Exam Bundle

That approach concerns a different situation: a client wants a recognized penetration-testing service accreditation model. CREST provides professional testing standards and assurance mechanisms. The required result is that the documented threat is classified as tampering with a protective control. The appropriate action is: Identify tampering in the STRIDE threat taxonomy.

That relates to a different issue: A company wants measurable technical security testing of network and physical channels. OSSTMM focuses on methodical operational security testing and measurement. That is not a direct remedy for the requested outcome: The documented threat is classified as tampering with a protective control. The appropriate action is: Identify tampering in the STRIDE threat taxonomy.

This action applies to a different case: A web application team wants a prioritized list of common application security risk categories. OWASP Top 10 groups frequent web application security risks. It does not establish the present requirement, where the documented threat is classified as tampering with a protective control. The appropriate action is: Identify tampering in the STRIDE threat taxonomy.

That approach concerns a different situation: a scanner detects a self-signed certificate on a test-only internal service. A self-signed certificate can be appropriate in controlled trust contexts. The required result is that the finding is supported by real asset configuration and scope evidence. The relevant evidence is: The finding is supported by real asset configuration and scope evidence.

That relates to a different issue: A scanner's authenticated credential was disabled during the test with no alert in the output summary. Credentials can silently fail and create false negative coverage. That is not a direct remedy for the requested outcome: The finding is supported by real asset configuration and scope evidence. The relevant evidence is: The finding is supported by real asset configuration and scope evidence.

It would address a scheduled assessment identifies fewer hosts than last month, but subnet routing has changed. The relevant reason in that case is: Fewer findings may indicate lost visibility, not improved security. Here the required success condition is the finding is supported by real asset configuration and scope evidence. The relevant evidence is: The finding is supported by real asset configuration and scope evidence.

This result applies to a different case: A small wireless network has neighboring SSIDs that must not be included in the client's assessment. SSID alone does not establish radio identity or scope ownership. It does not establish the present requirement, where the report associates the flaw with a controlled test transaction. The relevant evidence is: The report associates the flaw with a controlled test transaction.

That approach concerns a different situation: a team wants to detect weak API authorization in a running staging application. DAST evaluates behavior from the application's external interface. The required result is that the report associates the flaw with a controlled test transaction. The relevant evidence is: The report associates the flaw with a controlled test transaction.

That relates to a different issue: A test engineer wishes to find vulnerable applications in managed serverless services. Serverless resources lack direct host scanning but still have code and identity risks. That is not a direct remedy for the requested outcome: The report associates the flaw with a controlled test transaction. The relevant evidence is: The report associates the flaw with a controlled test transaction.

That relates to a different issue: A static scanner flags a parameter as unsanitized but a framework consistently binds SQL values. Automated source findings require context to avoid false positives. That is not a direct remedy for the requested outcome: The analyst can map deployed artifact to the vulnerable version. The appropriate action is: Collect software bill-of-materials evidence to establish installed dependencies.

This action applies to a different case: An IoT controller is sensitive to unexpected network packets during a vulnerability assessment. Industrial and embedded systems can fail under ordinary IT scan traffic. It does not establish the present requirement, where the analyst can map deployed artifact to the vulnerable version. The appropriate action is: Collect software bill-of-materials evidence to establish installed dependencies.

That approach concerns a different situation: a team wants to detect weak API authorization in a running staging application. DAST evaluates behavior from the application's external interface. The required result is that the analyst can map deployed artifact to the vulnerable version. The appropriate action is: Collect software bill-of-materials evidence to establish installed dependencies.

That approach concerns a different situation: an internal service uses cleartext FTP to move administrative files between servers. Plaintext file transfer can reveal data and credentials to intermediate observers. The required result is that an unauthorized lab principal cannot invoke remote object activation. The relevant evidence is: An unauthorized lab principal cannot invoke remote object activation.

That relates to a different issue: A host contains a copy of a credential dump but the tester is not authorized to open real user secrets. Credential dumps can enable lateral access but are sensitive forensic evidence. That is not a direct remedy for the requested outcome: An unauthorized lab principal cannot invoke remote object activation. The relevant evidence is: An unauthorized lab principal cannot invoke remote object activation.

This result applies to a different case: An approved lab account accesses a second Windows host using a remote service management channel. Valid credentials and remote management can bridge compromised systems. It does not establish the present requirement, where an unauthorized lab principal cannot invoke remote object activation. The relevant evidence is: An unauthorized lab principal cannot invoke remote object activation.

This action applies to a different case: A tester needs to analyze 802.11 management frames from an authorized lab capture. Wireless tooling can inspect captures separately from active disruption. It does not establish the present requirement, where the capture report identifies the relevant flows and excludes secrets. The appropriate action is: Use Wireshark or tcpdump to analyze the permitted packet capture.

That relates to a different issue: A test team has a PCAP but needs only a brief view of a suspicious DNS exchange. Capture filters reduce noise while retaining original evidence. That is not a direct remedy for the requested outcome: The capture report identifies the relevant flows and excludes secrets. The appropriate action is: Use Wireshark or tcpdump to analyze the permitted packet capture.

