Exam Bundle

It would address a tester needs to analyze 802.11 management frames from an authorized lab capture. The relevant reason in that case is: Wireless tooling can inspect captures separately from active disruption. Here the required success condition is the output lists channel, BSSID, and signal level for in-scope radios. The relevant evidence is: The output lists channel, BSSID, and signal level for in-scope radios.

This result applies to a different case: A client wants automated evidence of publicly exposed devices by application or network signatures. Index data may be historical and should not itself trigger attacks. It does not establish the present requirement, where the output lists channel, BSSID, and signal level for in-scope radios. The relevant evidence is: The output lists channel, BSSID, and signal level for in-scope radios.

That relates to a different issue: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. That is not a direct remedy for the requested outcome: The output lists channel, BSSID, and signal level for in-scope radios. The relevant evidence is: The output lists channel, BSSID, and signal level for in-scope radios.

It would address an analyst needs an offline password strength assessment but policy prohibits online guessing. The relevant reason in that case is: Offline password auditing can measure weakness without account lockouts. Here the required success condition is the evidence documents the safe test account and bounded requests. The relevant evidence is: The evidence documents the safe test account and bounded requests.

This result applies to a different case: A lab's Kerberos service accounts use weak reusable secrets with no rotation plan. Weak long-lived service account credentials expand ticket abuse risk. It does not establish the present requirement, where the evidence documents the safe test account and bounded requests. The relevant evidence is: The evidence documents the safe test account and bounded requests.

That approach concerns a different situation: a website returns a different error for nonexisting usernames even when all passwords fail. Error consistency prevents disclosure of valid account identities. The required result is that the evidence documents the safe test account and bounded requests. The relevant evidence is: The evidence documents the safe test account and bounded requests.

That approach concerns a different situation: a tester needs a structured penetration testing workflow from pre-engagement to reporting. PTES explicitly addresses preparation, discovery, exploitation, and reporting. The required result is that the methodology document maps test channels to defined observations. The appropriate action is: Evaluate OSSTMM as a structured operational security testing methodology.

That relates to a different issue: A risk workshop rates damage potential, exploitability, and discoverability for a threat. DREAD is a threat prioritization model with defined factor categories. That is not a direct remedy for the requested outcome: The methodology document maps test channels to defined observations. The appropriate action is: Evaluate OSSTMM as a structured operational security testing methodology.

It would address an architect needs to categorize a forged authenticated principal in a design diagram. The relevant reason in that case is: Spoofing concerns impersonating an identity or authentication claim. Here the required success condition is the methodology document maps test channels to defined observations. The appropriate action is: Evaluate OSSTMM as a structured operational security testing methodology.

This result applies to a different case: Employees frequently enter a controlled warehouse door by carrying boxes that obstruct badge presentation. Operational processes can unintentionally defeat physical control design. It does not establish the present requirement, where a controlled visitor is denied at every relevant entrance. The relevant evidence is: A controlled visitor is denied at every relevant entrance.

That approach concerns a different situation: a factory prohibits onsite photography but a tester wants to document an unmonitored side gate. Physical evidence collection remains bound by facility security policy. The required result is that a controlled visitor is denied at every relevant entrance. The relevant evidence is: A controlled visitor is denied at every relevant entrance.

That relates to a different issue: An assessor finds a portable storage device labeled 'payroll' left in an office lobby. Lures can induce unauthorized device execution or data disclosure. That is not a direct remedy for the requested outcome: A controlled visitor is denied at every relevant entrance. The relevant evidence is: A controlled visitor is denied at every relevant entrance.

It would address an internal team finds unexpected use of PsExec on an accounting server. The relevant reason in that case is: PsExec-style remote execution creates traceable service and process artifacts. Here the required success condition is the timeline links the route change to an authorized or unapproved process. The appropriate action is: Inspect route table changes and correlate the process that made them.

That approach concerns a different situation: a second network segment is reached through an unauthorized proxy running on an intermediate device. Intermediaries can bypass intended segmentation when routing rules are weak. The required result is that the timeline links the route change to an authorized or unapproved process. The appropriate action is: Inspect route table changes and correlate the process that made them.

That relates to a different issue: An incident team finds a suspicious process invoking remote PowerShell but no indication of the target machine. Remote management artifacts must be connected to endpoints to assess movement. That is not a direct remedy for the requested outcome: The timeline links the route change to an authorized or unapproved process. The appropriate action is: Inspect route table changes and correlate the process that made them.

That relates to a different issue: A targeted text asks employees to visit a fake payroll verification link. Smishing delivers phishing lures through text messaging. That is not a direct remedy for the requested outcome: Messages go only to the permitted synthetic or opt-in recipients. The relevant evidence is: Messages go only to the permitted synthetic or opt-in recipients.

It would address a malicious message is tailored to a financial executive's current acquisition project. The relevant reason in that case is: Role-specific pretexts can increase credibility with high-value individuals. Here the required success condition is messages go only to the permitted synthetic or opt-in recipients. The relevant evidence is: Messages go only to the permitted synthetic or opt-in recipients.

