frames cannot reach protected VLANs. The relevant evidence is: A lab segmentation test shows untrusted frames cannot reach protected VLANs.

This action applies to a different case: A tester plans to use Hydra against a production identity provider with a strict account-lockout policy. Online attack tooling can exceed legal and availability constraints. It does not establish the present requirement, where the lab report distinguishes dictionary candidates from full keyspace search. The appropriate action is: Classify it as a dictionary-based password attack.

That approach concerns a different situation: an analyst needs an offline password strength assessment but policy prohibits online guessing. Offline password auditing can measure weakness without account lockouts. The required result is that the lab report distinguishes dictionary candidates from full keyspace search. The appropriate action is: Classify it as a dictionary-based password attack.

That relates to a different issue: An approved lab shows NTLM network authentication may be accepted without a plaintext password. Reusable password-derived authentication material can be abused in some NTLM flows. That is not a direct remedy for the requested outcome: The lab report distinguishes dictionary candidates from full keyspace search. The appropriate action is: Classify it as a dictionary-based password attack.

This result applies to a different case: A container runtime allows an ordinary workload to access its orchestration API with cluster-admin privileges. Runtime identities can grant control of the wider container cluster. It does not establish the present requirement, where an unsafe test manifest fails admission while the hardened workload starts. The relevant evidence is: An unsafe test manifest fails admission while the hardened workload starts.

That approach concerns a different situation: an audit discovers cloud activity logging disabled for a sensitive storage resource. Missing logs undermine validation of cloud resource abuse. The required result is that an unsafe test manifest fails admission while the hardened workload starts. The relevant evidence is: An unsafe test manifest fails admission while the hardened workload starts.

That relates to a different issue: A public artifact repository accepts uploads under a shared build identity with no review process. Unsigned or unauthorized artifacts can contaminate downstream releases. That is not a direct remedy for the requested outcome: An unsafe test manifest fails admission while the hardened workload starts. The relevant evidence is: An unsafe test manifest fails admission while the hardened workload starts.

That relates to a different issue: An application includes third-party JavaScript that calls an analytics API outside client ownership. Embedded dependencies can cross organizational control boundaries. That is not a direct remedy for the requested outcome: The authorization map lists principal, scope, and effective role. The relevant evidence is: The authorization map lists principal, scope, and effective role.

It would address an assessment needs an inventory of publicly accessible cloud buckets under the customer's account. The relevant reason in that case is: Cloud access posture must be confirmed at both resource and data-plane levels. Here the required success condition is the authorization map lists principal, scope, and effective role. The relevant evidence is: The authorization map lists principal, scope, and effective role.

That approach concerns a different situation: a public application exposes an API descriptor that lists endpoints not reachable by the standard UI. API documentation can reveal functionality but does not establish exploitability. The required result is that the authorization map lists principal, scope, and effective role. The relevant evidence is: The authorization map lists principal, scope, and effective role.

That approach concerns a different situation: an assessor finds an apparently exposed cloud access key in a web app's client bundle. A visible string may be a test key, limited token, or revoked credential. The required result is that results distinguish anonymous denial from credentialed share access. The appropriate action is: Record anonymous enumeration restrictions and use supplied credentials only if permitted.

That relates to a different issue: An API returns sequential customer identifiers in JSON responses to a normal account. Guessable IDs alone are not proof of broken object authorization. That is not a direct remedy for the requested outcome: Results distinguish anonymous denial from credentialed share access. The appropriate action is: Record anonymous enumeration restrictions and use supplied credentials only if permitted.

It would address a server reports a plugin directory but no plugin version in HTTP headers. The relevant reason in that case is: Plugin presence is not proof of a particular exploitable release. Here the required success condition is results distinguish anonymous denial from credentialed share access. The appropriate action is: Record anonymous enumeration restrictions and use supplied credentials only if permitted.

This result applies to a different case: A login form is vulnerable to injected SQL fragments in a parameter. Bound query parameters prevent user input from becoming SQL syntax. It does not establish the present requirement, where a developer cannot delete backups but the backup operator can run approved restores. The relevant evidence is: A developer cannot delete backups but the backup operator can run approved restores.

That relates to a different issue: Staff retain elevated rights for months after changing roles. Role-based governance reduces excess privilege persistence. That is not a direct remedy for the requested outcome: A developer cannot delete backups but the backup operator can run approved restores. The relevant evidence is: A developer cannot delete backups but the backup operator can run approved restores.

