Exam Bundle

That approach concerns a different situation: a scheduled Linux maintenance script is writable by a nonprivileged group but runs from root cron. Root-run scheduled code must be protected against untrusted modification. The required result is that the test host rejects an untrusted driver under enforced policy. The appropriate action is: Report a driver-signing and application-control gap.

That relates to a different issue: A Windows application runs from a writable directory but claims its installer is signed. Signed installers do not guarantee continued integrity after deployment. That is not a direct remedy for the requested outcome: The test host rejects an untrusted driver under enforced policy. The appropriate action is: Report a driver-signing and application-control gap.

It would address a security agent is disabled by an ordinary user with local permissions. The relevant reason in that case is: Endpoint safeguards must resist unauthorized security-control changes. Here the required success condition is the test host rejects an untrusted driver under enforced policy. The appropriate action is: Report a driver-signing and application-control gap.

That approach concerns a different situation: a team plans to use Scapy to craft arbitrary network packets on a sensitive industrial segment. Packet crafting can bypass normal protocol safeguards and destabilize fragile systems. The required result is that a simulated retry yields one result and no second mutation. The relevant evidence is: A simulated retry yields one result and no second mutation.

That relates to a different issue: A tester wants to use PowerShell functions for recurring approved AD inventory steps. Reusable scripted functions improve repeatability and limit accidental actions. That is not a direct remedy for the requested outcome: A simulated retry yields one result and no second mutation. The relevant evidence is: A simulated retry yields one result and no second mutation.

It would address a security analyst wants to run Atomic Red Team tests but production containment could be triggered. The relevant reason in that case is: Breach-and-attack simulation must respect real business impact. Here the required success condition is a simulated retry yields one result and no second mutation. The relevant evidence is: A simulated retry yields one result and no second mutation.

This action applies to a different case: A tester plans to stage a 10 GB dataset for proof but the signed exfiltration budget is 1 MB. Demonstrating the data path does not require large transfers of client content. It does not establish the present requirement, where a forensic inventory detects the staged stream without executing it. The appropriate action is: Classify alternate data stream staging and inspect file metadata with approved tools.

That approach concerns a different situation: an authorized lab needs to test data staging without triggering production record changes. Controlled artifacts allow measurement of transfer behavior without real data exposure. The required result is that a forensic inventory detects the staged stream without executing it. The appropriate action is: Classify alternate data stream staging and inspect file metadata with approved tools.

That relates to a different issue: A Windows host maps a cloud-backed virtual drive through an unauthorized sync client. Mapped storage can move data outside conventional removable drives. That is not a direct remedy for the requested outcome: A forensic inventory detects the staged stream without executing it. The appropriate action is: Classify alternate data stream staging and inspect file metadata with approved tools.

That relates to a different issue: An assessor sees a TCP SYN-ACK from an in-scope host during a permitted probe. A SYN-ACK is evidence of a listening TCP service under ordinary conditions. That is not a direct remedy for the requested outcome: The report states the observed ICMP code and its qualified interpretation. The appropriate action is: Distinguish a closed UDP port from an open service based on the ICMP response type.

It would address a customer wants evidence that a network capture could expose plaintext application credentials. The relevant reason in that case is: Plaintext transport makes credential material observable to network participants. Here the required success condition is the report states the observed ICMP code and its qualified interpretation. The appropriate action is: Distinguish a closed UDP port from an open service based on the ICMP response type.

This action applies to a different case: A UDP application is suspected, but no response appears to a generic UDP probe. UDP scanning often lacks reliable positive replies without an application response. It does not establish the present requirement, where the report states the observed ICMP code and its qualified interpretation. The appropriate action is: Distinguish a closed UDP port from an open service based on the ICMP response type.

That approach concerns a different situation: a lab server accepts SMB authentication relayed from another service without enforcing signing. Unsigned authentication flows can be replayed or relayed across trust boundaries. The required result is that the audit names the risky template and excessive enrollment scope. The appropriate action is: Analyze template ACLs and issuance settings in the authorized directory inventory.

That relates to a different issue: A client wants to assess relay susceptibility without capturing employee credentials. Proof of authentication relay must avoid collection of unrelated secrets. That is not a direct remedy for the requested outcome: The audit names the risky template and excessive enrollment scope. The appropriate action is: Analyze template ACLs and issuance settings in the authorized directory inventory.

This action applies to a different case: A tester sees port 445 on an authorized server but has no credentials to enumerate its shares. Service availability is not the same as permission to enumerate protected resources. It does not establish the present requirement, where the audit names the risky template and excessive enrollment scope. The appropriate action is: Analyze template ACLs and issuance settings in the authorized directory inventory.

This action applies to a different case: An API returns sequential customer identifiers in JSON responses to a normal account. Guessable IDs alone are not proof of broken object authorization. It does not establish the present requirement, where the endpoint is only tested after customer ownership verification. The appropriate action is: Cross-check current cloud asset ownership before adding it to test targets.

