Exam Bundle

That approach concerns a different situation: a client asks testers to discover public subdomains without sending packets to the client's servers. Certificate issuance logs expose hostnames passively but do not prove current ownership. The required result is that the observed MX values match the latest authoritative zone response. The appropriate action is: Query authoritative DNS and compare MX records to the documented intended provider.

That relates to a different issue: A tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. Reverse names provide attribution hints but are not reliable proof of asset ownership. That is not a direct remedy for the requested outcome: The observed MX values match the latest authoritative zone response. The appropriate action is: Query authoritative DNS and compare MX records to the documented intended provider.

This action applies to a different case: An organization wants publicly exposed SSL certificate history for a retired hostname. Certificates can reveal previously registered names and issuance chronology. It does not establish the present requirement, where the observed MX values match the latest authoritative zone response. The appropriate action is: Query authoritative DNS and compare MX records to the documented intended provider.

This action applies to a different case: A Trojan-labeled binary claims to be a legitimate installer but performs unauthorized background operations. A Trojan conceals unwanted activity behind an apparently useful program. It does not establish the present requirement, where a standard test identity cannot stop the protective service. The appropriate action is: Classify security-control tampering and restore tamper protection.

That approach concerns a different situation: a web server begins making outbound connections even after the original test session ends. Server-side scripts can maintain remote control outside initial access. The required result is that a standard test identity cannot stop the protective service. The appropriate action is: Classify security-control tampering and restore tamper protection.

It would address a C2 simulation in a sandbox uses periodic HTTP check-ins from an agent. The relevant reason in that case is: Periodic callbacks can sustain remote tasking between interactions. Here the required success condition is a standard test identity cannot stop the protective service. The appropriate action is: Classify security-control tampering and restore tamper protection.

It would address a JSON Web Token API accepts tokens with an unexpected algorithm or mismatched audience. The relevant reason in that case is: JWT validation requires more than decoding a base64 payload. Here the required success condition is the previously issued test cookie is rejected after logout. The appropriate action is: Invalidate server-side sessions and refresh tokens during logout.

That approach concerns a different situation: a report generator uses user input inside its server-side template expression parser. Template engines may execute operators or expose objects when input is treated as syntax. The required result is that the previously issued test cookie is rejected after logout. The appropriate action is: Invalidate server-side sessions and refresh tokens during logout.

That relates to a different issue: A web scanner claims SQL injection because a quote produces an HTTP 500 response. Generic server errors do not prove attacker-controlled SQL execution. That is not a direct remedy for the requested outcome: The previously issued test cookie is rejected after logout. The appropriate action is: Invalidate server-side sessions and refresh tokens during logout.

That relates to a different issue: A test employee connects to a public-looking access point that offers the corporate SSID with a different certificate. Enterprise Wi-Fi trust should bind authentication to known infrastructure. That is not a direct remedy for the requested outcome: A safe test client cannot reach protected control interfaces. The relevant evidence is: A safe test client cannot reach protected control interfaces.

This result applies to a different case: A wireless security review notes that unauthenticated traffic can trigger large retransmission storms. Radio protocol abuse can affect availability without credential compromise. It does not establish the present requirement, where a safe test client cannot reach protected control interfaces. The relevant evidence is: A safe test client cannot reach protected control interfaces.

That approach concerns a different situation: a site uses WPS PIN enrollment on an access point that does not require it. Weak enrollment mechanisms may expose network credentials independently of WPA data encryption. The required result is that a safe test client cannot reach protected control interfaces. The relevant evidence is: A safe test client cannot reach protected control interfaces.

That approach concerns a different situation: a recon script classifies every non-200 HTTP response as an absent endpoint. Authentication and rate limiting are not equivalent to missing resources. The required result is that malformed ports are rejected while valid boundary ports are accepted. The relevant evidence is: Malformed ports are rejected while valid boundary ports are accepted.

That relates to a different issue: A test script logs raw bearer tokens while printing API request troubleshooting details. Diagnostic logs can become a second credential exposure path. That is not a direct remedy for the requested outcome: Malformed ports are rejected while valid boundary ports are accepted. The relevant evidence is: Malformed ports are rejected while valid boundary ports are accepted.

This result applies to a different case: A Bash host inventory script silently processes blank lines as targets. Input sanitation prevents accidental or malformed probe targets. It does not establish the present requirement, where malformed ports are rejected while valid boundary ports are accepted. The relevant evidence is: Malformed ports are rejected while valid boundary ports are accepted.

This action applies to a different case: A cloud team needs to check insecure Terraform settings before applying a new deployment. IaC scanning catches misconfigurations before infrastructure exists. It does not establish the present requirement, where scan logs show proper access and relevant configuration evidence. The appropriate action is: Use a supported Nessus or OpenVAS credentialed scan with reviewed accounts.

That relates to a different issue: A container repository may contain vulnerable dependencies absent from the running host inventory. Image-layer dependencies can be vulnerable even without an exposed network service. That is not a direct remedy for the requested outcome: Scan logs show proper access and relevant configuration evidence. The appropriate action is: Use a supported Nessus or OpenVAS credentialed scan with reviewed accounts.

