Exam Bundle

That approach concerns a different situation: a Windows application runs from a writable directory but claims its installer is signed. Signed installers do not guarantee continued integrity after deployment. The required result is that a designated test session cannot exit to a privileged shell. The relevant evidence is: A designated test session cannot exit to a privileged shell.

It would address a Windows service launches an executable using an unquoted path containing spaces. The relevant reason in that case is: Ambiguous executable paths matter only when lower-privilege users control a candidate location. Here the required success condition is a designated test session cannot exit to a privileged shell. The relevant evidence is: A designated test session cannot exit to a privileged shell.

This result applies to a different case: An endpoint protection tool flags a suspicious LOLBin process, but no malicious action is confirmed. Legitimate system binaries can support both administration and abuse. It does not establish the present requirement, where a designated test session cannot exit to a privileged shell. The relevant evidence is: A designated test session cannot exit to a privileged shell.

That approach concerns a different situation: a wireless survey sees several access points broadcasting the same SSID. SSID is a network name shared by multiple radios. The required result is that the authorization map lists principal, scope, and effective role. The appropriate action is: Request approved inventory of current role assignments for that principal.

That relates to a different issue: A tester needs to discover running operating system services using only a read-only endpoint account. Authenticated enumeration can identify services without exploiting them. That is not a direct remedy for the requested outcome: The authorization map lists principal, scope, and effective role. The appropriate action is: Request approved inventory of current role assignments for that principal.

It would address an assessment discovers a DNS alias that points from an approved hostname to a provider-owned domain. The relevant reason in that case is: Aliases do not extend consent to the target infrastructure automatically. Here the required success condition is the authorization map lists principal, scope, and effective role. The appropriate action is: Request approved inventory of current role assignments for that principal.

It would address an approved local wireless survey needs SSID channels and signal strengths without association. The relevant reason in that case is: Wireless analysis can inventory radios without authenticating to them. Here the required success condition is script results include invoked script name and operation limits. The relevant evidence is: Script results include invoked script name and operation limits.

This result applies to a different case: A tester needs an ownership hint for a domain's registration and delegated name servers. Registration metadata may identify contacts and service providers. It does not establish the present requirement, where script results include invoked script name and operation limits. The relevant evidence is: Script results include invoked script name and operation limits.

That approach concerns a different situation: a client wants automated evidence of publicly exposed devices by application or network signatures. Index data may be historical and should not itself trigger attacks. The required result is that script results include invoked script name and operation limits. The relevant evidence is: Script results include invoked script name and operation limits.

That relates to a different issue: A Windows machine auto-starts an unapproved process from a user-controlled registry Run key. Autostart registry paths can launch programs at sign-in. That is not a direct remedy for the requested outcome: A controlled network capture confirms the listening orientation. The appropriate action is: Identify the listening pattern as a bind shell rather than an outbound callback.

It would address a tester's controlled payload survives reboots through an unapproved login script. The relevant reason in that case is: Login scripts can reestablish code execution repeatedly. Here the required success condition is a controlled network capture confirms the listening orientation. The appropriate action is: Identify the listening pattern as a bind shell rather than an outbound callback.

This action applies to a different case: A Linux test host launches an unknown script daily from a root crontab. Cron entries provide recurring execution independent of user sessions. It does not establish the present requirement, where a controlled network capture confirms the listening orientation. The appropriate action is: Identify the listening pattern as a bind shell rather than an outbound callback.

That relates to a different issue: A tester needs an ownership hint for a domain's registration and delegated name servers. Registration metadata may identify contacts and service providers. That is not a direct remedy for the requested outcome: The candidate list contains source attribution and no active probes. The relevant evidence is: The candidate list contains source attribution and no active probes.

It would address the engagement needs a passive mapping of email addresses published on customer sites. The relevant reason in that case is: Public email discovery can reveal exposed identifiers without authentication. Here the required success condition is the candidate list contains source attribution and no active probes. The relevant evidence is: The candidate list contains source attribution and no active probes.

This result applies to a different case: A tester needs to analyze 802.11 management frames from an authorized lab capture. Wireless tooling can inspect captures separately from active disruption. It does not establish the present requirement, where the candidate list contains source attribution and no active probes. The relevant evidence is: The candidate list contains source attribution and no active probes.

This result applies to a different case: A site requires an inventory of TLS-enabled services without attempting authentication. TLS handshakes can describe certificate names and supported protocol families. It does not establish the present requirement, where the finding redacts content while retaining protocol and traffic evidence. The relevant evidence is: The finding redacts content while retaining protocol and traffic evidence.

That approach concerns a different situation: a security engineer needs to discover unmanaged assets visible at a site but cannot reach them from the test subnet. Visibility boundaries can limit an active scanner's completeness. The required result is that the finding redacts content while retaining protocol and traffic evidence. The relevant evidence is: The finding redacts content while retaining protocol and traffic evidence.