That approach concerns a different situation: an external DNS zone permits public records but the client has not authorized zone-transfer testing against its provider. A DNS service may be third-party managed and subject to additional restrictions. The required result is that the endpoint is only tested after customer ownership verification. The appropriate action is: Cross-check current cloud asset ownership before adding it to test targets.

That relates to a different issue: A security review wants to map paths from a low-privilege directory user to high-value assets. Attack paths may depend on indirect privilege edges rather than direct role grants. That is not a direct remedy for the requested outcome: The endpoint is only tested after customer ownership verification. The appropriate action is: Cross-check current cloud asset ownership before adding it to test targets.

It would address a visitor uses an authorized staff member's badge replica in a test access system. The relevant reason in that case is: Copied credentials can bypass physical identity checks if unprotected. Here the required success condition is a site survey map identifies the uncovered entry point. The relevant evidence is: A site survey map identifies the uncovered entry point.

This result applies to a different case: A client wants to determine whether an employee can remotely open a door with another person's proximity badge. Authentication properties must be demonstrated without using actual employee identifiers. It does not establish the present requirement, where a site survey map identifies the uncovered entry point. The relevant evidence is: A site survey map identifies the uncovered entry point.

That approach concerns a different situation: a staff member encounters an unknown visitor attempting to enter a restricted work area. Policies require actual procedural enforcement, not only badge hardware. The required result is that a site survey map identifies the uncovered entry point. The relevant evidence is: A site survey map identifies the uncovered entry point.

It would address an IoT controller is sensitive to unexpected network packets during a vulnerability assessment. The relevant reason in that case is: Industrial and embedded systems can fail under ordinary IT scan traffic. Here the required success condition is the output maps approved radios to their channels and signal levels. The relevant evidence is: The output maps approved radios to their channels and signal levels.

This result applies to a different case: A repository includes a known vulnerable open-source library without obvious input paths. SCA identifies known risks in third-party packages at build time. It does not establish the present requirement, where the output maps approved radios to their channels and signal levels. The relevant evidence is: The output maps approved radios to their channels and signal levels.

That approach concerns a different situation: a test engineer wishes to find vulnerable applications in managed serverless services. Serverless resources lack direct host scanning but still have code and identity risks. The required result is that the output maps approved radios to their channels and signal levels. The relevant evidence is: The output maps approved radios to their channels and signal levels.

That approach concerns a different situation: a developer assumes process injection and process hollowing are equivalent terms. Host execution techniques differ in process lifecycle and memory manipulation. The required result is that the proof uses isolated test accounts and shows no client secret extraction. The relevant evidence is: The proof uses isolated test accounts and shows no client secret extraction.

That relates to a different issue: A Windows event log unexpectedly stops recording privileged actions during a test. Audit integrity is required to detect and investigate host compromise. That is not a direct remedy for the requested outcome: The proof uses isolated test accounts and shows no client secret extraction. The relevant evidence is: The proof uses isolated test accounts and shows no client secret extraction.

This result applies to a different case: A service startup configuration references an executable removed during a software upgrade. Missing service executables are not exploitable without a controllable replacement path. It does not establish the present requirement, where the proof uses isolated test accounts and shows no client secret extraction. The relevant evidence is: The proof uses isolated test accounts and shows no client secret extraction.

That approach concerns a different situation: an active test reveals evidence of a critical customer-data exposure while the weekly meeting is days away. Critical material findings require timely escalation outside routine reporting cadence. The required result is that the client accepts a documented impact-based escalation rationale. The appropriate action is: Explain the threat path and critical business dependencies that amplify impact.

That relates to a different issue: A remote client asks testers to send raw extracted authentication tokens by ordinary email. Sensitive evidence needs confidentiality and controlled recipients. That is not a direct remedy for the requested outcome: The client accepts a documented impact-based escalation rationale. The appropriate action is: Explain the threat path and critical business dependencies that amplify impact.

It would address two testers disagree on whether the observed login behavior is a genuine authorization bypass. The relevant reason in that case is: Independent review reduces false positives and inconsistent severity decisions. Here the required success condition is the client accepts a documented impact-based escalation rationale. The appropriate action is: Explain the threat path and critical business dependencies that amplify impact.

It would address an enterprise worries about privilege paths hidden within Active Directory group membership. The relevant reason in that case is: Graphing permissions can expose potential attack paths without executing them. Here the required success condition is the reported code path is verified before calling it an exploitable defect. The relevant evidence is: The reported code path is verified before calling it an exploitable defect.

That approach concerns a different situation: an internal application requires a comparison of its dependencies before and after a release. Changed packages alter exposure even if application source appears unchanged. The required result is that the reported code path is verified before calling it an exploitable defect. The relevant evidence is: The reported code path is verified before calling it an exploitable defect.

That relates to a different issue: A security pipeline may contain private API tokens in committed history. Secret detection should avoid creating new exposure in logs. That is not a direct remedy for the requested outcome: The reported code path is verified before calling it an exploitable defect. The relevant evidence is: The reported code path is verified before calling it an exploitable defect.