It would address an assessor wants to enumerate external records but cannot use a product requiring active client network contact. The relevant reason in that case is: Tool mode is more important than product name for scope compliance. Here the required success condition is the capture report identifies the relevant flows and excludes secrets. The appropriate action is: Use Wireshark or tcpdump to analyze the permitted packet capture.

It would address a password audit tests a curated wordlist against approved offline synthetic hashes. The relevant reason in that case is: Dictionary attacks try likely words instead of exhaustive permutations. Here the required success condition is the evidence documents the safe test account and bounded requests. The appropriate action is: Replace aggressive guessing with approved synthetic lockout-safe testing.

That approach concerns a different situation: a lab's Kerberos service accounts use weak reusable secrets with no rotation plan. Weak long-lived service account credentials expand ticket abuse risk. The required result is that the evidence documents the safe test account and bounded requests. The appropriate action is: Replace aggressive guessing with approved synthetic lockout-safe testing.

That relates to a different issue: A client needs to visualize delegated privileges leading from a low-right account to an admin role. Directory graphing can reveal potential escalation edges for remediation. That is not a direct remedy for the requested outcome: The evidence documents the safe test account and bounded requests. The appropriate action is: Replace aggressive guessing with approved synthetic lockout-safe testing.

It would address a user-controlled redirection URL points an authenticated session toward an external lookalike domain. The relevant reason in that case is: Open redirects can support phishing and weaken trusted navigation assumptions. Here the required success condition is a traversal-style lab input cannot retrieve a file outside the allowed directory. The relevant evidence is: A traversal-style lab input cannot retrieve a file outside the allowed directory.

This result applies to a different case: A JSON Web Token API accepts tokens with an unexpected algorithm or mismatched audience. JWT validation requires more than decoding a base64 payload. It does not establish the present requirement, where a traversal-style lab input cannot retrieve a file outside the allowed directory. The relevant evidence is: A traversal-style lab input cannot retrieve a file outside the allowed directory.

That approach concerns a different situation: a plugin upload endpoint permits executable scripts to be stored inside a public web root. File upload handling must prevent attacker-controlled server-side execution. The required result is that a traversal-style lab input cannot retrieve a file outside the allowed directory. The relevant evidence is: A traversal-style lab input cannot retrieve a file outside the allowed directory.

That approach concerns a different situation: a secure room's access logs show one badge opened the door repeatedly during an unoccupied shift. Access anomaly evidence is stronger when multiple sources agree. The required result is that a controlled cloned credential is rejected or logged under the approved test. The appropriate action is: Identify the risk as badge cloning and validate access-controller safeguards.

It would address a reception area has cameras covering exits but not the badge reader at the server room. The relevant reason in that case is: Physical monitoring coverage determines visibility into unauthorized access. Here the required success condition is a controlled cloned credential is rejected or logged under the approved test. The appropriate action is: Identify the risk as badge cloning and validate access-controller safeguards.

This action applies to a different case: A test team discovers sensitive paper records in an unattended office recycling bin. Physical information leakage may occur without network exploitation. It does not establish the present requirement, where a controlled cloned credential is rejected or logged under the approved test. The appropriate action is: Identify the risk as badge cloning and validate access-controller safeguards.

This result applies to a different case: The client's network team publishes a list of routable and private subnets with overlapping names. Incorrect network arithmetic can accidentally scan unauthorized ranges. It does not establish the present requirement, where the inventory records certificate subjects and service addresses only. The relevant evidence is: The inventory records certificate subjects and service addresses only.

That approach concerns a different situation: a UDP application is suspected, but no response appears to a generic UDP probe. UDP scanning often lacks reliable positive replies without an application response. The required result is that the inventory records certificate subjects and service addresses only. The relevant evidence is: The inventory records certificate subjects and service addresses only.

It would address an assessor sees a TCP SYN-ACK from an in-scope host during a permitted probe. The relevant reason in that case is: A SYN-ACK is evidence of a listening TCP service under ordinary conditions. Here the required success condition is the inventory records certificate subjects and service addresses only. The relevant evidence is: The inventory records certificate subjects and service addresses only.

This action applies to a different case: A tester proposes scraping discarded sensitive papers from an office dumpster after physical scope ended. Dumpster diving is physical reconnaissance and is not implied by web authorization. It does not establish the present requirement, where a trained employee refuses the request and uses an approved callback number. The appropriate action is: Classify the attempt as vishing and teach independent callback verification.

That approach concerns a different situation: a compromised community website frequently used by a particular department redirects users to unsafe content. Trusted browsing habits can expose targeted groups to hostile sites. The required result is that a trained employee refuses the request and uses an approved callback number. The appropriate action is: Classify the attempt as vishing and teach independent callback verification.

That relates to a different issue: A client wants a social-engineering platform to deliver simulated emails at low volume. Dedicated tools can manage controlled phishing simulation and reporting. That is not a direct remedy for the requested outcome: A trained employee refuses the request and uses an approved callback number. The appropriate action is: Classify the attempt as vishing and teach independent callback verification.