Exam Bundle

This result applies to a different case: A client asks testers to discover public subdomains without sending packets to the client's servers. Certificate issuance logs expose hostnames passively but do not prove current ownership. It does not establish the present requirement, where the observed MX values match the latest authoritative zone response. The relevant evidence is: The observed MX values match the latest authoritative zone response.

That approach concerns a different situation: a client wants the passive discovery of hosts from public certificate names and DNS records. Multiple passive sources reduce the chance of relying on a stale artifact. The required result is that the observed MX values match the latest authoritative zone response. The relevant evidence is: The observed MX values match the latest authoritative zone response.

That relates to a different issue: An organization wants publicly exposed SSL certificate history for a retired hostname. Certificates can reveal previously registered names and issuance chronology. That is not a direct remedy for the requested outcome: The observed MX values match the latest authoritative zone response. The relevant evidence is: The observed MX values match the latest authoritative zone response.

That relates to a different issue: A client lists 10.40.0.0/24 as the only authorized internal range, but an asset resolves to 10.41.0.8. A resolved IP outside the signed CIDR range is not automatically included. That is not a direct remedy for the requested outcome: Logs show no requests to the third-party host before approval. The appropriate action is: Exclude the hostname until the third party issues explicit written authorization.

It would address a cloud provider permits vulnerability scanning only under defined acceptable-use conditions. The relevant reason in that case is: A customer's permission cannot override a hosting provider's contractual constraints. Here the required success condition is logs show no requests to the third-party host before approval. The appropriate action is: Exclude the hostname until the third party issues explicit written authorization.

That approach concerns a different situation: a researcher uncovers likely personal data during an authorized test of a public portal. Authorization to test does not grant unlimited personal-data collection. The required result is that logs show no requests to the third-party host before approval. The appropriate action is: Exclude the hostname until the third party issues explicit written authorization.

That approach concerns a different situation: a server sends an ICMP destination-unreachable response during a UDP assessment. Certain ICMP unreachable codes are evidence of blocked or unavailable UDP destinations. The required result is that host presence is inferred from safe observed protocol replies. The appropriate action is: Use other authorized host-discovery signals rather than declaring the host absent.

That relates to a different issue: A UDP application is suspected, but no response appears to a generic UDP probe. UDP scanning often lacks reliable positive replies without an application response. That is not a direct remedy for the requested outcome: Host presence is inferred from safe observed protocol replies. The appropriate action is: Use other authorized host-discovery signals rather than declaring the host absent.

This action applies to a different case: A tester needs to identify an industrial controller while the plant prohibits active protocol enumeration. Passive OT reconnaissance reduces risk of disrupting fragile control equipment. It does not establish the present requirement, where host presence is inferred from safe observed protocol replies. The appropriate action is: Use other authorized host-discovery signals rather than declaring the host absent.

This action applies to a different case: A model endpoint outputs confidential training examples when prompted with generic cues. Model behavior can expose sensitive memorized data. It does not establish the present requirement, where the test handset blocks unapproved messages while normal pairing works. The appropriate action is: Classify bluejacking or Bluetooth spamming and enforce pairing/message restrictions.

That approach concerns a different situation: an AI assistant retrieves an untrusted web page that contains instructions to send private documents. Untrusted source data must not gain authority over tool operations. The required result is that the test handset blocks unapproved messages while normal pairing works. The appropriate action is: Classify bluejacking or Bluetooth spamming and enforce pairing/message restrictions.

It would address a security engineer needs to inspect BLE advertising data for an approved IoT sensor. The relevant reason in that case is: Bluetooth advertisement fields can disclose device information passively. Here the required success condition is the test handset blocks unapproved messages while normal pairing works. The appropriate action is: Classify bluejacking or Bluetooth spamming and enforce pairing/message restrictions.

It would address a client shares a URL containing a deep path but excludes the administrative console on the same host. The relevant reason in that case is: URL-level exclusions can narrow a host-level test authorization. Here the required success condition is the project file includes owner identity and a signed permission letter. The relevant evidence is: The project file includes owner identity and a signed permission letter.

This result applies to a different case: An authorized tester is invited to inspect an adjacent subsidiary that is absent from the signed contract. Corporate affiliation does not automatically extend scoped legal permission. It does not establish the present requirement, where the project file includes owner identity and a signed permission letter. The relevant evidence is: The project file includes owner identity and a signed permission letter.

That relates to a different issue: A client lists 10.40.0.0/24 as the only authorized internal range, but an asset resolves to 10.41.0.8. A resolved IP outside the signed CIDR range is not automatically included. That is not a direct remedy for the requested outcome: The project file includes owner identity and a signed permission letter. The relevant evidence is: The project file includes owner identity and a signed permission letter.

That relates to a different issue: An industrial plant needs a diagram of enterprise, supervisory, and process-control zones. Purdue levels organize industrial control network functions and boundaries. That is not a direct remedy for the requested outcome: The documented threat is classified as tampering with a protective control. The relevant evidence is: The documented threat is classified as tampering with a protective control.

