Exam Bundle

It would address a web gateway trusts an unsigned JWT claim that a user is an administrator. The relevant reason in that case is: Untrusted token content must never grant privileged API access. Here the required success condition is a controlled concurrency test cannot produce an unauthorized state transition. The relevant evidence is: A controlled concurrency test cannot produce an unauthorized state transition.

This result applies to a different case: A JSON Web Token API accepts tokens with an unexpected algorithm or mismatched audience. JWT validation requires more than decoding a base64 payload. It does not establish the present requirement, where a controlled concurrency test cannot produce an unauthorized state transition. The relevant evidence is: A controlled concurrency test cannot produce an unauthorized state transition.

That approach concerns a different situation: an OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. The required result is that a controlled concurrency test cannot produce an unauthorized state transition. The relevant evidence is: A controlled concurrency test cannot produce an unauthorized state transition.

That relates to a different issue: A web application's LDAP filter directly concatenates a username field. Unescaped filter meta-characters can alter directory query meaning. That is not a direct remedy for the requested outcome: An expired test ticket is rejected and clock drift is measured. The relevant evidence is: An expired test ticket is rejected and clock drift is measured.

It would address a lab's Kerberos service accounts use weak reusable secrets with no rotation plan. The relevant reason in that case is: Weak long-lived service account credentials expand ticket abuse risk. Here the required success condition is an expired test ticket is rejected and clock drift is measured. The relevant evidence is: An expired test ticket is rejected and clock drift is measured.

That approach concerns a different situation: a stolen application bearer token allows an API call without further challenge in a lab. Bearer tokens can authorize access for whoever possesses them. The required result is that an expired test ticket is rejected and clock drift is measured. The relevant evidence is: An expired test ticket is rejected and clock drift is measured.

That approach concerns a different situation: a threat model asks which category covers an attacker changing stored invoice values. STRIDE describes six threat classes, including unauthorized modification. The required result is that the test plan identifies deliverables for each agreed methodology phase. The relevant evidence is: The test plan identifies deliverables for each agreed methodology phase.

It would address a SOC wants observed adversary behavior mapped to detection technique identifiers. The relevant reason in that case is: ATT&CK classifies adversary behavior rather than providing a full test contract. Here the required success condition is the test plan identifies deliverables for each agreed methodology phase. The relevant evidence is: The test plan identifies deliverables for each agreed methodology phase.

This result applies to a different case: An industrial plant needs a diagram of enterprise, supervisory, and process-control zones. Purdue levels organize industrial control network functions and boundaries. It does not establish the present requirement, where the test plan identifies deliverables for each agreed methodology phase. The relevant evidence is: The test plan identifies deliverables for each agreed methodology phase.

This action applies to a different case: A team needs to reuse certificate parsing logic across several safe recon tasks. Reusable functions reduce divergent parsing behavior across scripts. It does not establish the present requirement, where the parsed service name is preserved for multiword banners. The appropriate action is: Use a structured output format or robust quoting-aware parsing.

That relates to a different issue: A Bash host inventory script silently processes blank lines as targets. Input sanitation prevents accidental or malformed probe targets. That is not a direct remedy for the requested outcome: The parsed service name is preserved for multiword banners. The appropriate action is: Use a structured output format or robust quoting-aware parsing.

It would address a team wants to correlate results from Bash, Python, and PowerShell utilities. The relevant reason in that case is: Consistent output fields support reproducible, attributable analysis. Here the required success condition is the parsed service name is preserved for multiword banners. The appropriate action is: Use a structured output format or robust quoting-aware parsing.

It would address an old exposed service is at end of life with no maintained security updates. The relevant reason in that case is: Unsupported systems may have unfixable exposure and high business risk. Here the required success condition is the diagram labels each confirmed and unconfirmed step. The relevant evidence is: The diagram labels each confirmed and unconfirmed step.

This result applies to a different case: An assessment uses only a CVSS number to estimate the likelihood of active exploitation. EPSS estimates exploitation likelihood rather than vulnerability impact. It does not establish the present requirement, where the diagram labels each confirmed and unconfirmed step. The relevant evidence is: The diagram labels each confirmed and unconfirmed step.

That approach concerns a different situation: a tester selects an attack tool because it is familiar, not because it matches target protocol. Tool choice should be threat-led and technically appropriate. The required result is that the diagram labels each confirmed and unconfirmed step. The relevant evidence is: The diagram labels each confirmed and unconfirmed step.

That relates to a different issue: A portal uses an API host not listed among the contract's authorized DNS names. Front-end references do not implicitly authorize backend testing. That is not a direct remedy for the requested outcome: Synthetic controls demonstrate whether the error differs by account existence. The relevant evidence is: Synthetic controls demonstrate whether the error differs by account existence.

It would address a wireless survey sees several access points broadcasting the same SSID. The relevant reason in that case is: SSID is a network name shared by multiple radios. Here the required success condition is synthetic controls demonstrate whether the error differs by account existence. The relevant evidence is: Synthetic controls demonstrate whether the error differs by account existence.

