Exam Bundle

That relates to a different issue: An analyst must assess an ICS network that lacks safe active vulnerability scanning windows. Live probing can create safety and availability risk to industrial equipment. That is not a direct remedy for the requested outcome: The result cites observed missing headers or exposed files, not an assumed exploit. The relevant evidence is: The result cites observed missing headers or exposed files, not an assumed exploit.

It would address an assessment finds a web service protected by a WAF that blocks many scanner patterns. The relevant reason in that case is: WAF responses can mask vulnerabilities and reduce scan completeness. Here the required success condition is the result cites observed missing headers or exposed files, not an assumed exploit. The relevant evidence is: The result cites observed missing headers or exposed files, not an assumed exploit.

This result applies to a different case: A test engineer wishes to find vulnerable applications in managed serverless services. Serverless resources lack direct host scanning but still have code and identity risks. It does not establish the present requirement, where the result cites observed missing headers or exposed files, not an assumed exploit. The relevant evidence is: The result cites observed missing headers or exposed files, not an assumed exploit.

That approach concerns a different situation: a host exposes a remote printing service on a restricted subnet and testers want to enumerate it. Print services may bridge operating-system privileges and network segments. The required result is that a controlled capture no longer contains sensitive FTP content. The relevant evidence is: A controlled capture no longer contains sensitive FTP content.

That relates to a different issue: A test server accepts SSH from an untrusted internal segment despite its approved management design. Encrypted SSH still creates a lateral path when exposed broadly. That is not a direct remedy for the requested outcome: A controlled capture no longer contains sensitive FTP content. The relevant evidence is: A controlled capture no longer contains sensitive FTP content.

It would address an internal team finds unexpected use of PsExec on an accounting server. The relevant reason in that case is: PsExec-style remote execution creates traceable service and process artifacts. Here the required success condition is a controlled capture no longer contains sensitive FTP content. The relevant evidence is: A controlled capture no longer contains sensitive FTP content.

This result applies to a different case: A password-change API accepts simultaneous requests but applies different validation rules depending on timing. Race conditions can bypass checks when state is updated nonatomically. It does not establish the present requirement, where a synthetic quote-bearing value remains inert in the rendered page. The relevant evidence is: A synthetic quote-bearing value remains inert in the rendered page.

That approach concerns a different situation: a search endpoint concatenates raw query text into SQL statements. Data must not be interpreted as SQL syntax during query construction. The required result is that a synthetic quote-bearing value remains inert in the rendered page. The relevant evidence is: A synthetic quote-bearing value remains inert in the rendered page.

That relates to a different issue: A login rate limit can be bypassed because it counts only a mutable client-provided header. Untrusted request headers should not control abuse enforcement. That is not a direct remedy for the requested outcome: A synthetic quote-bearing value remains inert in the rendered page. The relevant evidence is: A synthetic quote-bearing value remains inert in the rendered page.

That relates to a different issue: A tester plans to stage a 10 GB dataset for proof but the signed exfiltration budget is 1 MB. Demonstrating the data path does not require large transfers of client content. That is not a direct remedy for the requested outcome: A controlled capture records abnormal payload sizes and frequency. The relevant evidence is: A controlled capture records abnormal payload sizes and frequency.

This result applies to a different case: A compromised process uses a covert channel but the defender has only firewall allow/deny logs. Allowed protocols may still carry anomalous information. It does not establish the present requirement, where a controlled capture records abnormal payload sizes and frequency. The relevant evidence is: A controlled capture records abnormal payload sizes and frequency.

That approach concerns a different situation: an authorized lab needs to test data staging without triggering production record changes. Controlled artifacts allow measurement of transfer behavior without real data exposure. The required result is that a controlled capture records abnormal payload sizes and frequency. The relevant evidence is: A controlled capture records abnormal payload sizes and frequency.

That relates to a different issue: A browser profile repeatedly reconnects to a suspicious host after the user closes all tabs. Browser extensions can persist and run with user browsing context. That is not a direct remedy for the requested outcome: The test process no longer starts after removing the entry. The appropriate action is: Identify registry-based persistence and restrict startup entry modifications.

It would address a lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. The relevant reason in that case is: Scheduled execution can restore a foothold without an interactive login. Here the required success condition is the test process no longer starts after removing the entry. The appropriate action is: Identify registry-based persistence and restrict startup entry modifications.

This action applies to a different case: A Linux service manager starts a rogue daemon at boot under an elevated account. Service managers can provide durable execution with configured privileges. It does not establish the present requirement, where the test process no longer starts after removing the entry. The appropriate action is: Identify registry-based persistence and restrict startup entry modifications.

That approach concerns a different situation: a Windows domain has AD Certificate Services templates granting enrollment privileges to unintended users. Misconfigured certificate templates can grant unintended authentication capabilities. The required result is that a safe connectivity test confirms the unintended path is blocked. The appropriate action is: Review forwarding settings and enforce isolation at both interfaces.

