Exam Bundle

That relates to a different issue: A tester needs service version metadata from a tightly scoped lab host. Service fingerprinting can establish versions more reliably than port assumptions. That is not a direct remedy for the requested outcome: The research notes registrar and attribution uncertainty. The relevant evidence is: The research notes registrar and attribution uncertainty.

It would address an assessor wants to enumerate external records but cannot use a product requiring active client network contact. The relevant reason in that case is: Tool mode is more important than product name for scope compliance. Here the required success condition is the research notes registrar and attribution uncertainty. The relevant evidence is: The research notes registrar and attribution uncertainty.

This result applies to a different case: A penetration tester wants an initial list of OSINT resource types for a new engagement. Resource directories organize potential intelligence sources but are not findings. It does not establish the present requirement, where the research notes registrar and attribution uncertainty. The relevant evidence is: The research notes registrar and attribution uncertainty.

This action applies to a different case: An analyst relies on a CVE record without noting whether the affected function is enabled. Attack prerequisites determine relevance to a specific system. It does not establish the present requirement, where the report distinguishes uncertainty from a verified exposed service. The appropriate action is: Retain the uncertain scan state and seek safe protocol-specific confirmation.

That relates to a different issue: A plugin fails because the scanner host cannot resolve the target hostname. Tool errors are not target security findings. That is not a direct remedy for the requested outcome: The report distinguishes uncertainty from a verified exposed service. The appropriate action is: Retain the uncertain scan state and seek safe protocol-specific confirmation.

It would address a web scan reports no injection defects but excluded every authenticated API route. The relevant reason in that case is: A negative result applies only to the surfaces actually tested. Here the required success condition is the report distinguishes uncertainty from a verified exposed service. The appropriate action is: Retain the uncertain scan state and seek safe protocol-specific confirmation.

It would address an internal service uses cleartext FTP to move administrative files between servers. The relevant reason in that case is: Plaintext file transfer can reveal data and credentials to intermediate observers. Here the required success condition is only designated management sources can authenticate to SSH. The relevant evidence is: Only designated management sources can authenticate to SSH.

That approach concerns a different situation: a file server presents an SMB share writable by an account used across unrelated hosts. Shared writable resources and reused credentials can connect trust zones. The required result is that only designated management sources can authenticate to SSH. The relevant evidence is: Only designated management sources can authenticate to SSH.

That relates to a different issue: A network policy allows RDP from every employee laptop into a protected application server. Broad RDP exposure can facilitate cross-host movement. That is not a direct remedy for the requested outcome: Only designated management sources can authenticate to SSH. The relevant evidence is: Only designated management sources can authenticate to SSH.

That relates to a different issue: An approved lab uses Netcat to relay a simple TCP session through a second host. Relays obscure direct source-destination relationships. That is not a direct remedy for the requested outcome: An ordinary workstation cannot establish a protected RDP session. The relevant evidence is: An ordinary workstation cannot establish a protected RDP session.

It would address a host exposes a remote printing service on a restricted subnet and testers want to enumerate it. The relevant reason in that case is: Print services may bridge operating-system privileges and network segments. Here the required success condition is an ordinary workstation cannot establish a protected RDP session. The relevant evidence is: An ordinary workstation cannot establish a protected RDP session.

That approach concerns a different situation: a tester's lab traffic from a pivot host reaches a protected subnet not accessible directly. Pivoting uses an intermediate host to reach another zone. The required result is that an ordinary workstation cannot establish a protected RDP session. The relevant evidence is: An ordinary workstation cannot establish a protected RDP session.

That relates to a different issue: A customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. That is not a direct remedy for the requested outcome: The report proves the misconfiguration without modifying production IAM. The appropriate action is: Use read-only evidence and design a separately approved controlled proof.

It would address a team is about to test a service containing a safety-critical industrial controller. The relevant reason in that case is: Fragile and safety-related services need tailored test restrictions. Here the required success condition is the report proves the misconfiguration without modifying production IAM. The appropriate action is: Use read-only evidence and design a separately approved controlled proof.

This action applies to a different case: An assessor has a public proof of concept whose license and integrity are uncertain. Unknown exploit code may be malicious or destructive to the tester. It does not establish the present requirement, where the report proves the misconfiguration without modifying production IAM. The appropriate action is: Use read-only evidence and design a separately approved controlled proof.

This action applies to a different case: An approved lab shows NTLM network authentication may be accepted without a plaintext password. Reusable password-derived authentication material can be abused in some NTLM flows. It does not establish the present requirement, where a revoked or wrong-audience synthetic token is rejected after remediation. The appropriate action is: Identify pass-the-token risk and recommend short-lived, audience-bound tokens.

That approach concerns a different situation: a test user's reset flow issues single-use tokens that remain valid after consumption. One-time recovery tokens should be invalidated after successful use. The required result is that a revoked or wrong-audience synthetic token is rejected after remediation. The appropriate action is: Identify pass-the-token risk and recommend short-lived, audience-bound tokens.

