Exam Bundle

It would address a public application exposes an API descriptor that lists endpoints not reachable by the standard UI. The relevant reason in that case is: API documentation can reveal functionality but does not establish exploitability. Here the required success condition is the activity log distinguishes passive discovery from authorized API checks. The appropriate action is: Identify the API endpoint for owner clarification without sending unapproved test traffic.

This action applies to a different case: An application includes third-party JavaScript that calls an analytics API outside client ownership. Embedded dependencies can cross organizational control boundaries. It does not establish the present requirement, where the activity log distinguishes passive discovery from authorized API checks. The appropriate action is: Identify the API endpoint for owner clarification without sending unapproved test traffic.

That relates to a different issue: An assessor finds an apparently exposed cloud access key in a web app's client bundle. A visible string may be a test key, limited token, or revoked credential. That is not a direct remedy for the requested outcome: The activity log distinguishes passive discovery from authorized API checks. The appropriate action is: Identify the API endpoint for owner clarification without sending unapproved test traffic.

It would address a team wants to detect weak API authorization in a running staging application. The relevant reason in that case is: DAST evaluates behavior from the application's external interface. Here the required success condition is the result lists the affected component and a confirmed version range. The relevant evidence is: The result lists the affected component and a confirmed version range.

This result applies to a different case: A custom application service cannot be instrumented for IAST due to platform restrictions. Testing technique choice must fit runtime access and instrumentation limits. It does not establish the present requirement, where the result lists the affected component and a confirmed version range. The relevant evidence is: The result lists the affected component and a confirmed version range.

That approach concerns a different situation: a tester is asked to assess 802.11 channel utilization and coverage without disruption. Radio surveys can evaluate exposure without performing active interference. The required result is that the result lists the affected component and a confirmed version range. The relevant evidence is: The result lists the affected component and a confirmed version range.

That approach concerns a different situation: an assessor discovers credential samples in a third-party breach corpus mentioning the client's email domain. Leaked credentials are sensitive evidence, not blanket authorization to log in. The required result is that the PTR result is explicitly treated as a candidate until validated by the owner. The appropriate action is: Use PTR lookups and corroborate with customer ownership records.

It would address a client wants to discover previously published but now removed endpoint documentation. The relevant reason in that case is: Web caches may preserve older public information no longer linked. Here the required success condition is the PTR result is explicitly treated as a candidate until validated by the owner. The appropriate action is: Use PTR lookups and corroborate with customer ownership records.

This action applies to a different case: A company cannot explain why an old DNS mail exchanger still appears in public records. Current DNS answers identify public mail routing independently of internal diagrams. It does not establish the present requirement, where the PTR result is explicitly treated as a candidate until validated by the owner. The appropriate action is: Use PTR lookups and corroborate with customer ownership records.

This action applies to a different case: A vulnerability scan highlights a CVE in a dormant service not installed on the target. CVE matching must correspond to actual components. It does not establish the present requirement, where the coverage statement identifies the omitted protected routes. The appropriate action is: Treat the outcome as an incomplete scan with possible false negatives.

That relates to a different issue: An assessor discovers a password in a published repository but cannot verify it is still active without exceeding scope. Unverified current validity cannot justify unauthorized login attempts. That is not a direct remedy for the requested outcome: The coverage statement identifies the omitted protected routes. The appropriate action is: Treat the outcome as an incomplete scan with possible false negatives.

It would address the same web path returns 403 to scanners but 200 to an authorized test account. The relevant reason in that case is: Authenticated routes require appropriate evaluation context. Here the required success condition is the coverage statement identifies the omitted protected routes. The appropriate action is: Treat the outcome as an incomplete scan with possible false negatives.

It would address a client shares a URL containing a deep path but excludes the administrative console on the same host. The relevant reason in that case is: URL-level exclusions can narrow a host-level test authorization. Here the required success condition is all tested IPs and names trace to approved scope entries. The relevant evidence is: All tested IPs and names trace to approved scope entries.

This result applies to a different case: A cloud provider permits vulnerability scanning only under defined acceptable-use conditions. A customer's permission cannot override a hosting provider's contractual constraints. It does not establish the present requirement, where all tested IPs and names trace to approved scope entries. The relevant evidence is: All tested IPs and names trace to approved scope entries.

That relates to a different issue: A researcher uncovers likely personal data during an authorized test of a public portal. Authorization to test does not grant unlimited personal-data collection. That is not a direct remedy for the requested outcome: All tested IPs and names trace to approved scope entries. The relevant evidence is: All tested IPs and names trace to approved scope entries.

That relates to a different issue: A tester wants to infer whether an address is active while ICMP echo replies are blocked. Firewalls can suppress ping despite active TCP listeners. That is not a direct remedy for the requested outcome: The scan record reflects closed states for the observed resets. The appropriate action is: Classify those ports as closed rather than silently filtered.

