Exam Bundle

It would address a PowerShell inventory includes duplicate IPs from multiple subnets and scans them repeatedly. The relevant reason in that case is: Unnecessary probes increase risk and distort evidence counts. Here the required success condition is a test fixture never exceeds the configured request budget. The appropriate action is: Add configurable concurrency, delay, and maximum request count.

This action applies to a different case: A PowerShell script exports internal usernames to a publicly writable diagnostics folder. Recon output can expose sensitive client information beyond the testing system. It does not establish the present requirement, where a test fixture never exceeds the configured request budget. The appropriate action is: Add configurable concurrency, delay, and maximum request count.

That approach concerns a different situation: a Python recon tool fails when JSON output omits an optional field. Schema-tolerant parsing preserves partial observations without inventing facts. The required result is that a test fixture never exceeds the configured request budget. The appropriate action is: Add configurable concurrency, delay, and maximum request count.

That relates to a different issue: A network segment contains thousands of servers but the authorized scan engine is configured with unlimited concurrency. Assessment intensity can create operational risks independent of exploit payloads. That is not a direct remedy for the requested outcome: The assessment contains no frames targeted at unrelated radios. The appropriate action is: Enumerate only approved BSSIDs and monitor channels passively.

It would address a security pipeline may contain private API tokens in committed history. The relevant reason in that case is: Secret detection should avoid creating new exposure in logs. Here the required success condition is the assessment contains no frames targeted at unrelated radios. The appropriate action is: Enumerate only approved BSSIDs and monitor channels passively.

That approach concerns a different situation: a vulnerability analyst needs to assess a publicly reachable web server's unsafe headers and default files. Web configuration assessment targets service weaknesses distinct from full code review. The required result is that the assessment contains no frames targeted at unrelated radios. The appropriate action is: Enumerate only approved BSSIDs and monitor channels passively.

That relates to a different issue: A plugin upload endpoint permits executable scripts to be stored inside a public web root. File upload handling must prevent attacker-controlled server-side execution. That is not a direct remedy for the requested outcome: Malformed or wrong-audience test JWTs are rejected. The relevant evidence is: Malformed or wrong-audience test JWTs are rejected.

It would address a REST API silently processes unsupported HTTP methods as privileged operations. The relevant reason in that case is: Method confusion can expose operations not covered by UI controls. Here the required success condition is malformed or wrong-audience test JWTs are rejected. The relevant evidence is: Malformed or wrong-audience test JWTs are rejected.

This result applies to a different case: An OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. It does not establish the present requirement, where malformed or wrong-audience test JWTs are rejected. The relevant evidence is: Malformed or wrong-audience test JWTs are rejected.

That approach concerns a different situation: a team wants to validate its public wireless discovery without generating deauthentication traffic. Wireless tool capability does not imply authorization for disruptive features. The required result is that the capture report identifies the relevant flows and excludes secrets. The relevant evidence is: The capture report identifies the relevant flows and excludes secrets.

That relates to a different issue: A tester needs to analyze 802.11 management frames from an authorized lab capture. Wireless tooling can inspect captures separately from active disruption. That is not a direct remedy for the requested outcome: The capture report identifies the relevant flows and excludes secrets. The relevant evidence is: The capture report identifies the relevant flows and excludes secrets.

It would address a customer wants to discover a website's historical public configuration. The relevant reason in that case is: Archived snapshots show previously public pages but not current deployment. Here the required success condition is the capture report identifies the relevant flows and excludes secrets. The relevant evidence is: The capture report identifies the relevant flows and excludes secrets.

This result applies to a different case: A company posts cloud administrator vacancy descriptions revealing its deployed identity platform. Recruitment posts can disclose likely stack components without network interaction. It does not establish the present requirement, where indexed URLs are listed with timestamps and confirmed owner scope. The relevant evidence is: Indexed URLs are listed with timestamps and confirmed owner scope.

That approach concerns a different situation: a company cannot explain why an old DNS mail exchanger still appears in public records. Current DNS answers identify public mail routing independently of internal diagrams. The required result is that indexed URLs are listed with timestamps and confirmed owner scope. The relevant evidence is: Indexed URLs are listed with timestamps and confirmed owner scope.

That relates to a different issue: A tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. Reverse names provide attribution hints but are not reliable proof of asset ownership. That is not a direct remedy for the requested outcome: Indexed URLs are listed with timestamps and confirmed owner scope. The relevant evidence is: Indexed URLs are listed with timestamps and confirmed owner scope.

That relates to a different issue: A customer has stale machine account certificates with expired owners. Key and certificate hygiene prevents service interruption and untrusted identity reuse. That is not a direct remedy for the requested outcome: A password-only sign-in cannot open the administrative portal. The relevant evidence is: A password-only sign-in cannot open the administrative portal.