That relates to a different issue: An organization wants to identify potential service exposure from an approved public perimeter capture. Traffic analysis can reveal services not documented in current asset inventory. That is not a direct remedy for the requested outcome: The finding redacts content while retaining protocol and traffic evidence. The relevant evidence is: The finding redacts content while retaining protocol and traffic evidence.

It would address an exercise used a dedicated cloud API key that remains active after delivery. The relevant reason in that case is: Leaving tester credentials active creates unnecessary future access. Here the required success condition is a reviewed policy diff matches the approved baseline. The relevant evidence is: A reviewed policy diff matches the approved baseline.

This result applies to a different case: An assessor created a temporary directory account to validate scoped identity permissions. Tester-created identities can become lingering access paths. It does not establish the present requirement, where a reviewed policy diff matches the approved baseline. The relevant evidence is: A reviewed policy diff matches the approved baseline.

That relates to a different issue: A test changed a DNS entry to direct a synthetic domain toward a lab server. Incomplete restoration can disrupt normal routing after the test. That is not a direct remedy for the requested outcome: A reviewed policy diff matches the approved baseline. The relevant evidence is: A reviewed policy diff matches the approved baseline.

It would address a cloud product exposes IAM policies that allow wildcard administrative actions. The relevant reason in that case is: Cloud identity misconfiguration is a control-plane issue. Here the required success condition is a policy test flags the privileged mount in the intended workload. The relevant evidence is: A policy test flags the privileged mount in the intended workload.

This result applies to a different case: A security pipeline may contain private API tokens in committed history. Secret detection should avoid creating new exposure in logs. It does not establish the present requirement, where a policy test flags the privileged mount in the intended workload. The relevant evidence is: A policy test flags the privileged mount in the intended workload.

That approach concerns a different situation: a container repository may contain vulnerable dependencies absent from the running host inventory. Image-layer dependencies can be vulnerable even without an exposed network service. The required result is that a policy test flags the privileged mount in the intended workload. The relevant evidence is: A policy test flags the privileged mount in the intended workload.

That approach concerns a different situation: a tester needs to identify an industrial controller while the plant prohibits active protocol enumeration. Passive OT reconnaissance reduces risk of disrupting fragile control equipment. The required result is that the test yields a bounded port inventory with no disruption alerts. The relevant evidence is: The test yields a bounded port inventory with no disruption alerts.

That relates to a different issue: A server sends an ICMP destination-unreachable response during a UDP assessment. Certain ICMP unreachable codes are evidence of blocked or unavailable UDP destinations. That is not a direct remedy for the requested outcome: The test yields a bounded port inventory with no disruption alerts. The relevant evidence is: The test yields a bounded port inventory with no disruption alerts.

This result applies to a different case: A customer wants evidence that a network capture could expose plaintext application credentials. Plaintext transport makes credential material observable to network participants. It does not establish the present requirement, where the test yields a bounded port inventory with no disruption alerts. The relevant evidence is: The test yields a bounded port inventory with no disruption alerts.

This action applies to a different case: A threat intelligence feed marks a package as exploited but the application team calls its severity moderate. Exploitability and external exposure may elevate practical risk. It does not establish the present requirement, where the summary reconciles discovered hosts to the expected owner inventory. The appropriate action is: Investigate scanner reachability and target-list completeness before reporting progress.

That relates to a different issue: A scanner discovers a cloud service tag matching a vulnerable product but no accessible resource endpoint. Product labels do not alone prove exploitability. That is not a direct remedy for the requested outcome: The summary reconciles discovered hosts to the expected owner inventory. The appropriate action is: Investigate scanner reachability and target-list completeness before reporting progress.

It would address a scanner labels a host unreachable while a jump system sees it available. The relevant reason in that case is: Network visibility differs by source segment. Here the required success condition is the summary reconciles discovered hosts to the expected owner inventory. The appropriate action is: Investigate scanner reachability and target-list completeness before reporting progress.

It would address a web gateway trusts an unsigned JWT claim that a user is an administrator. The relevant reason in that case is: Untrusted token content must never grant privileged API access. Here the required success condition is a controlled concurrency test cannot produce an unauthorized state transition. The relevant evidence is: A controlled concurrency test cannot produce an unauthorized state transition.

This result applies to a different case: A JSON Web Token API accepts tokens with an unexpected algorithm or mismatched audience. JWT validation requires more than decoding a base64 payload. It does not establish the present requirement, where a controlled concurrency test cannot produce an unauthorized state transition. The relevant evidence is: A controlled concurrency test cannot produce an unauthorized state transition.

That approach concerns a different situation: an OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. The required result is that a controlled concurrency test cannot produce an unauthorized state transition. The relevant evidence is: A controlled concurrency test cannot produce an unauthorized state transition.