Exam Bundle

It would address a shared workstation allows users to write into a privileged application's plugin folder. The relevant reason in that case is: Writable extension paths create opportunities for untrusted code under elevated context. Here the required success condition is the lab application resolves only approved signed library paths. The appropriate action is: Identify possible library injection or search-path hijack behavior.

That approach concerns a different situation: a Windows event log unexpectedly stops recording privileged actions during a test. Audit integrity is required to detect and investigate host compromise. The required result is that the lab application resolves only approved signed library paths. The appropriate action is: Identify possible library injection or search-path hijack behavior.

That relates to a different issue: A Windows kiosk permits access to a general command shell through a settings shortcut. Single-purpose devices should not expose general operating-system controls. That is not a direct remedy for the requested outcome: The lab application resolves only approved signed library paths. The appropriate action is: Identify possible library injection or search-path hijack behavior.

It would address a web application's LDAP filter directly concatenates a username field. The relevant reason in that case is: Unescaped filter meta-characters can alter directory query meaning. Here the required success condition is a synthetic mismatched-audience token is denied. The relevant evidence is: A synthetic mismatched-audience token is denied.

This result applies to a different case: A stolen application bearer token allows an API call without further challenge in a lab. Bearer tokens can authorize access for whoever possesses them. It does not establish the present requirement, where a synthetic mismatched-audience token is denied. The relevant evidence is: A synthetic mismatched-audience token is denied.

That approach concerns a different situation: a tester plans to use Hydra against a production identity provider with a strict account-lockout policy. Online attack tooling can exceed legal and availability constraints. The required result is that a synthetic mismatched-audience token is denied. The relevant evidence is: A synthetic mismatched-audience token is denied.

That relates to a different issue: An endpoint accepts unsigned drivers from a normal user context in an authorized lab. Unsigned kernel components can threaten host integrity. That is not a direct remedy for the requested outcome: The lab application resolves only approved signed library paths. The relevant evidence is: The lab application resolves only approved signed library paths.

It would address a Windows event log unexpectedly stops recording privileged actions during a test. The relevant reason in that case is: Audit integrity is required to detect and investigate host compromise. Here the required success condition is the lab application resolves only approved signed library paths. The relevant evidence is: The lab application resolves only approved signed library paths.

This result applies to a different case: A developer assumes process injection and process hollowing are equivalent terms. Host execution techniques differ in process lifecycle and memory manipulation. It does not establish the present requirement, where the lab application resolves only approved signed library paths. The relevant evidence is: The lab application resolves only approved signed library paths.

This action applies to a different case: A tester needs a structured penetration testing workflow from pre-engagement to reporting. PTES explicitly addresses preparation, discovery, exploitation, and reporting. It does not establish the present requirement, where the risk worksheet evaluates relevant DREAD factors consistently. The appropriate action is: Use the DREAD factors as the qualitative threat-rating framework.

That approach concerns a different situation: an architect needs to categorize a forged authenticated principal in a design diagram. Spoofing concerns impersonating an identity or authentication claim. The required result is that the risk worksheet evaluates relevant DREAD factors consistently. The appropriate action is: Use the DREAD factors as the qualitative threat-rating framework.

It would address a mobile team needs verification criteria for client-side storage and authentication controls. The relevant reason in that case is: MASVS defines mobile application security verification requirements. Here the required success condition is the risk worksheet evaluates relevant DREAD factors consistently. The appropriate action is: Use the DREAD factors as the qualitative threat-rating framework.

It would address a network vulnerability engine runs on an isolated segment and cannot contact its update source. The relevant reason in that case is: Stale scanner content can miss recent vulnerabilities. Here the required success condition is the assessment records controller posture without control-system downtime. The appropriate action is: Use passive observations and vendor-approved assessment windows instead of aggressive probing.

This action applies to a different case: A small wireless network has neighboring SSIDs that must not be included in the client's assessment. SSID alone does not establish radio identity or scope ownership. It does not establish the present requirement, where the assessment records controller posture without control-system downtime. The appropriate action is: Use passive observations and vendor-approved assessment windows instead of aggressive probing.

That approach concerns a different situation: a team wants an assessment of a Kubernetes cluster while its production workloads cannot tolerate attack simulation. Kubernetes posture assessment can identify weak RBAC and workloads without disrupting them. The required result is that the assessment records controller posture without control-system downtime. The appropriate action is: Use passive observations and vendor-approved assessment windows instead of aggressive probing.

That relates to a different issue: A CI pipeline contains an image registry scanner but scans only a mutable latest tag. Mutable tags can change between scan and deployment, invalidating evidence. That is not a direct remedy for the requested outcome: The scan shows installed versions without changing production settings. The relevant evidence is: The scan shows installed versions without changing production settings.

It would address a Windows estate needs a structured credentialed inventory of missing patches and weak configuration. The relevant reason in that case is: Credentialed assessment improves version and local-setting coverage. Here the required success condition is the scan shows installed versions without changing production settings. The relevant evidence is: The scan shows installed versions without changing production settings.

