Exam Bundle

That approach concerns a different situation: a Windows domain has AD Certificate Services templates granting enrollment privileges to unintended users. Misconfigured certificate templates can grant unintended authentication capabilities. The required result is that the test account is accepted only by authorized service endpoints. The appropriate action is: Use designated synthetic credentials and read-only authentication tests.

That relates to a different issue: An assessor detects unsupported SMB dialects enabled for a legacy file service. Older dialects can lack modern session security features. That is not a direct remedy for the requested outcome: The test account is accepted only by authorized service endpoints. The appropriate action is: Use designated synthetic credentials and read-only authentication tests.

It would address a switch port is configured to accept tags from an untrusted endpoint. The relevant reason in that case is: Incorrect trunk or native VLAN settings can break intended network segregation. Here the required success condition is the test account is accepted only by authorized service endpoints. The appropriate action is: Use designated synthetic credentials and read-only authentication tests.

This result applies to a different case: Operations and security disagree about whether a fragile server may be actively scanned. Cross-team agreement is needed when testing could disrupt business services. It does not establish the present requirement, where published screenshots contain no prohibited identifiers or secrets. The relevant evidence is: Published screenshots contain no prohibited identifiers or secrets.

That approach concerns a different situation: a service owner reports unexpected instability that might be unrelated to a recent scan. Temporal correlation alone is insufficient proof of test-caused outage. The required result is that published screenshots contain no prohibited identifiers or secrets. The relevant evidence is: Published screenshots contain no prohibited identifiers or secrets.

That relates to a different issue: An active test reveals evidence of a critical customer-data exposure while the weekly meeting is days away. Critical material findings require timely escalation outside routine reporting cadence. That is not a direct remedy for the requested outcome: Published screenshots contain no prohibited identifiers or secrets. The relevant evidence is: Published screenshots contain no prohibited identifiers or secrets.

It would address a team wants an assessment of a Kubernetes cluster while its production workloads cannot tolerate attack simulation. The relevant reason in that case is: Kubernetes posture assessment can identify weak RBAC and workloads without disrupting them. Here the required success condition is scan logs show proper access and relevant configuration evidence. The relevant evidence is: Scan logs show proper access and relevant configuration evidence.

This result applies to a different case: An enterprise wants to find missing patches that unauthenticated perimeter scans cannot verify. Authenticated scans can inspect local package or registry state beyond network banners. It does not establish the present requirement, where scan logs show proper access and relevant configuration evidence. The relevant evidence is: Scan logs show proper access and relevant configuration evidence.

That approach concerns a different situation: a container repository may contain vulnerable dependencies absent from the running host inventory. Image-layer dependencies can be vulnerable even without an exposed network service. The required result is that scan logs show proper access and relevant configuration evidence. The relevant evidence is: Scan logs show proper access and relevant configuration evidence.

It would address a permitted SMB account lists a share with write permission although the business expected read-only access. The relevant reason in that case is: Authorization may differ between share and filesystem permission layers. Here the required success condition is the inventory lists each bucket's effective approved public-access setting. The relevant evidence is: The inventory lists each bucket's effective approved public-access setting.

This result applies to a different case: An LDAP directory query returns fewer user records than the account inventory provided by the owner. Enumeration completeness depends on query filters and directory permissions. It does not establish the present requirement, where the inventory lists each bucket's effective approved public-access setting. The relevant evidence is: The inventory lists each bucket's effective approved public-access setting.

That approach concerns a different situation: an in-scope Windows server advertises SMB but shares cannot be listed anonymously. Authentication boundaries limit accessible share inventories. The required result is that the inventory lists each bucket's effective approved public-access setting. The relevant evidence is: The inventory lists each bucket's effective approved public-access setting.

That relates to a different issue: An IoT controller is sensitive to unexpected network packets during a vulnerability assessment. Industrial and embedded systems can fail under ordinary IT scan traffic. That is not a direct remedy for the requested outcome: An intentionally public storage declaration fails a predeployment policy test. The appropriate action is: Scan infrastructure-as-code definitions for risky resource configuration.

It would address an app release pipeline needs to assess newly introduced source flaws as developers commit changes. The relevant reason in that case is: Source testing can gate dangerous patterns before execution. Here the required success condition is an intentionally public storage declaration fails a predeployment policy test. The appropriate action is: Scan infrastructure-as-code definitions for risky resource configuration.

This action applies to a different case: An application repository could contain command-construction flaws before deployment. SAST analyzes source patterns without requiring a running app. It does not establish the present requirement, where an intentionally public storage declaration fails a predeployment policy test. The appropriate action is: Scan infrastructure-as-code definitions for risky resource configuration.

This action applies to a different case: A mobile app's locally stored credentials may be exposed in its compiled bundle. Mobile packages can contain hard-coded material that is not visible in server scans. It does not establish the present requirement, where the triage records safe parameter binding or a genuine unsafe path. The appropriate action is: Validate the data flow and binding behavior before treating the alert as confirmed injection.

That relates to a different issue: A CI pipeline contains an image registry scanner but scans only a mutable latest tag. Mutable tags can change between scan and deployment, invalidating evidence. That is not a direct remedy for the requested outcome: The triage records safe parameter binding or a genuine unsafe path. The appropriate action is: Validate the data flow and binding behavior before treating the alert as confirmed injection.

