Exam Bundle

That approach concerns a different situation: the client's network team publishes a list of routable and private subnets with overlapping names. Incorrect network arithmetic can accidentally scan unauthorized ranges. The required result is that the inventory records certificate subjects and service addresses only. The appropriate action is: Collect approved certificate and protocol metadata from exposed endpoints.

That relates to a different issue: A reverse proxy presents a server header claiming a particular web product version. Response headers may be hidden, modified, or deliberately misleading. That is not a direct remedy for the requested outcome: The inventory records certificate subjects and service addresses only. The appropriate action is: Collect approved certificate and protocol metadata from exposed endpoints.

This action applies to a different case: A tester needs to identify an industrial controller while the plant prohibits active protocol enumeration. Passive OT reconnaissance reduces risk of disrupting fragile control equipment. It does not establish the present requirement, where the inventory records certificate subjects and service addresses only. The appropriate action is: Collect approved certificate and protocol metadata from exposed endpoints.

This action applies to a different case: The client asks which contract establishes general payment and liability terms across annual projects. An MSA typically governs the continuing commercial relationship. It does not establish the present requirement, where request logs contain the allowed route and no excluded admin path. The appropriate action is: Constrain requests to authorized application paths and avoid the excluded console.

That approach concerns a different situation: a client lists 10.40.0.0/24 as the only authorized internal range, but an asset resolves to 10.41.0.8. A resolved IP outside the signed CIDR range is not automatically included. The required result is that request logs contain the allowed route and no excluded admin path. The appropriate action is: Constrain requests to authorized application paths and avoid the excluded console.

It would address a client and supplier agree on ongoing terms, but the current test's exact hosts and dates are unrecorded. The relevant reason in that case is: The statement of work defines this particular engagement's operational boundaries. Here the required success condition is request logs contain the allowed route and no excluded admin path. The appropriate action is: Constrain requests to authorized application paths and avoid the excluded console.

This action applies to a different case: A PowerShell script exports internal usernames to a publicly writable diagnostics folder. Recon output can expose sensitive client information beyond the testing system. It does not establish the present requirement, where malformed ports are rejected while valid boundary ports are accepted. The appropriate action is: Validate and convert numeric port fields with exception handling.

That approach concerns a different situation: a recon script classifies every non-200 HTTP response as an absent endpoint. Authentication and rate limiting are not equivalent to missing resources. The required result is that malformed ports are rejected while valid boundary ports are accepted. The appropriate action is: Validate and convert numeric port fields with exception handling.

That relates to a different issue: A script retries failed probes indefinitely when an endpoint is unavailable. Retry storms can cause avoidable service impact and unreliable results. That is not a direct remedy for the requested outcome: Malformed ports are rejected while valid boundary ports are accepted. The appropriate action is: Validate and convert numeric port fields with exception handling.

That relates to a different issue: A web server can reach instance metadata with broad credentials accessible to its application identity. Metadata-derived temporary credentials may confer excessive cloud authority. That is not a direct remedy for the requested outcome: The integration performs required tasks without global administrative access. The appropriate action is: Review OAuth consent and replace with minimum required scopes.

It would address a service operator cannot determine whether a cloud attack attempt originated from a stolen temporary token. The relevant reason in that case is: Temporary credential abuse requires identity and control-plane evidence. Here the required success condition is the integration performs required tasks without global administrative access. The appropriate action is: Review OAuth consent and replace with minimum required scopes.

That approach concerns a different situation: a private cloud endpoint resolves to a public address because the DNS zone is misconfigured. Private endpoint creation alone does not ensure clients use private routes. The required result is that the integration performs required tasks without global administrative access. The appropriate action is: Review OAuth consent and replace with minimum required scopes.

That approach concerns a different situation: a penetration tester identifies an accessible PowerShell script that imports a privileged module from a writable directory. Dynamic module loading can cross privilege boundaries if paths are user-controlled. The required result is that the threat model records the observed process behavior accurately. The appropriate action is: Distinguish creating/replacing a process image from injecting into a running process.

That relates to a different issue: A Windows application runs from a writable directory but claims its installer is signed. Signed installers do not guarantee continued integrity after deployment. That is not a direct remedy for the requested outcome: The threat model records the observed process behavior accurately. The appropriate action is: Distinguish creating/replacing a process image from injecting into a running process.

This action applies to a different case: A scheduled Linux maintenance script is writable by a nonprivileged group but runs from root cron. Root-run scheduled code must be protected against untrusted modification. It does not establish the present requirement, where the threat model records the observed process behavior accurately. The appropriate action is: Distinguish creating/replacing a process image from injecting into a running process.

This action applies to a different case: A client and supplier agree on ongoing terms, but the current test's exact hosts and dates are unrecorded. The statement of work defines this particular engagement's operational boundaries. It does not establish the present requirement, where counsel confirms the MSA governs the recurring testing relationship. The appropriate action is: Use the master service agreement for standing commercial and legal terms.

