Exam Bundle

It would address an enterprise worries about privilege paths hidden within Active Directory group membership. The relevant reason in that case is: Graphing permissions can expose potential attack paths without executing them. Here the required success condition is the reported code path is verified before calling it an exploitable defect. The relevant evidence is: The reported code path is verified before calling it an exploitable defect.

That approach concerns a different situation: an internal application requires a comparison of its dependencies before and after a release. Changed packages alter exposure even if application source appears unchanged. The required result is that the reported code path is verified before calling it an exploitable defect. The relevant evidence is: The reported code path is verified before calling it an exploitable defect.

That relates to a different issue: A security pipeline may contain private API tokens in committed history. Secret detection should avoid creating new exposure in logs. That is not a direct remedy for the requested outcome: The reported code path is verified before calling it an exploitable defect. The relevant evidence is: The reported code path is verified before calling it an exploitable defect.

It would address a tester needs to discover running operating system services using only a read-only endpoint account. The relevant reason in that case is: Authenticated enumeration can identify services without exploiting them. Here the required success condition is the evidence lists third-party destinations without unauthorized probes. The relevant evidence is: The evidence lists third-party destinations without unauthorized probes.

This result applies to a different case: A service responds with a detailed stack trace that names its web framework and local file path. Verbose errors can expose implementation details useful for attack planning. It does not establish the present requirement, where the evidence lists third-party destinations without unauthorized probes. The relevant evidence is: The evidence lists third-party destinations without unauthorized probes.

That approach concerns a different situation: a portal uses an API host not listed among the contract's authorized DNS names. Front-end references do not implicitly authorize backend testing. The required result is that the evidence lists third-party destinations without unauthorized probes. The relevant evidence is: The evidence lists third-party destinations without unauthorized probes.

That approach concerns a different situation: a site survey finds two entrances to a data room, one with biometric checks and one with an unmonitored exit. Security is limited by the least protected route into the same zone. The required result is that the report uses redacted evidence and verifies disposal control ownership. The appropriate action is: Document insecure disposal and recommend approved destruction procedures.

That relates to a different issue: A reception area has cameras covering exits but not the badge reader at the server room. Physical monitoring coverage determines visibility into unauthorized access. That is not a direct remedy for the requested outcome: The report uses redacted evidence and verifies disposal control ownership. The appropriate action is: Document insecure disposal and recommend approved destruction procedures.

This action applies to a different case: A secure room's access logs show one badge opened the door repeatedly during an unoccupied shift. Access anomaly evidence is stronger when multiple sources agree. It does not establish the present requirement, where the report uses redacted evidence and verifies disposal control ownership. The appropriate action is: Document insecure disposal and recommend approved destruction procedures.

This action applies to a different case: A client wants to inspect traffic from an approved SPAN port during an application test. Packet analyzers reveal protocol exchanges without altering endpoints. It does not establish the present requirement, where a filter returns the expected DNS conversations from the immutable capture. The appropriate action is: Apply a tcpdump or Wireshark display filter for the relevant protocol and timestamp.

That approach concerns a different situation: an assessor needs to query current A, MX, and TXT records for a customer's domain. DNS command-line tools retrieve authoritative or resolver responses. The required result is that a filter returns the expected DNS conversations from the immutable capture. The appropriate action is: Apply a tcpdump or Wireshark display filter for the relevant protocol and timestamp.

That relates to a different issue: The engagement needs a passive mapping of email addresses published on customer sites. Public email discovery can reveal exposed identifiers without authentication. That is not a direct remedy for the requested outcome: A filter returns the expected DNS conversations from the immutable capture. The appropriate action is: Apply a tcpdump or Wireshark display filter for the relevant protocol and timestamp.

It would address a site map lists admin pages under a different product hostname than the approved portal. The relevant reason in that case is: Discovery by crawling must not override hostname restrictions. Here the required success condition is the graph identifies verified relationships without attempting privilege escalation. The appropriate action is: Construct an approved relationship graph from directory roles and group memberships.

That approach concerns a different situation: a server reports a plugin directory but no plugin version in HTTP headers. Plugin presence is not proof of a particular exploitable release. The required result is that the graph identifies verified relationships without attempting privilege escalation. The appropriate action is: Construct an approved relationship graph from directory roles and group memberships.

That relates to a different issue: An external DNS zone permits public records but the client has not authorized zone-transfer testing against its provider. A DNS service may be third-party managed and subject to additional restrictions. That is not a direct remedy for the requested outcome: The graph identifies verified relationships without attempting privilege escalation. The appropriate action is: Construct an approved relationship graph from directory roles and group memberships.

That relates to a different issue: A website allows a cross-site form to change an authenticated user's email without an anti-CSRF check. An authenticated browser can carry session cookies for unintended state-changing requests. That is not a direct remedy for the requested outcome: A synthetic client exceeds its quota and receives a controlled rate-limit response. The appropriate action is: Apply per-client request quotas and resource cost controls.