It would address a production scan reports hundreds of unsupported plugins but the system owner restricts active checks. The relevant reason in that case is: Offline/version-based assessment can support findings when proof testing is unsafe. Here the required success condition is the triage records safe parameter binding or a genuine unsafe path. The appropriate action is: Validate the data flow and binding behavior before treating the alert as confirmed injection.

This result applies to a different case: An office Wi-Fi assessment records a strong signal from a neighbor-owned access point. Physical proximity does not establish authorization to test a wireless asset. It does not establish the present requirement, where the final report names the correct asset or documents ambiguity. The relevant evidence is: The final report names the correct asset or documents ambiguity.

That approach concerns a different situation: an assessment needs an inventory of publicly accessible cloud buckets under the customer's account. Cloud access posture must be confirmed at both resource and data-plane levels. The required result is that the final report names the correct asset or documents ambiguity. The relevant evidence is: The final report names the correct asset or documents ambiguity.

That relates to a different issue: A container build reveals a secret-like value in a public manifest but production service accounts are out of scope. Found credentials do not authorize use beyond signed targets. That is not a direct remedy for the requested outcome: The final report names the correct asset or documents ambiguity. The relevant evidence is: The final report names the correct asset or documents ambiguity.

That relates to a different issue: A service sends files to an external mailbox instead of a sanctioned business archive. Email offers a familiar outbound path that may bypass specialized DLP controls. That is not a direct remedy for the requested outcome: The lab shows synthetic bytes crossed the approved boundary only. The relevant evidence is: The lab shows synthetic bytes crossed the approved boundary only.

It would address a test team wants to assess whether confidential files could be moved to personal web text storage. The relevant reason in that case is: Public paste sites may provide an outbound data path not intended for business use. Here the required success condition is the lab shows synthetic bytes crossed the approved boundary only. The relevant evidence is: The lab shows synthetic bytes crossed the approved boundary only.

That approach concerns a different situation: a malicious process appears to send compressed data archives to external cloud storage. Compression can stage data for transfer but is not itself proof of theft. The required result is that the lab shows synthetic bytes crossed the approved boundary only. The relevant evidence is: The lab shows synthetic bytes crossed the approved boundary only.

That relates to a different issue: A login rate limit can be bypassed because it counts only a mutable client-provided header. Untrusted request headers should not control abuse enforcement. That is not a direct remedy for the requested outcome: The issued session cookie has the required flags in a test browser. The appropriate action is: Recommend Secure and appropriate HttpOnly and SameSite cookie controls.

It would address an app downloads files based on a path parameter that accepts parent-directory components. The relevant reason in that case is: Path normalization and authorization must prevent escaping a file root. Here the required success condition is the issued session cookie has the required flags in a test browser. The appropriate action is: Recommend Secure and appropriate HttpOnly and SameSite cookie controls.

This action applies to a different case: A GraphQL endpoint permits deeply nested expensive queries without limits. Flexible query interfaces can cause denial of service through costly resolution. It does not establish the present requirement, where the issued session cookie has the required flags in a test browser. The appropriate action is: Recommend Secure and appropriate HttpOnly and SameSite cookie controls.

This result applies to a different case: A Trojan-labeled binary claims to be a legitimate installer but performs unauthorized background operations. A Trojan conceals unwanted activity behind an apparently useful program. It does not establish the present requirement, where trusted offline analysis confirms or rejects unauthorized modification. The relevant evidence is: Trusted offline analysis confirms or rejects unauthorized modification.

That relates to a different issue: A Windows machine auto-starts an unapproved process from a user-controlled registry Run key. Autostart registry paths can launch programs at sign-in. That is not a direct remedy for the requested outcome: Trusted offline analysis confirms or rejects unauthorized modification. The relevant evidence is: Trusted offline analysis confirms or rejects unauthorized modification.

It would address a browser profile repeatedly reconnects to a suspicious host after the user closes all tabs. The relevant reason in that case is: Browser extensions can persist and run with user browsing context. Here the required success condition is trusted offline analysis confirms or rejects unauthorized modification. The relevant evidence is: Trusted offline analysis confirms or rejects unauthorized modification.

It would address a penetration tester wants to prove data exfiltration but the contract forbids copying personal information. The relevant reason in that case is: Exfiltration tests should avoid moving real sensitive client content. Here the required success condition is a safe lab pattern triggers the intended anomaly detection. The relevant evidence is: A safe lab pattern triggers the intended anomaly detection.

This result applies to a different case: An application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. Encrypted transport can conceal unauthorized data transfer. It does not establish the present requirement, where a safe lab pattern triggers the intended anomaly detection. The relevant evidence is: A safe lab pattern triggers the intended anomaly detection.

That approach concerns a different situation: a Windows host maps a cloud-backed virtual drive through an unauthorized sync client. Mapped storage can move data outside conventional removable drives. The required result is that a safe lab pattern triggers the intended anomaly detection. The relevant evidence is: A safe lab pattern triggers the intended anomaly detection.