Exam Bundle

That approach concerns a different situation: users receive repeated unsolicited MFA push prompts from an unknown source. Repeated prompts may coerce approval of an attacker-initiated sign-in. The required result is that the report identifies weak authentication design without collecting production hashes. The relevant evidence is: The report identifies weak authentication design without collecting production hashes.

That relates to a different issue: A stolen application bearer token allows an API call without further challenge in a lab. Bearer tokens can authorize access for whoever possesses them. That is not a direct remedy for the requested outcome: The report identifies weak authentication design without collecting production hashes. The relevant evidence is: The report identifies weak authentication design without collecting production hashes.

It would address a password audit tests a curated wordlist against approved offline synthetic hashes. The relevant reason in that case is: Dictionary attacks try likely words instead of exhaustive permutations. Here the required success condition is the report identifies weak authentication design without collecting production hashes. The relevant evidence is: The report identifies weak authentication design without collecting production hashes.

This result applies to a different case: An organization needs to compare simulated adversary behavior across controlled lab systems. Simulation frameworks automate observable behaviors and require careful scoping. It does not establish the present requirement, where the logs contain no protected tokens or passwords. The relevant evidence is: The logs contain no protected tokens or passwords.

That relates to a different issue: A PowerShell lab tool scans too many endpoints in parallel, triggering service health alarms. Automation pacing is part of authorized test safety. That is not a direct remedy for the requested outcome: The logs contain no protected tokens or passwords. The relevant evidence is: The logs contain no protected tokens or passwords.

It would address a tester wants to use PowerShell functions for recurring approved AD inventory steps. The relevant reason in that case is: Reusable scripted functions improve repeatability and limit accidental actions. Here the required success condition is the logs contain no protected tokens or passwords. The relevant evidence is: The logs contain no protected tokens or passwords.

It would address an assessor wants to enumerate external records but cannot use a product requiring active client network contact. The relevant reason in that case is: Tool mode is more important than product name for scope compliance. Here the required success condition is the export notes each discovered fact's source and confidence. The appropriate action is: Use SpiderFoot passive modules with third-party-source restrictions.

That approach concerns a different situation: a client requests exploration of public DNS records including delegated subdomain records. DNS intelligence services help build candidate domain inventories. The required result is that the export notes each discovered fact's source and confidence. The appropriate action is: Use SpiderFoot passive modules with third-party-source restrictions.

That relates to a different issue: An assessor needs to query current A, MX, and TXT records for a customer's domain. DNS command-line tools retrieve authoritative or resolver responses. That is not a direct remedy for the requested outcome: The export notes each discovered fact's source and confidence. The appropriate action is: Use SpiderFoot passive modules with third-party-source restrictions.

It would address a project storage account is shared with an unrelated external cloud account. The relevant reason in that case is: Cloud-native access may enable transfer without conventional internet downloads. Here the required success condition is the investigation documents contextual evidence for the final classification. The appropriate action is: Compare ownership, schedule, process origin, and destination before classifying it as theft.

This action applies to a different case: A compromised process uses a covert channel but the defender has only firewall allow/deny logs. Allowed protocols may still carry anomalous information. It does not establish the present requirement, where the investigation documents contextual evidence for the final classification. The appropriate action is: Compare ownership, schedule, process origin, and destination before classifying it as theft.

That approach concerns a different situation: a penetration tester wants to prove data exfiltration but the contract forbids copying personal information. Exfiltration tests should avoid moving real sensitive client content. The required result is that the investigation documents contextual evidence for the final classification. The appropriate action is: Compare ownership, schedule, process origin, and destination before classifying it as theft.

That approach concerns a different situation: a tester wants to map an organization's access points while driving around neighboring offices. Radio proximity does not establish permission for active testing. The required result is that the test supplicant rejects the mismatched certificate. The appropriate action is: Treat it as potential evil-twin activity and verify the EAP server certificate policy.

That relates to a different issue: A company asks the tester to send disruptive Wi-Fi deauthentication frames during business hours. Service-disruption methods require explicit risk and impact authorization. That is not a direct remedy for the requested outcome: The test supplicant rejects the mismatched certificate. The appropriate action is: Treat it as potential evil-twin activity and verify the EAP server certificate policy.

This action applies to a different case: A company finds a rogue access point advertising the same SSID as its legitimate Wi-Fi. Impersonated wireless infrastructure can redirect or harvest client connections. It does not establish the present requirement, where the test supplicant rejects the mismatched certificate. The appropriate action is: Treat it as potential evil-twin activity and verify the EAP server certificate policy.

That approach concerns a different situation: a service account has access to a second application's database but no business need for it. Privilege propagation depends on actual effective entitlements. The required result is that no test traffic reaches other clients and evidence is redacted. The relevant evidence is: No test traffic reaches other clients and evidence is redacted.