That relates to a different issue: A cloud provider permits vulnerability scanning only under defined acceptable-use conditions. A customer's permission cannot override a hosting provider's contractual constraints. That is not a direct remedy for the requested outcome: Counsel confirms the MSA governs the recurring testing relationship. The appropriate action is: Use the master service agreement for standing commercial and legal terms.

It would address two companies need confidentiality protection before testers receive internal network diagrams. The relevant reason in that case is: An NDA governs handling of confidential information prior to technical access. Here the required success condition is counsel confirms the MSA governs the recurring testing relationship. The appropriate action is: Use the master service agreement for standing commercial and legal terms.

It would address an active test reveals evidence of a critical customer-data exposure while the weekly meeting is days away. The relevant reason in that case is: Critical material findings require timely escalation outside routine reporting cadence. Here the required success condition is a second reviewer confirms the reproducible condition or records its dismissal. The appropriate action is: Peer-review the reproduced evidence and agree on a defensible classification.

This action applies to a different case: A security team wants to publish screenshots showing real account names in a public presentation. Client confidentiality extends to demonstrations and marketing material. It does not establish the present requirement, where a second reviewer confirms the reproducible condition or records its dismissal. The appropriate action is: Peer-review the reproduced evidence and agree on a defensible classification.

That approach concerns a different situation: a client requests test data in a collaboration workspace available to all contractors. Findings can expose exploitation paths if shared broadly. The required result is that a second reviewer confirms the reproducible condition or records its dismissal. The appropriate action is: Peer-review the reproduced evidence and agree on a defensible classification.

That relates to a different issue: A scanner's authenticated credential was disabled during the test with no alert in the output summary. Credentials can silently fail and create false negative coverage. That is not a direct remedy for the requested outcome: The summary reconciles discovered hosts to the expected owner inventory. The relevant evidence is: The summary reconciles discovered hosts to the expected owner inventory.

It would address a scanner labels a host unreachable while a jump system sees it available. The relevant reason in that case is: Network visibility differs by source segment. Here the required success condition is the summary reconciles discovered hosts to the expected owner inventory. The relevant evidence is: The summary reconciles discovered hosts to the expected owner inventory.

This result applies to a different case: A credentialed scan finds no missing patches but several hosts never accepted the scan account. Unscanned hosts cannot be treated as confirmed patched. It does not establish the present requirement, where the summary reconciles discovered hosts to the expected owner inventory. The relevant evidence is: The summary reconciles discovered hosts to the expected owner inventory.

That relates to a different issue: A security agent is disabled by an ordinary user with local permissions. Endpoint safeguards must resist unauthorized security-control changes. That is not a direct remedy for the requested outcome: A low-right test account cannot modify protected service definitions. The appropriate action is: Recommend reducing service control permissions and account scope.

It would address a Windows event log unexpectedly stops recording privileged actions during a test. The relevant reason in that case is: Audit integrity is required to detect and investigate host compromise. Here the required success condition is a low-right test account cannot modify protected service definitions. The appropriate action is: Recommend reducing service control permissions and account scope.

This action applies to a different case: A Windows service launches an executable using an unquoted path containing spaces. Ambiguous executable paths matter only when lower-privilege users control a candidate location. It does not establish the present requirement, where a low-right test account cannot modify protected service definitions. The appropriate action is: Recommend reducing service control permissions and account scope.

This result applies to a different case: A risk workshop rates damage potential, exploitability, and discoverability for a threat. DREAD is a threat prioritization model with defined factor categories. It does not establish the present requirement, where the proposal identifies applicable CREST requirements without claiming certification improperly. The relevant evidence is: The proposal identifies applicable CREST requirements without claiming certification improperly.

That approach concerns a different situation: a SOC wants observed adversary behavior mapped to detection technique identifiers. ATT&CK classifies adversary behavior rather than providing a full test contract. The required result is that the proposal identifies applicable CREST requirements without claiming certification improperly. The relevant evidence is: The proposal identifies applicable CREST requirements without claiming certification improperly.

That relates to a different issue: A web application team wants a prioritized list of common application security risk categories. OWASP Top 10 groups frequent web application security risks. That is not a direct remedy for the requested outcome: The proposal identifies applicable CREST requirements without claiming certification improperly. The relevant evidence is: The proposal identifies applicable CREST requirements without claiming certification improperly.

It would address a PowerShell inventory includes duplicate IPs from multiple subnets and scans them repeatedly. The relevant reason in that case is: Unnecessary probes increase risk and distort evidence counts. Here the required success condition is a test fixture never exceeds the configured request budget. The appropriate action is: Add configurable concurrency, delay, and maximum request count.

This action applies to a different case: A PowerShell script exports internal usernames to a publicly writable diagnostics folder. Recon output can expose sensitive client information beyond the testing system. It does not establish the present requirement, where a test fixture never exceeds the configured request budget. The appropriate action is: Add configurable concurrency, delay, and maximum request count.

That approach concerns a different situation: a Python recon tool fails when JSON output omits an optional field. Schema-tolerant parsing preserves partial observations without inventing facts. The required result is that a test fixture never exceeds the configured request budget. The appropriate action is: Add configurable concurrency, delay, and maximum request count.