This result applies to a different case: An enterprise worries about privilege paths hidden within Active Directory group membership. Graphing permissions can expose potential attack paths without executing them. It does not establish the present requirement, where the scan shows installed versions without changing production settings. The relevant evidence is: The scan shows installed versions without changing production settings.

That approach concerns a different situation: a test server accepts SSH from an untrusted internal segment despite its approved management design. Encrypted SSH still creates a lateral path when exposed broadly. The required result is that an unauthorized lab principal cannot invoke remote object activation. The appropriate action is: Narrow DCOM permission scope and monitor remote activation events.

It would address a service uses LDAP to locate accounts that are also local administrators of other machines. The relevant reason in that case is: Directory relationships can suggest a lateral path but require actual access conditions. Here the required success condition is an unauthorized lab principal cannot invoke remote object activation. The appropriate action is: Narrow DCOM permission scope and monitor remote activation events.

This action applies to a different case: A tester is given permission to assess one management jump host but finds cached connections to other clients. Existing routes or credentials cannot grant authorization over unrelated customers. It does not establish the present requirement, where an unauthorized lab principal cannot invoke remote object activation. The appropriate action is: Narrow DCOM permission scope and monitor remote activation events.

This result applies to a different case: A Windows endpoint uses an overly broad service account that can install services on many servers. Service creation rights can enable privileged code execution. It does not establish the present requirement, where a simulated protected event remains in tamper-resistant centralized logs. The relevant evidence is: A simulated protected event remains in tamper-resistant centralized logs.

That relates to a different issue: A Windows service launches an executable using an unquoted path containing spaces. Ambiguous executable paths matter only when lower-privilege users control a candidate location. That is not a direct remedy for the requested outcome: A simulated protected event remains in tamper-resistant centralized logs. The relevant evidence is: A simulated protected event remains in tamper-resistant centralized logs.

It would address a tester needs to know whether a privileged session used PsExec to start a remote service in a permitted lab. The relevant reason in that case is: Remote service tools can be used by administrators and attackers. Here the required success condition is a simulated protected event remains in tamper-resistant centralized logs. The relevant evidence is: A simulated protected event remains in tamper-resistant centralized logs.

This action applies to a different case: An industrial plant needs a diagram of enterprise, supervisory, and process-control zones. Purdue levels organize industrial control network functions and boundaries. It does not establish the present requirement, where the findings map to relevant categories without treating the list as exhaustive. The appropriate action is: Use the OWASP Top 10 as a risk-awareness guide alongside test evidence.

That approach concerns a different situation: an architect needs to categorize a forged authenticated principal in a design diagram. Spoofing concerns impersonating an identity or authentication claim. The required result is that the findings map to relevant categories without treating the list as exhaustive. The appropriate action is: Use the OWASP Top 10 as a risk-awareness guide alongside test evidence.

That relates to a different issue: A SOC wants observed adversary behavior mapped to detection technique identifiers. ATT&CK classifies adversary behavior rather than providing a full test contract. That is not a direct remedy for the requested outcome: The findings map to relevant categories without treating the list as exhaustive. The appropriate action is: Use the OWASP Top 10 as a risk-awareness guide alongside test evidence.

That relates to a different issue: A client wants a social-engineering platform to deliver simulated emails at low volume. Dedicated tools can manage controlled phishing simulation and reporting. That is not a direct remedy for the requested outcome: The exercise records proper reporting and no disclosure of real credentials. The appropriate action is: Run a scripted, nondeceptive-harm vishing exercise with consent and escalation rules.

This action applies to a different case: A tester receives approval for employee phishing simulation but not collection of real passwords. Social engineering exercises should gather only the explicitly approved evidence. It does not establish the present requirement, where the exercise records proper reporting and no disclosure of real credentials. The appropriate action is: Run a scripted, nondeceptive-harm vishing exercise with consent and escalation rules.

That approach concerns a different situation: a compromised community website frequently used by a particular department redirects users to unsafe content. Trusted browsing habits can expose targeted groups to hostile sites. The required result is that the exercise records proper reporting and no disclosure of real credentials. The appropriate action is: Run a scripted, nondeceptive-harm vishing exercise with consent and escalation rules.

That approach concerns a different situation: a Windows domain has AD Certificate Services templates granting enrollment privileges to unintended users. Misconfigured certificate templates can grant unintended authentication capabilities. The required result is that the test account is accepted only by authorized service endpoints. The appropriate action is: Use designated synthetic credentials and read-only authentication tests.

That relates to a different issue: An assessor detects unsupported SMB dialects enabled for a legacy file service. Older dialects can lack modern session security features. That is not a direct remedy for the requested outcome: The test account is accepted only by authorized service endpoints. The appropriate action is: Use designated synthetic credentials and read-only authentication tests.

It would address a switch port is configured to accept tags from an untrusted endpoint. The relevant reason in that case is: Incorrect trunk or native VLAN settings can break intended network segregation. Here the required success condition is the test account is accepted only by authorized service endpoints. The appropriate action is: Use designated synthetic credentials and read-only authentication tests.