That relates to a different issue: An incident team finds a suspicious process invoking remote PowerShell but no indication of the target machine. Remote management artifacts must be connected to endpoints to assess movement. That is not a direct remedy for the requested outcome: No test traffic reaches other clients and evidence is redacted. The relevant evidence is: No test traffic reaches other clients and evidence is redacted.

It would address a Windows domain exposes DCOM remote activation rights to a broad group. The relevant reason in that case is: DCOM can provide remote activation paths when permissive. Here the required success condition is no test traffic reaches other clients and evidence is redacted. The relevant evidence is: No test traffic reaches other clients and evidence is redacted.

This action applies to a different case: A Java application must be monitored for unsafe runtime data flows while executing tests. IAST combines application execution and code-level instrumentation signals. It does not establish the present requirement, where the scanner reports a redacted finding tied to commit and owner. The appropriate action is: Use an approved secrets scanner on the designated repository and redact discoveries.

That approach concerns a different situation: a container repository may contain vulnerable dependencies absent from the running host inventory. Image-layer dependencies can be vulnerable even without an exposed network service. The required result is that the scanner reports a redacted finding tied to commit and owner. The appropriate action is: Use an approved secrets scanner on the designated repository and redact discoveries.

That relates to a different issue: An assessment finds a web service protected by a WAF that blocks many scanner patterns. WAF responses can mask vulnerabilities and reduce scan completeness. That is not a direct remedy for the requested outcome: The scanner reports a redacted finding tied to commit and owner. The appropriate action is: Use an approved secrets scanner on the designated repository and redact discoveries.

It would address a team wants to detect weak API authorization in a running staging application. The relevant reason in that case is: DAST evaluates behavior from the application's external interface. Here the required success condition is the report includes separate SCA and application test results. The appropriate action is: Combine package analysis with scoped application behavior testing.

This action applies to a different case: An enterprise wants to find missing patches that unauthenticated perimeter scans cannot verify. Authenticated scans can inspect local package or registry state beyond network banners. It does not establish the present requirement, where the report includes separate SCA and application test results. The appropriate action is: Combine package analysis with scoped application behavior testing.

That approach concerns a different situation: a container repository may contain vulnerable dependencies absent from the running host inventory. Image-layer dependencies can be vulnerable even without an exposed network service. The required result is that the report includes separate SCA and application test results. The appropriate action is: Combine package analysis with scoped application behavior testing.

That approach concerns a different situation: two companies need confidentiality protection before testers receive internal network diagrams. An NDA governs handling of confidential information prior to technical access. The required result is that the approved method matches the provider's current testing terms. The relevant evidence is: The approved method matches the provider's current testing terms.

That relates to a different issue: A client and supplier agree on ongoing terms, but the current test's exact hosts and dates are unrecorded. The statement of work defines this particular engagement's operational boundaries. That is not a direct remedy for the requested outcome: The approved method matches the provider's current testing terms. The relevant evidence is: The approved method matches the provider's current testing terms.

This result applies to a different case: The client asks which contract establishes general payment and liability terms across annual projects. An MSA typically governs the continuing commercial relationship. It does not establish the present requirement, where the approved method matches the provider's current testing terms. The relevant evidence is: The approved method matches the provider's current testing terms.

That approach concerns a different situation: a security team asks whether public profile data exposes names and organizational roles of privileged employees. Public role disclosures can inform social-engineering exposure without active contact. The required result is that only positively confirmed customer assets progress to active reconnaissance. The appropriate action is: Validate current ownership and exclude unrelated address space.

That relates to a different issue: A company cannot explain why an old DNS mail exchanger still appears in public records. Current DNS answers identify public mail routing independently of internal diagrams. That is not a direct remedy for the requested outcome: Only positively confirmed customer assets progress to active reconnaissance. The appropriate action is: Validate current ownership and exclude unrelated address space.

It would address a company posts cloud administrator vacancy descriptions revealing its deployed identity platform. The relevant reason in that case is: Recruitment posts can disclose likely stack components without network interaction. Here the required success condition is only positively confirmed customer assets progress to active reconnaissance. The appropriate action is: Validate current ownership and exclude unrelated address space.

It would address an app asks for contact-list access even though the business feature uses only a camera. The relevant reason in that case is: Unnecessary mobile permissions expand sensitive data exposure. Here the required success condition is the activity log lists only authorized device serials. The relevant evidence is: The activity log lists only authorized device serials.

This result applies to a different case: A testing team uses Mobile Security Framework to inspect a permitted app package. Mobile-focused tooling identifies application configuration and code issues. It does not establish the present requirement, where the activity log lists only authorized device serials. The relevant evidence is: The activity log lists only authorized device serials.

That relates to a different issue: A factory PLC accepts unauthenticated writes to process registers on a lab Modbus network. Legacy industrial protocols may not enforce message authorization. That is not a direct remedy for the requested outcome: The activity log lists only authorized device serials. The relevant evidence is: The activity log lists only authorized device serials.