This result applies to a different case: An attacker places a plausible company-branded Wi-Fi login page in a public lobby. Impersonated access portals can collect user authentication data. It does not establish the present requirement, where messages go only to the permitted synthetic or opt-in recipients. The relevant evidence is: Messages go only to the permitted synthetic or opt-in recipients.

That approach concerns a different situation: a client changes its target business objective midway through an authorized engagement. Material objective changes can affect budget, risk, and scope. The required result is that the case has an acknowledged urgent notification and incident owner. The appropriate action is: Notify the named emergency stakeholder through the approved escalation channel immediately.

That relates to a different issue: A remote client asks testers to send raw extracted authentication tokens by ordinary email. Sensitive evidence needs confidentiality and controlled recipients. That is not a direct remedy for the requested outcome: The case has an acknowledged urgent notification and incident owner. The appropriate action is: Notify the named emergency stakeholder through the approved escalation channel immediately.

It would address the final demonstration was technically complete but the customer has not confirmed acceptance criteria. The relevant reason in that case is: Contractual delivery is not identical to internal test completion. Here the required success condition is the case has an acknowledged urgent notification and incident owner. The appropriate action is: Notify the named emergency stakeholder through the approved escalation channel immediately.

This action applies to a different case: A Windows kiosk permits access to a general command shell through a settings shortcut. Single-purpose devices should not expose general operating-system controls. It does not establish the present requirement, where the installed directory ACL denies unprivileged replacement of program files. The appropriate action is: Protect runtime binary and DLL paths in addition to installer authenticity.

That approach concerns a different situation: a penetration tester identifies an accessible PowerShell script that imports a privileged module from a writable directory. Dynamic module loading can cross privilege boundaries if paths are user-controlled. The required result is that the installed directory ACL denies unprivileged replacement of program files. The appropriate action is: Protect runtime binary and DLL paths in addition to installer authenticity.

It would address a client wants a Mimikatz demonstration but its authorization excludes any extraction of live credentials. The relevant reason in that case is: Credential tools can expose sensitive data beyond the intended objective. Here the required success condition is the installed directory ACL denies unprivileged replacement of program files. The appropriate action is: Protect runtime binary and DLL paths in addition to installer authenticity.

It would address a shell script checks whether a discovered address is inside a permitted CIDR range using string prefixes. The relevant reason in that case is: Textual prefix matching is not correct network arithmetic. Here the required success condition is a fixture with missing fields completes and marks the value unknown. The relevant evidence is: A fixture with missing fields completes and marks the value unknown.

That approach concerns a different situation: a script retries failed probes indefinitely when an endpoint is unavailable. Retry storms can cause avoidable service impact and unreliable results. The required result is that a fixture with missing fields completes and marks the value unknown. The relevant evidence is: A fixture with missing fields completes and marks the value unknown.

That relates to a different issue: A Python reconnaissance script stops after the first page of API results. APIs commonly limit each response and require explicit continuation. That is not a direct remedy for the requested outcome: A fixture with missing fields completes and marks the value unknown. The relevant evidence is: A fixture with missing fields completes and marks the value unknown.

It would address a team wants an assessment of a Kubernetes cluster while its production workloads cannot tolerate attack simulation. The relevant reason in that case is: Kubernetes posture assessment can identify weak RBAC and workloads without disrupting them. Here the required success condition is the report states which routes were blocked and not verified. The relevant evidence is: The report states which routes were blocked and not verified.

This result applies to a different case: A cloud product exposes IAM policies that allow wildcard administrative actions. Cloud identity misconfiguration is a control-plane issue. It does not establish the present requirement, where the report states which routes were blocked and not verified. The relevant evidence is: The report states which routes were blocked and not verified.

That approach concerns a different situation: an internal application requires a comparison of its dependencies before and after a release. Changed packages alter exposure even if application source appears unchanged. The required result is that the report states which routes were blocked and not verified. The relevant evidence is: The report states which routes were blocked and not verified.

That approach concerns a different situation: a client wants the passive discovery of hosts from public certificate names and DNS records. Multiple passive sources reduce the chance of relying on a stale artifact. The required result is that the report contains only role patterns and privacy-appropriate citations. The relevant evidence is: The report contains only role patterns and privacy-appropriate citations.

That relates to a different issue: A company cannot explain why an old DNS mail exchanger still appears in public records. Current DNS answers identify public mail routing independently of internal diagrams. That is not a direct remedy for the requested outcome: The report contains only role patterns and privacy-appropriate citations. The relevant evidence is: The report contains only role patterns and privacy-appropriate citations.

This result applies to a different case: A cloud team worries that an old object storage endpoint is indexed in search results. Search indices can disclose public paths even after application navigation changes. It does not establish the present requirement, where the report contains only role patterns and privacy-appropriate citations. The relevant evidence is: The report contains only role patterns and privacy-appropriate citations.