This result applies to a different case: A production app stores an API key in a publicly readable deployment manifest. Secret revocation is necessary after disclosure; merely hiding a file is insufficient. It does not establish the present requirement, where a password-only sign-in cannot open the administrative portal. The relevant evidence is: A password-only sign-in cannot open the administrative portal.

That approach concerns a different situation: an administrator can reach production backups using the same broad privileges as developers. Privilege separation limits destructive access from routine accounts. The required result is that a password-only sign-in cannot open the administrative portal. The relevant evidence is: A password-only sign-in cannot open the administrative portal.

That approach concerns a different situation: a client requests test data in a collaboration workspace available to all contractors. Findings can expose exploitation paths if shared broadly. The required result is that the transmission audit shows authorized recipient, encryption, and deletion policy. The appropriate action is: Transfer only the minimum evidence using the agreed encrypted distribution channel.

It would address a client changes its target business objective midway through an authorized engagement. The relevant reason in that case is: Material objective changes can affect budget, risk, and scope. Here the required success condition is the transmission audit shows authorized recipient, encryption, and deletion policy. The appropriate action is: Transfer only the minimum evidence using the agreed encrypted distribution channel.

This action applies to a different case: The final demonstration was technically complete but the customer has not confirmed acceptance criteria. Contractual delivery is not identical to internal test completion. It does not establish the present requirement, where the transmission audit shows authorized recipient, encryption, and deletion policy. The appropriate action is: Transfer only the minimum evidence using the agreed encrypted distribution channel.

That approach concerns a different situation: a lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. Scheduled execution can restore a foothold without an interactive login. The required result is that the identity and group membership are removed with an audit record. The appropriate action is: Escalate the out-of-scope change and follow the approved account removal workflow.

That relates to a different issue: A Trojan-labeled binary claims to be a legitimate installer but performs unauthorized background operations. A Trojan conceals unwanted activity behind an apparently useful program. That is not a direct remedy for the requested outcome: The identity and group membership are removed with an audit record. The appropriate action is: Escalate the out-of-scope change and follow the approved account removal workflow.

It would address a web server begins making outbound connections even after the original test session ends. The relevant reason in that case is: Server-side scripts can maintain remote control outside initial access. Here the required success condition is the identity and group membership are removed with an audit record. The appropriate action is: Escalate the out-of-scope change and follow the approved account removal workflow.

It would address a data center relies on a turnstile that permits multiple people to pass behind one badge. The relevant reason in that case is: One-factor door systems may fail to enforce one-person admission. Here the required success condition is a controlled training exercise documents pickup/reporting outcomes safely. The relevant evidence is: A controlled training exercise documents pickup/reporting outcomes safely.

This result applies to a different case: A tester sees an employee hold open a restricted office door for a visitor without checking credentials. Tailgating involves following an authorized entrant through a secured access point. It does not establish the present requirement, where a controlled training exercise documents pickup/reporting outcomes safely. The relevant evidence is: A controlled training exercise documents pickup/reporting outcomes safely.

That relates to a different issue: Employees frequently enter a controlled warehouse door by carrying boxes that obstruct badge presentation. Operational processes can unintentionally defeat physical control design. That is not a direct remedy for the requested outcome: A controlled training exercise documents pickup/reporting outcomes safely. The relevant evidence is: A controlled training exercise documents pickup/reporting outcomes safely.

That relates to a different issue: An application security team needs to test live behavior after new API endpoints are deployed. Runtime behavior may differ from static source expectations. That is not a direct remedy for the requested outcome: The report includes separate SCA and application test results. The relevant evidence is: The report includes separate SCA and application test results.

This result applies to a different case: A static scanner flags a parameter as unsanitized but a framework consistently binds SQL values. Automated source findings require context to avoid false positives. It does not establish the present requirement, where the report includes separate SCA and application test results. The relevant evidence is: The report includes separate SCA and application test results.

That approach concerns a different situation: a CI pipeline contains an image registry scanner but scans only a mutable latest tag. Mutable tags can change between scan and deployment, invalidating evidence. The required result is that the report includes separate SCA and application test results. The relevant evidence is: The report includes separate SCA and application test results.

That relates to a different issue: A tester needs service version metadata from a tightly scoped lab host. Service fingerprinting can establish versions more reliably than port assumptions. That is not a direct remedy for the requested outcome: The research notes registrar and attribution uncertainty. The relevant evidence is: The research notes registrar and attribution uncertainty.

It would address an assessor wants to enumerate external records but cannot use a product requiring active client network contact. The relevant reason in that case is: Tool mode is more important than product name for scope compliance. Here the required success condition is the research notes registrar and attribution uncertainty. The relevant evidence is: The research notes registrar and attribution uncertainty.

This result applies to a different case: A penetration tester wants an initial list of OSINT resource types for a new engagement. Resource directories organize potential intelligence sources but are not findings. It does not establish the present requirement, where the research notes registrar and attribution uncertainty. The relevant evidence is: The research notes registrar and attribution uncertainty.