Exam Bundle

It would address an app asks for contact-list access even though the business feature uses only a camera. The relevant reason in that case is: Unnecessary mobile permissions expand sensitive data exposure. Here the required success condition is the activity log lists only authorized device serials. The relevant evidence is: The activity log lists only authorized device serials.

This result applies to a different case: A testing team uses Mobile Security Framework to inspect a permitted app package. Mobile-focused tooling identifies application configuration and code issues. It does not establish the present requirement, where the activity log lists only authorized device serials. The relevant evidence is: The activity log lists only authorized device serials.

That relates to a different issue: A factory PLC accepts unauthenticated writes to process registers on a lab Modbus network. Legacy industrial protocols may not enforce message authorization. That is not a direct remedy for the requested outcome: The activity log lists only authorized device serials. The relevant evidence is: The activity log lists only authorized device serials.

That relates to a different issue: A vulnerability ID references a flaw fixed in a backported enterprise Linux package. Vendor backports can remediate CVEs without changing upstream major version. That is not a direct remedy for the requested outcome: The report identifies the trust violation or records why it is not relevant. The appropriate action is: Assess trust requirements and actual attack exposure rather than assuming compromise.

It would address a scanner discovers a cloud service tag matching a vulnerable product but no accessible resource endpoint. The relevant reason in that case is: Product labels do not alone prove exploitability. Here the required success condition is the report identifies the trust violation or records why it is not relevant. The appropriate action is: Assess trust requirements and actual attack exposure rather than assuming compromise.

That approach concerns a different situation: a scanner's authenticated credential was disabled during the test with no alert in the output summary. Credentials can silently fail and create false negative coverage. The required result is that the report identifies the trust violation or records why it is not relevant. The appropriate action is: Assess trust requirements and actual attack exposure rather than assuming compromise.

That approach concerns a different situation: a temporary firewall exception was added to a test subnet under approved change control. Testing changes must not weaken production controls after the engagement. The required result is that the owner signs off on the baseline-diff and outstanding exceptions. The relevant evidence is: The owner signs off on the baseline-diff and outstanding exceptions.

That relates to a different issue: A test team performed controlled changes to a lab Kubernetes role assignment. Temporary elevated cluster roles can outlive the exercise. That is not a direct remedy for the requested outcome: The owner signs off on the baseline-diff and outstanding exceptions. The relevant evidence is: The owner signs off on the baseline-diff and outstanding exceptions.

It would address a temporary password was set on an approved test account during a proof. The relevant reason in that case is: Temporary authentication changes can create lingering security risk. Here the required success condition is the owner signs off on the baseline-diff and outstanding exceptions. The relevant evidence is: The owner signs off on the baseline-diff and outstanding exceptions.

This action applies to a different case: A Windows application runs from a writable directory but claims its installer is signed. Signed installers do not guarantee continued integrity after deployment. It does not establish the present requirement, where the proof uses isolated test accounts and shows no client secret extraction. The appropriate action is: Use synthetic lab credentials and avoid collection from production memory.

That approach concerns a different situation: a Linux helper binary has setuid enabled despite no demonstrated business requirement. Setuid changes execution privileges and can increase escalation impact. The required result is that the proof uses isolated test accounts and shows no client secret extraction. The appropriate action is: Use synthetic lab credentials and avoid collection from production memory.

That relates to a different issue: A scheduled Linux maintenance script is writable by a nonprivileged group but runs from root cron. Root-run scheduled code must be protected against untrusted modification. That is not a direct remedy for the requested outcome: The proof uses isolated test accounts and shows no client secret extraction. The appropriate action is: Use synthetic lab credentials and avoid collection from production memory.

It would address a login system sends session cookies without Secure on an HTTPS-only site. The relevant reason in that case is: Cookie attributes reduce exposure to transport and script risks. Here the required success condition is a traversal-style lab input cannot retrieve a file outside the allowed directory. The appropriate action is: Identify directory traversal and restrict paths to canonical approved storage roots.

That approach concerns a different situation: a password-change API accepts simultaneous requests but applies different validation rules depending on timing. Race conditions can bypass checks when state is updated nonatomically. The required result is that a traversal-style lab input cannot retrieve a file outside the allowed directory. The appropriate action is: Identify directory traversal and restrict paths to canonical approved storage roots.

That relates to a different issue: A picture import URL is fetched by a server with access to internal service endpoints. User-supplied destinations can redirect server trust to internal resources. That is not a direct remedy for the requested outcome: A traversal-style lab input cannot retrieve a file outside the allowed directory. The appropriate action is: Identify directory traversal and restrict paths to canonical approved storage roots.

It would address an assessment deployed a temporary cloud VM and associated public IP for a controlled attack simulation. The relevant reason in that case is: Temporary test resources can create ongoing cost and exposure. Here the required success condition is a scoped connectivity check confirms the proxy endpoint is closed. The appropriate action is: Close the listener and remove exposed test routes as part of final cleanup.