That relates to a different issue: A captured lab TCP session reveals an intermediary can see unencrypted application data. Traffic traversing an attacker-controlled segment can expose plaintext. That is not a direct remedy for the requested outcome: A safe connectivity test confirms the unintended path is blocked. The appropriate action is: Review forwarding settings and enforce isolation at both interfaces.

It would address a network appliance's HTTP admin login is open on a management VLAN shared with guests. The relevant reason in that case is: Guest-to-admin reachability increases risk irrespective of password strength. Here the required success condition is a safe connectivity test confirms the unintended path is blocked. The appropriate action is: Review forwarding settings and enforce isolation at both interfaces.

It would address a web scanner claims SQL injection because a quote produces an HTTP 500 response. The relevant reason in that case is: Generic server errors do not prove attacker-controlled SQL execution. Here the required success condition is the previously issued test cookie is rejected after logout. The relevant evidence is: The previously issued test cookie is rejected after logout.

This result applies to a different case: A picture import URL is fetched by a server with access to internal service endpoints. User-supplied destinations can redirect server trust to internal resources. It does not establish the present requirement, where the previously issued test cookie is rejected after logout. The relevant evidence is: The previously issued test cookie is rejected after logout.

That approach concerns a different situation: a user-controlled redirection URL points an authenticated session toward an external lookalike domain. Open redirects can support phishing and weaken trusted navigation assumptions. The required result is that the previously issued test cookie is rejected after logout. The relevant evidence is: The previously issued test cookie is rejected after logout.

It would address a test host's ARP poisoning protection rejects an untrusted gateway claim. The relevant reason in that case is: Network access checks can prevent an on-path position before application traffic. Here the required success condition is the report lists verified interface identities without assuming exploitability. The appropriate action is: Correlate authorized service inventory with the observed RPC binding metadata.

This action applies to a different case: A tester sees port 445 on an authorized server but has no credentials to enumerate its shares. Service availability is not the same as permission to enumerate protected resources. It does not establish the present requirement, where the report lists verified interface identities without assuming exploitability. The appropriate action is: Correlate authorized service inventory with the observed RPC binding metadata.

That approach concerns a different situation: a Windows domain has AD Certificate Services templates granting enrollment privileges to unintended users. Misconfigured certificate templates can grant unintended authentication capabilities. The required result is that the report lists verified interface identities without assuming exploitability. The appropriate action is: Correlate authorized service inventory with the observed RPC binding metadata.

That approach concerns a different situation: a wireless sensor records repeated malformed management frames near a permitted client test area. Malformed frames can stress wireless implementations. The required result is that a synthetic client sees an authenticated portal and no untrusted redirects. The appropriate action is: Require trusted portal identity and restrict redirect destinations.

That relates to a different issue: A tester wants to map an organization's access points while driving around neighboring offices. Radio proximity does not establish permission for active testing. That is not a direct remedy for the requested outcome: A synthetic client sees an authenticated portal and no untrusted redirects. The appropriate action is: Require trusted portal identity and restrict redirect destinations.

This action applies to a different case: An assessor needs the operating channel and encryption mode of approved access points. Beacon frames can reveal radio parameters without association. It does not establish the present requirement, where a synthetic client sees an authenticated portal and no untrusted redirects. The appropriate action is: Require trusted portal identity and restrict redirect destinations.

That approach concerns a different situation: an enterprise wants to find missing patches that unauthenticated perimeter scans cannot verify. Authenticated scans can inspect local package or registry state beyond network banners. The required result is that the graph identifies a documented misconfigured permission chain. The appropriate action is: Use authorized directory relationship collection and analyze with BloodHound.

That relates to a different issue: A vulnerability analyst needs to assess a publicly reachable web server's unsafe headers and default files. Web configuration assessment targets service weaknesses distinct from full code review. That is not a direct remedy for the requested outcome: The graph identifies a documented misconfigured permission chain. The appropriate action is: Use authorized directory relationship collection and analyze with BloodHound.

It would address a container repository may contain vulnerable dependencies absent from the running host inventory. The relevant reason in that case is: Image-layer dependencies can be vulnerable even without an exposed network service. Here the required success condition is the graph identifies a documented misconfigured permission chain. The appropriate action is: Use authorized directory relationship collection and analyze with BloodHound.

It would address a firewall sends TCP RST responses to selected ports during discovery. The relevant reason in that case is: TCP resets distinguish a rejected connection from a no-response condition. Here the required success condition is new service candidates are reported with source and destination metadata. The relevant evidence is: New service candidates are reported with source and destination metadata.

This result applies to a different case: An assessor sees a TCP SYN-ACK from an in-scope host during a permitted probe. A SYN-ACK is evidence of a listening TCP service under ordinary conditions. It does not establish the present requirement, where new service candidates are reported with source and destination metadata. The relevant evidence is: New service candidates are reported with source and destination metadata.

That relates to a different issue: A site requires an inventory of TLS-enabled services without attempting authentication. TLS handshakes can describe certificate names and supported protocol families. That is not a direct remedy for the requested outcome: New service candidates are reported with source and destination metadata. The relevant evidence is: New service candidates are reported with source and destination metadata.