It would address a customer has stale machine account certificates with expired owners. The relevant reason in that case is: Key and certificate hygiene prevents service interruption and untrusted identity reuse. Here the required success condition is a developer cannot delete backups but the backup operator can run approved restores. The relevant evidence is: A developer cannot delete backups but the backup operator can run approved restores.

It would address a risk workshop rates damage potential, exploitability, and discoverability for a threat. The relevant reason in that case is: DREAD is a threat prioritization model with defined factor categories. Here the required success condition is the test case traces to the applicable MASVS control area. The appropriate action is: Apply the OWASP Mobile Application Security Verification Standard.

This action applies to a different case: A client wants a recognized penetration-testing service accreditation model. CREST provides professional testing standards and assurance mechanisms. It does not establish the present requirement, where the test case traces to the applicable MASVS control area. The appropriate action is: Apply the OWASP Mobile Application Security Verification Standard.

That relates to a different issue: A company wants measurable technical security testing of network and physical channels. OSSTMM focuses on methodical operational security testing and measurement. That is not a direct remedy for the requested outcome: The test case traces to the applicable MASVS control area. The appropriate action is: Apply the OWASP Mobile Application Security Verification Standard.

That relates to a different issue: An assessor discovers credential samples in a third-party breach corpus mentioning the client's email domain. Leaked credentials are sensitive evidence, not blanket authorization to log in. That is not a direct remedy for the requested outcome: The case records only minimal redacted evidence and alerts the owner. The relevant evidence is: The case records only minimal redacted evidence and alerts the owner.

It would address a company cannot explain why an old DNS mail exchanger still appears in public records. The relevant reason in that case is: Current DNS answers identify public mail routing independently of internal diagrams. Here the required success condition is the case records only minimal redacted evidence and alerts the owner. The relevant evidence is: The case records only minimal redacted evidence and alerts the owner.

This result applies to a different case: A tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. Reverse names provide attribution hints but are not reliable proof of asset ownership. It does not establish the present requirement, where the case records only minimal redacted evidence and alerts the owner. The relevant evidence is: The case records only minimal redacted evidence and alerts the owner.

That approach concerns a different situation: a model endpoint outputs confidential training examples when prompted with generic cues. Model behavior can expose sensitive memorized data. The required result is that a local test account cannot expose its session token through untrusted access. The appropriate action is: Identify mobile information disclosure and require protected storage.

That relates to a different issue: A warehouse badge reader accepts duplicate RFID identifiers without cryptographic authentication. Static radio identifiers are susceptible to copying without stronger protections. That is not a direct remedy for the requested outcome: A local test account cannot expose its session token through untrusted access. The appropriate action is: Identify mobile information disclosure and require protected storage.

It would address an app asks for contact-list access even though the business feature uses only a camera. The relevant reason in that case is: Unnecessary mobile permissions expand sensitive data exposure. Here the required success condition is a local test account cannot expose its session token through untrusted access. The appropriate action is: Identify mobile information disclosure and require protected storage.

This action applies to a different case: A tester wants to infer whether an address is active while ICMP echo replies are blocked. Firewalls can suppress ping despite active TCP listeners. It does not establish the present requirement, where a generated target list includes only addresses inside signed network scopes. The appropriate action is: Reconcile CIDR membership before active target enumeration.

That approach concerns a different situation: a service exposes multiple ports associated with different application protocols. Nonstandard port assignments are common and port numbers are only initial clues. The required result is that a generated target list includes only addresses inside signed network scopes. The appropriate action is: Reconcile CIDR membership before active target enumeration.

That relates to a different issue: A site requires an inventory of TLS-enabled services without attempting authentication. TLS handshakes can describe certificate names and supported protocol families. That is not a direct remedy for the requested outcome: A generated target list includes only addresses inside signed network scopes. The appropriate action is: Reconcile CIDR membership before active target enumeration.

It would address a testing team receives approval for a site survey but not for collecting unattended staff badges. The relevant reason in that case is: Physical testing permission is limited to the agreed method and property. Here the required success condition is the staff member follows the established verification and escort process. The appropriate action is: Assess the visitor challenge and escort process using authorized role-play.

This action applies to a different case: A data center relies on a turnstile that permits multiple people to pass behind one badge. One-factor door systems may fail to enforce one-person admission. It does not establish the present requirement, where the staff member follows the established verification and escort process. The appropriate action is: Assess the visitor challenge and escort process using authorized role-play.

That relates to a different issue: A secure room's access logs show one badge opened the door repeatedly during an unoccupied shift. Access anomaly evidence is stronger when multiple sources agree. That is not a direct remedy for the requested outcome: The staff member follows the established verification and escort process. The appropriate action is: Assess the visitor challenge and escort process using authorized role-play.