It would address a service exposes multiple ports associated with different application protocols. The relevant reason in that case is: Nonstandard port assignments are common and port numbers are only initial clues. Here the required success condition is the scan record reflects closed states for the observed resets. The appropriate action is: Classify those ports as closed rather than silently filtered.

That approach concerns a different situation: a limited-scope assessment needs the list of responding ports without overwhelming a fragile legacy gateway. Discovery intensity must reflect operational constraints and written permission. The required result is that the scan record reflects closed states for the observed resets. The appropriate action is: Classify those ports as closed rather than silently filtered.

That approach concerns a different situation: a tester needs to discover running operating system services using only a read-only endpoint account. Authenticated enumeration can identify services without exploiting them. The required result is that the finding shows the account's observed access against owner expectations. The appropriate action is: Compare effective permissions with the intended share ACL and document the mismatch.

It would address an in-scope Linux account is permitted to view local service configuration but not system credential files. The relevant reason in that case is: Local test authorization is constrained by supplied account privileges. Here the required success condition is the finding shows the account's observed access against owner expectations. The appropriate action is: Compare effective permissions with the intended share ACL and document the mismatch.

This action applies to a different case: An in-scope Windows server advertises SMB but shares cannot be listed anonymously. Authentication boundaries limit accessible share inventories. It does not establish the present requirement, where the finding shows the account's observed access against owner expectations. The appropriate action is: Compare effective permissions with the intended share ACL and document the mismatch.

This result applies to a different case: An internal admin portal accepts a password alone for privileged access. Strong second-factor binding reduces credential theft and replay risk. It does not establish the present requirement, where a transferred employee loses old privileges after an approved review. The relevant evidence is: A transferred employee loses old privileges after an approved review.

That approach concerns a different situation: a service exposes its administrative interface to every network segment. Limiting reachability reduces opportunities for credential and service abuse. The required result is that a transferred employee loses old privileges after an approved review. The relevant evidence is: A transferred employee loses old privileges after an approved review.

It would address a staff member can plug unknown USB devices into a sensitive workstation. The relevant reason in that case is: Technical device restrictions supplement awareness training. Here the required success condition is a transferred employee loses old privileges after an approved review. The relevant evidence is: A transferred employee loses old privileges after an approved review.

It would address a test host's ARP poisoning protection rejects an untrusted gateway claim. The relevant reason in that case is: Network access checks can prevent an on-path position before application traffic. Here the required success condition is the safe lab evidence proves missing protection without production credential use. The appropriate action is: Classify the finding as relay exposure and recommend SMB signing or channel protections.

This action applies to a different case: A captured lab TCP session reveals an intermediary can see unencrypted application data. Traffic traversing an attacker-controlled segment can expose plaintext. It does not establish the present requirement, where the safe lab evidence proves missing protection without production credential use. The appropriate action is: Classify the finding as relay exposure and recommend SMB signing or channel protections.

That relates to a different issue: A tester is considering a public Metasploit module that attempts service disruption. An available exploit module is not inherently appropriate for production testing. That is not a direct remedy for the requested outcome: The safe lab evidence proves missing protection without production credential use. The appropriate action is: Classify the finding as relay exposure and recommend SMB signing or channel protections.

That relates to a different issue: A service responds with a detailed stack trace that names its web framework and local file path. Verbose errors can expose implementation details useful for attack planning. That is not a direct remedy for the requested outcome: The crawl captures routes without repeatedly logging out test users. The relevant evidence is: The crawl captures routes without repeatedly logging out test users.

It would address an assessment discovers a DNS alias that points from an approved hostname to a provider-owned domain. The relevant reason in that case is: Aliases do not extend consent to the target infrastructure automatically. Here the required success condition is the crawl captures routes without repeatedly logging out test users. The relevant evidence is: The crawl captures routes without repeatedly logging out test users.

This result applies to a different case: An assessor finds an apparently exposed cloud access key in a web app's client bundle. A visible string may be a test key, limited token, or revoked credential. It does not establish the present requirement, where the crawl captures routes without repeatedly logging out test users. The relevant evidence is: The crawl captures routes without repeatedly logging out test users.

That approach concerns a different situation: the client's network team publishes a list of routable and private subnets with overlapping names. Incorrect network arithmetic can accidentally scan unauthorized ranges. The required result is that the inventory records certificate subjects and service addresses only. The appropriate action is: Collect approved certificate and protocol metadata from exposed endpoints.

That relates to a different issue: A reverse proxy presents a server header claiming a particular web product version. Response headers may be hidden, modified, or deliberately misleading. That is not a direct remedy for the requested outcome: The inventory records certificate subjects and service addresses only. The appropriate action is: Collect approved certificate and protocol metadata from exposed endpoints.

This action applies to a different case: A tester needs to identify an industrial controller while the plant prohibits active protocol enumeration. Passive OT reconnaissance reduces risk of disrupting fragile control equipment. It does not establish the present requirement, where the inventory records certificate subjects and service addresses only. The appropriate action is: Collect approved certificate and protocol metadata from exposed endpoints.