It would address an analyst must assess an ICS network that lacks safe active vulnerability scanning windows. The relevant reason in that case is: Live probing can create safety and availability risk to industrial equipment. Here the required success condition is scan logs show proper access and relevant configuration evidence. The appropriate action is: Use a supported Nessus or OpenVAS credentialed scan with reviewed accounts.

It would address a security review wants to map paths from a low-privilege directory user to high-value assets. The relevant reason in that case is: Attack paths may depend on indirect privilege edges rather than direct role grants. Here the required success condition is the path remains untested until its inclusion in scope is confirmed. The relevant evidence is: The path remains untested until its inclusion in scope is confirmed.

This result applies to a different case: An external DNS zone permits public records but the client has not authorized zone-transfer testing against its provider. A DNS service may be third-party managed and subject to additional restrictions. It does not establish the present requirement, where the path remains untested until its inclusion in scope is confirmed. The relevant evidence is: The path remains untested until its inclusion in scope is confirmed.

That approach concerns a different situation: a server reports a plugin directory but no plugin version in HTTP headers. Plugin presence is not proof of a particular exploitable release. The required result is that the path remains untested until its inclusion in scope is confirmed. The relevant evidence is: The path remains untested until its inclusion in scope is confirmed.

That relates to a different issue: A login portal sees a few guesses for one password across many different usernames. Spraying tests one or few common secrets against many identities. That is not a direct remedy for the requested outcome: A controlled test proves the app detects reused credential attempts. The appropriate action is: Identify credential stuffing risk and validate defenses with synthetic accounts.

It would address a password audit uses fixed character positions with variable numeric suffixes on synthetic hashes. The relevant reason in that case is: Mask attacks constrain guesses by a specified character pattern. Here the required success condition is a controlled test proves the app detects reused credential attempts. The appropriate action is: Identify credential stuffing risk and validate defenses with synthetic accounts.

That approach concerns a different situation: one account receives hundreds of password guesses in a short period. Brute force concentrates many guesses against one identity. The required result is that a controlled test proves the app detects reused credential attempts. The appropriate action is: Identify credential stuffing risk and validate defenses with synthetic accounts.

That approach concerns a different situation: a limited-scope assessment needs the list of responding ports without overwhelming a fragile legacy gateway. Discovery intensity must reflect operational constraints and written permission. The required result is that the protocol and device observations derive from permitted capture data. The appropriate action is: Inspect an approved mirrored traffic capture instead of probing the controller.

That relates to a different issue: A site requires an inventory of TLS-enabled services without attempting authentication. TLS handshakes can describe certificate names and supported protocol families. That is not a direct remedy for the requested outcome: The protocol and device observations derive from permitted capture data. The appropriate action is: Inspect an approved mirrored traffic capture instead of probing the controller.

This action applies to a different case: An organization wants to identify potential service exposure from an approved public perimeter capture. Traffic analysis can reveal services not documented in current asset inventory. It does not establish the present requirement, where the protocol and device observations derive from permitted capture data. The appropriate action is: Inspect an approved mirrored traffic capture instead of probing the controller.

This result applies to a different case: The client's network team publishes a list of routable and private subnets with overlapping names. Incorrect network arithmetic can accidentally scan unauthorized ranges. It does not establish the present requirement, where the report distinguishes banner claims from confirmed deployed versions. The relevant evidence is: The report distinguishes banner claims from confirmed deployed versions.

That approach concerns a different situation: an assessor attempts to correlate a domain's A, AAAA, and CNAME records before testing. DNS aliases and address families can point to differently owned endpoints. The required result is that the report distinguishes banner claims from confirmed deployed versions. The relevant evidence is: The report distinguishes banner claims from confirmed deployed versions.

That relates to a different issue: A limited-scope assessment needs the list of responding ports without overwhelming a fragile legacy gateway. Discovery intensity must reflect operational constraints and written permission. That is not a direct remedy for the requested outcome: The report distinguishes banner claims from confirmed deployed versions. The relevant evidence is: The report distinguishes banner claims from confirmed deployed versions.

This result applies to a different case: A cloud team worries that an old object storage endpoint is indexed in search results. Search indices can disclose public paths even after application navigation changes. It does not establish the present requirement, where the finding contains redacted exposure proof and no unauthorized sign-ins. The relevant evidence is: The finding contains redacted exposure proof and no unauthorized sign-ins.

That approach concerns a different situation: a company cannot explain why an old DNS mail exchanger still appears in public records. Current DNS answers identify public mail routing independently of internal diagrams. The required result is that the finding contains redacted exposure proof and no unauthorized sign-ins. The relevant evidence is: The finding contains redacted exposure proof and no unauthorized sign-ins.

That relates to a different issue: A tester's passive source lists an IP as belonging to a vendor, but the contract targets the customer only. Internet intelligence results may have stale service ownership attribution. That is not a direct remedy for the requested outcome: The finding contains redacted exposure proof and no unauthorized sign-ins. The relevant evidence is: The finding contains redacted exposure proof and no unauthorized sign-ins.