It would address a user logs out but an old test session cookie continues granting access. The relevant reason in that case is: Removing a cookie client-side does not necessarily revoke server authority. Here the required success condition is a synthetic client exceeds its quota and receives a controlled rate-limit response. The appropriate action is: Apply per-client request quotas and resource cost controls.

That approach concerns a different situation: a login system sends session cookies without Secure on an HTTPS-only site. Cookie attributes reduce exposure to transport and script risks. The required result is that a synthetic client exceeds its quota and receives a controlled rate-limit response. The appropriate action is: Apply per-client request quotas and resource cost controls.

That approach concerns a different situation: an assessment discovers a DNS alias that points from an approved hostname to a provider-owned domain. Aliases do not extend consent to the target infrastructure automatically. The required result is that the graph identifies verified relationships without attempting privilege escalation. The relevant evidence is: The graph identifies verified relationships without attempting privilege escalation.

That relates to a different issue: A target's CDN returns the same default page for every unknown URL. Uniform fallback responses can make missing endpoints appear valid. That is not a direct remedy for the requested outcome: The graph identifies verified relationships without attempting privilege escalation. The relevant evidence is: The graph identifies verified relationships without attempting privilege escalation.

This result applies to a different case: An LDAP directory query returns fewer user records than the account inventory provided by the owner. Enumeration completeness depends on query filters and directory permissions. It does not establish the present requirement, where the graph identifies verified relationships without attempting privilege escalation. The relevant evidence is: The graph identifies verified relationships without attempting privilege escalation.

This result applies to a different case: A lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. Scheduled execution can restore a foothold without an interactive login. It does not establish the present requirement, where the test process no longer starts after removing the entry. The relevant evidence is: The test process no longer starts after removing the entry.

That relates to a different issue: A C2 simulation in a sandbox uses periodic HTTP check-ins from an agent. Periodic callbacks can sustain remote tasking between interactions. That is not a direct remedy for the requested outcome: The test process no longer starts after removing the entry. The relevant evidence is: The test process no longer starts after removing the entry.

It would address a Windows endpoint contains a newly created service with a binary path outside approved software folders. The relevant reason in that case is: Services can restart unwanted binaries during boot. Here the required success condition is the test process no longer starts after removing the entry. The relevant evidence is: The test process no longer starts after removing the entry.

It would address a custom application service cannot be instrumented for IAST due to platform restrictions. The relevant reason in that case is: Testing technique choice must fit runtime access and instrumentation limits. Here the required success condition is the scan report includes current feed revision and update provenance. The relevant evidence is: The scan report includes current feed revision and update provenance.

This result applies to a different case: A network segment contains thousands of servers but the authorized scan engine is configured with unlimited concurrency. Assessment intensity can create operational risks independent of exploit payloads. It does not establish the present requirement, where the scan report includes current feed revision and update provenance. The relevant evidence is: The scan report includes current feed revision and update provenance.

That approach concerns a different situation: a team wants to identify weak settings on a test container but cannot inspect its internals. Container vulnerability analysis depends on the specific image and runtime conditions. The required result is that the scan report includes current feed revision and update provenance. The relevant evidence is: The scan report includes current feed revision and update provenance.

That relates to a different issue: An attacker places a plausible company-branded Wi-Fi login page in a public lobby. Impersonated access portals can collect user authentication data. That is not a direct remedy for the requested outcome: The exercise report distinguishes target group and safe campaign metrics. The appropriate action is: Identify whaling or targeted spearphishing rather than generic spam.

It would address a telephone caller impersonates a helpdesk employee and demands a one-time authentication code. The relevant reason in that case is: Voice pretexts can solicit secrets or bypass verification procedures. Here the required success condition is the exercise report distinguishes target group and safe campaign metrics. The appropriate action is: Identify whaling or targeted spearphishing rather than generic spam.

That approach concerns a different situation: an employee repeatedly follows strangers through secure doors during a role-play exercise. Physical social engineering can bypass identity checkpoints. The required result is that the exercise report distinguishes target group and safe campaign metrics. The appropriate action is: Identify whaling or targeted spearphishing rather than generic spam.

That approach concerns a different situation: a cloud VM snapshot is shared with another account unintentionally. Data snapshots can disclose sensitive disk content outside running systems. The required result is that the incident has attributable token issuer, principal, and API activity. The relevant evidence is: The incident has attributable token issuer, principal, and API activity.

It would address a public artifact repository accepts uploads under a shared build identity with no review process. The relevant reason in that case is: Unsigned or unauthorized artifacts can contaminate downstream releases. Here the required success condition is the incident has attributable token issuer, principal, and API activity. The relevant evidence is: The incident has attributable token issuer, principal, and API activity.

This result applies to a different case: A cloud identity policy grants wildcard actions on all resources to an automation job. Overly broad IAM permissions expand compromise impact. It does not establish the present requirement, where the incident has attributable token issuer, principal, and API activity. The relevant evidence is: The incident has attributable token issuer, principal, and API activity.