This action applies to a different case: An exercise used a dedicated cloud API key that remains active after delivery. Leaving tester credentials active creates unnecessary future access. It does not establish the present requirement, where a scoped connectivity check confirms the proxy endpoint is closed. The appropriate action is: Close the listener and remove exposed test routes as part of final cleanup.

That approach concerns a different situation: a report needs proof that no unauthorized modification remained after a system-level assessment. Restoration requires verification, not a verbal cleanup statement. The required result is that a scoped connectivity check confirms the proxy endpoint is closed. The appropriate action is: Close the listener and remove exposed test routes as part of final cleanup.

That relates to a different issue: An application repository could contain command-construction flaws before deployment. SAST analyzes source patterns without requiring a running app. That is not a direct remedy for the requested outcome: The report maps package findings to the exact image digest. The relevant evidence is: The report maps package findings to the exact image digest.

It would address a test engineer wishes to find vulnerable applications in managed serverless services. The relevant reason in that case is: Serverless resources lack direct host scanning but still have code and identity risks. Here the required success condition is the report maps package findings to the exact image digest. The relevant evidence is: The report maps package findings to the exact image digest.

This result applies to a different case: A container deployment uses hostPath mounts that may weaken host isolation. Host filesystem mounts can undermine container isolation. It does not establish the present requirement, where the report maps package findings to the exact image digest. The relevant evidence is: The report maps package findings to the exact image digest.

That approach concerns a different situation: a customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. The required result is that the engagement plan documents lifecycle status and safe validation limits. The relevant evidence is: The engagement plan documents lifecycle status and safe validation limits.

That relates to a different issue: An approved test finds a high-CVSS bug on an isolated lab system and a lower-CVSS exposed gateway weakness. CVSS base score does not incorporate local attack surface and asset criticality. That is not a direct remedy for the requested outcome: The engagement plan documents lifecycle status and safe validation limits. The relevant evidence is: The engagement plan documents lifecycle status and safe validation limits.

It would address a tester selects an attack tool because it is familiar, not because it matches target protocol. The relevant reason in that case is: Tool choice should be threat-led and technically appropriate. Here the required success condition is the engagement plan documents lifecycle status and safe validation limits. The relevant evidence is: The engagement plan documents lifecycle status and safe validation limits.

This action applies to a different case: A tester's controlled payload survives reboots through an unapproved login script. Login scripts can reestablish code execution repeatedly. It does not establish the present requirement, where sandbox execution reveals the unauthorized activity without production installation. The appropriate action is: Classify masquerading software behavior and preserve signed evidence.

That approach concerns a different situation: an endpoint security agent stops automatically after an unauthorized service modification. Weak control integrity can help malicious access persist. The required result is that sandbox execution reveals the unauthorized activity without production installation. The appropriate action is: Classify masquerading software behavior and preserve signed evidence.

That relates to a different issue: A workstation appears compromised below normal process-monitor visibility. Kernel or low-level compromise can hide from ordinary host tools. That is not a direct remedy for the requested outcome: Sandbox execution reveals the unauthorized activity without production installation. The appropriate action is: Classify masquerading software behavior and preserve signed evidence.

It would address a team wants to validate its public wireless discovery without generating deauthentication traffic. The relevant reason in that case is: Wireless tool capability does not imply authorization for disruptive features. Here the required success condition is the report identifies frame types from a fixed lab capture. The appropriate action is: Use Wireshark or Aircrack-ng's analysis functions without transmitting attacks.

This action applies to a different case: An approved local wireless survey needs SSID channels and signal strengths without association. Wireless analysis can inventory radios without authenticating to them. It does not establish the present requirement, where the report identifies frame types from a fixed lab capture. The appropriate action is: Use Wireshark or Aircrack-ng's analysis functions without transmitting attacks.

That approach concerns a different situation: a tester needs an ownership hint for a domain's registration and delegated name servers. Registration metadata may identify contacts and service providers. The required result is that the report identifies frame types from a fixed lab capture. The appropriate action is: Use Wireshark or Aircrack-ng's analysis functions without transmitting attacks.

That approach concerns a different situation: a client wants a recognized penetration-testing service accreditation model. CREST provides professional testing standards and assurance mechanisms. The required result is that the documented threat is classified as tampering with a protective control. The appropriate action is: Identify tampering in the STRIDE threat taxonomy.

That relates to a different issue: A company wants measurable technical security testing of network and physical channels. OSSTMM focuses on methodical operational security testing and measurement. That is not a direct remedy for the requested outcome: The documented threat is classified as tampering with a protective control. The appropriate action is: Identify tampering in the STRIDE threat taxonomy.

This action applies to a different case: A web application team wants a prioritized list of common application security risk categories. OWASP Top 10 groups frequent web application security risks. It does not establish the present requirement, where the documented threat is classified as tampering with a protective control. The appropriate action is: Identify tampering in the STRIDE threat taxonomy.