It would address a tester identifies anonymous LDAP directory reads exposing sensitive account groups. The relevant reason in that case is: Directory enumeration can reveal high-value targets without account compromise. Here the required success condition is a revoked or wrong-audience synthetic token is rejected after remediation. The appropriate action is: Identify pass-the-token risk and recommend short-lived, audience-bound tokens.

It would address a cloud project has a cross-account role trust that permits principals outside the expected partner organization. The relevant reason in that case is: Cross-account trust can expand reach beyond intended organizational boundaries. Here the required success condition is the workload cannot list or modify unrelated namespace objects. The appropriate action is: Reduce the service account permissions and protect sensitive tokens.

This action applies to a different case: A service operator cannot determine whether a cloud attack attempt originated from a stolen temporary token. Temporary credential abuse requires identity and control-plane evidence. It does not establish the present requirement, where the workload cannot list or modify unrelated namespace objects. The appropriate action is: Reduce the service account permissions and protect sensitive tokens.

That relates to a different issue: A workload pod mounts the host filesystem and runs privileged with no operational need. Weak container isolation increases opportunities for host-level impact. That is not a direct remedy for the requested outcome: The workload cannot list or modify unrelated namespace objects. The appropriate action is: Reduce the service account permissions and protect sensitive tokens.

That relates to a different issue: A search endpoint concatenates raw query text into SQL statements. Data must not be interpreted as SQL syntax during query construction. That is not a direct remedy for the requested outcome: A harmless expression is displayed as data rather than evaluated. The appropriate action is: Identify server-side template injection and sandbox template expressions.

It would address a login rate limit can be bypassed because it counts only a mutable client-provided header. The relevant reason in that case is: Untrusted request headers should not control abuse enforcement. Here the required success condition is a harmless expression is displayed as data rather than evaluated. The appropriate action is: Identify server-side template injection and sandbox template expressions.

That approach concerns a different situation: a website allows a cross-site form to change an authenticated user's email without an anti-CSRF check. An authenticated browser can carry session cookies for unintended state-changing requests. The required result is that a harmless expression is displayed as data rather than evaluated. The appropriate action is: Identify server-side template injection and sandbox template expressions.

That approach concerns a different situation: a network weakness requires two earlier access conditions that are not present in the scoped lab. An attack chain is limited by its unmet prerequisite steps. The required result is that the prioritized target list identifies payment data and associated owners. The appropriate action is: Rank the payment system using high-value asset identification.

It would address a cloud service is misconfigured but the contract forbids modification of production access policies. The relevant reason in that case is: Exploitation must respect both target scope and permitted change types. Here the required success condition is the prioritized target list identifies payment data and associated owners. The appropriate action is: Rank the payment system using high-value asset identification.

This action applies to a different case: An assessor has a public proof of concept whose license and integrity are uncertain. Unknown exploit code may be malicious or destructive to the tester. It does not establish the present requirement, where the prioritized target list identifies payment data and associated owners. The appropriate action is: Rank the payment system using high-value asset identification.

This action applies to a different case: A scheduled Linux maintenance script is writable by a nonprivileged group but runs from root cron. Root-run scheduled code must be protected against untrusted modification. It does not establish the present requirement, where the script loads only reviewed modules after hardening. The appropriate action is: Review module path integrity and restrict who may modify imported code.

That approach concerns a different situation: a Linux helper binary has setuid enabled despite no demonstrated business requirement. Setuid changes execution privileges and can increase escalation impact. The required result is that the script loads only reviewed modules after hardening. The appropriate action is: Review module path integrity and restrict who may modify imported code.

It would address a Windows service binary directory is writable by ordinary users while the service runs as a privileged identity. The relevant reason in that case is: Writable privileged service artifacts can cross user-to-system trust boundaries. Here the required success condition is the script loads only reviewed modules after hardening. The appropriate action is: Review module path integrity and restrict who may modify imported code.

It would address a tester needs to analyze 802.11 management frames from an authorized lab capture. The relevant reason in that case is: Wireless tooling can inspect captures separately from active disruption. Here the required success condition is the output lists channel, BSSID, and signal level for in-scope radios. The relevant evidence is: The output lists channel, BSSID, and signal level for in-scope radios.

This result applies to a different case: A client wants automated evidence of publicly exposed devices by application or network signatures. Index data may be historical and should not itself trigger attacks. It does not establish the present requirement, where the output lists channel, BSSID, and signal level for in-scope radios. The relevant evidence is: The output lists channel, BSSID, and signal level for in-scope radios.

That relates to a different issue: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. That is not a direct remedy for the requested outcome: The output lists channel, BSSID, and signal level for in-scope radios. The relevant evidence is: The output lists channel, BSSID, and signal level for in-scope radios.