This result applies to a different case: A website publishes robots.txt paths for a legacy backup directory. Robots exclusions are crawler advice, not an authorization boundary. It does not establish the present requirement, where synthetic controls demonstrate whether the error differs by account existence. The relevant evidence is: Synthetic controls demonstrate whether the error differs by account existence.

That approach concerns a different situation: a compromised community website frequently used by a particular department redirects users to unsafe content. Trusted browsing habits can expose targeted groups to hostile sites. The required result is that the assessment contains no unapproved disposal-site collection. The relevant evidence is: The assessment contains no unapproved disposal-site collection.

It would address a malicious message is tailored to a financial executive's current acquisition project. The relevant reason in that case is: Role-specific pretexts can increase credibility with high-value individuals. Here the required success condition is the assessment contains no unapproved disposal-site collection. The relevant evidence is: The assessment contains no unapproved disposal-site collection.

This result applies to a different case: An attacker places a plausible company-branded Wi-Fi login page in a public lobby. Impersonated access portals can collect user authentication data. It does not establish the present requirement, where the assessment contains no unapproved disposal-site collection. The relevant evidence is: The assessment contains no unapproved disposal-site collection.

This result applies to a different case: A Python test harness submits the same harmless API validation twice after a timeout. Retries must not produce duplicate state changes in a target app. It does not establish the present requirement, where the test fixture stops at its request limit and honors retry guidance. The relevant evidence is: The test fixture stops at its request limit and honors retry guidance.

That approach concerns a different situation: an assessment writes temporary sensitive artifacts to a shared world-readable system directory. Automation outputs can contain client intelligence needing protection. The required result is that the test fixture stops at its request limit and honors retry guidance. The relevant evidence is: The test fixture stops at its request limit and honors retry guidance.

It would address a scripted lab assessment stores authorized targets in a fixed text file but includes one malformed external domain. The relevant reason in that case is: Automation magnifies the impact of input mistakes. Here the required success condition is the test fixture stops at its request limit and honors retry guidance. The relevant evidence is: The test fixture stops at its request limit and honors retry guidance.

It would address a company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. The relevant reason in that case is: Service-disruption methods require explicit risk and impact authorization. Here the required success condition is a controlled client rejects an unapproved proxy configuration. The appropriate action is: Assess WPAD/proxy trust and require authenticated configuration sources.

This action applies to a different case: A corporate access point sends users to a captive portal that allows arbitrary external form pages. Captive portals can be impersonated to harvest user credentials. It does not establish the present requirement, where a controlled client rejects an unapproved proxy configuration. The appropriate action is: Assess WPAD/proxy trust and require authenticated configuration sources.

That approach concerns a different situation: a wireless security review notes that unauthenticated traffic can trigger large retransmission storms. Radio protocol abuse can affect availability without credential compromise. The required result is that a controlled client rejects an unapproved proxy configuration. The appropriate action is: Assess WPAD/proxy trust and require authenticated configuration sources.

That relates to a different issue: A cloud provider permits vulnerability scanning only under defined acceptable-use conditions. A customer's permission cannot override a hosting provider's contractual constraints. That is not a direct remedy for the requested outcome: The exchanged diagrams are covered by a signed confidentiality agreement. The relevant evidence is: The exchanged diagrams are covered by a signed confidentiality agreement.

It would address a client and supplier agree on ongoing terms, but the current test's exact hosts and dates are unrecorded. The relevant reason in that case is: The statement of work defines this particular engagement's operational boundaries. Here the required success condition is the exchanged diagrams are covered by a signed confidentiality agreement. The relevant evidence is: The exchanged diagrams are covered by a signed confidentiality agreement.

This result applies to a different case: The client asks which contract establishes general payment and liability terms across annual projects. An MSA typically governs the continuing commercial relationship. It does not establish the present requirement, where the exchanged diagrams are covered by a signed confidentiality agreement. The relevant evidence is: The exchanged diagrams are covered by a signed confidentiality agreement.

That approach concerns a different situation: a scheduled Linux maintenance script is writable by a nonprivileged group but runs from root cron. Root-run scheduled code must be protected against untrusted modification. The required result is that the test host rejects an untrusted driver under enforced policy. The appropriate action is: Report a driver-signing and application-control gap.

That relates to a different issue: A Windows application runs from a writable directory but claims its installer is signed. Signed installers do not guarantee continued integrity after deployment. That is not a direct remedy for the requested outcome: The test host rejects an untrusted driver under enforced policy. The appropriate action is: Report a driver-signing and application-control gap.

It would address a security agent is disabled by an ordinary user with local permissions. The relevant reason in that case is: Endpoint safeguards must resist unauthorized security-control changes. Here the required success condition is the test host rejects an untrusted driver under enforced policy. The appropriate action is: Report a driver-signing and application-control gap.