It would address a mobile team needs verification criteria for client-side storage and authentication controls. The relevant reason in that case is: MASVS defines mobile application security verification requirements. Here the required success condition is the documented threat is classified as tampering with a protective control. The relevant evidence is: The documented threat is classified as tampering with a protective control.

This result applies to a different case: An architect needs to categorize a forged authenticated principal in a design diagram. Spoofing concerns impersonating an identity or authentication claim. It does not establish the present requirement, where the documented threat is classified as tampering with a protective control. The relevant evidence is: The documented threat is classified as tampering with a protective control.

That approach concerns a different situation: a report generator uses user input inside its server-side template expression parser. Template engines may execute operators or expose objects when input is treated as syntax. The required result is that a forged admin claim in a test token cannot access privileged routes. The appropriate action is: Require signature verification and server-side authorization before accepting claims.

It would address a picture import URL is fetched by a server with access to internal service endpoints. The relevant reason in that case is: User-supplied destinations can redirect server trust to internal resources. Here the required success condition is a forged admin claim in a test token cannot access privileged routes. The appropriate action is: Require signature verification and server-side authorization before accepting claims.

This action applies to a different case: A theme installer accepts an external URL that is included into server-side code execution. Server execution should not import untrusted remote code. It does not establish the present requirement, where a forged admin claim in a test token cannot access privileged routes. The appropriate action is: Require signature verification and server-side authorization before accepting claims.

This result applies to a different case: A basic directory brute-force wordlist causes rate limits and exceeds the test request budget. Automated enumeration must honor request limits and detection agreements. It does not establish the present requirement, where only allowed pages appear in the final crawl evidence. The relevant evidence is: Only allowed pages appear in the final crawl evidence.

That approach concerns a different situation: an assessment needs an inventory of publicly accessible cloud buckets under the customer's account. Cloud access posture must be confirmed at both resource and data-plane levels. The required result is that only allowed pages appear in the final crawl evidence. The relevant evidence is: Only allowed pages appear in the final crawl evidence.

It would address a cloud project exposes a service principal name but not evidence of its active privileges. The relevant reason in that case is: Identity existence alone does not determine effective cloud permission. Here the required success condition is only allowed pages appear in the final crawl evidence. The relevant evidence is: Only allowed pages appear in the final crawl evidence.

It would address a server presents user profile data from a shared cache keyed only by URL. The relevant reason in that case is: Cross-user cache leakage can bypass application-level access policy. Here the required success condition is an unauthorized method receives an appropriate rejection. The relevant evidence is: An unauthorized method receives an appropriate rejection.

This result applies to a different case: A file-conversion service passes filenames directly to a system shell. Shell metacharacters can change command execution when inputs are concatenated. It does not establish the present requirement, where an unauthorized method receives an appropriate rejection. The relevant evidence is: An unauthorized method receives an appropriate rejection.

That relates to a different issue: A user-controlled account ID in a billing API returns another synthetic customer's invoice. Guessing or changing object identifiers must not bypass ownership enforcement. That is not a direct remedy for the requested outcome: An unauthorized method receives an appropriate rejection. The relevant evidence is: An unauthorized method receives an appropriate rejection.

It would address a model endpoint outputs confidential training examples when prompted with generic cues. The relevant reason in that case is: Model behavior can expose sensitive memorized data. Here the required success condition is a simulated unauthorized register write is blocked by the protective gateway. The appropriate action is: Report register-manipulation exposure and require segmentation and authenticated control paths.

This action applies to a different case: A testing team uses Mobile Security Framework to inspect a permitted app package. Mobile-focused tooling identifies application configuration and code issues. It does not establish the present requirement, where a simulated unauthorized register write is blocked by the protective gateway. The appropriate action is: Report register-manipulation exposure and require segmentation and authenticated control paths.

That approach concerns a different situation: an AI assistant retrieves an untrusted web page that contains instructions to send private documents. Untrusted source data must not gain authority over tool operations. The required result is that a simulated unauthorized register write is blocked by the protective gateway. The appropriate action is: Report register-manipulation exposure and require segmentation and authenticated control paths.

That approach concerns a different situation: users receive repeated unsolicited MFA push prompts from an unknown source. Repeated prompts may coerce approval of an attacker-initiated sign-in. The required result is that the report identifies weak authentication design without collecting production hashes. The relevant evidence is: The report identifies weak authentication design without collecting production hashes.

That relates to a different issue: A stolen application bearer token allows an API call without further challenge in a lab. Bearer tokens can authorize access for whoever possesses them. That is not a direct remedy for the requested outcome: The report identifies weak authentication design without collecting production hashes. The relevant evidence is: The report identifies weak authentication design without collecting production hashes.

It would address a password audit tests a curated wordlist against approved offline synthetic hashes. The relevant reason in that case is: Dictionary attacks try likely words instead of exhaustive permutations. Here the required success condition is the report identifies weak authentication design without collecting production hashes. The relevant evidence is: The report identifies weak authentication design without collecting production hashes.