Exam Bundle

It would address a firewall sends TCP RST responses to selected ports during discovery. The relevant reason in that case is: TCP resets distinguish a rejected connection from a no-response condition. Here the required success condition is new service candidates are reported with source and destination metadata. The relevant evidence is: New service candidates are reported with source and destination metadata.

This result applies to a different case: An assessor sees a TCP SYN-ACK from an in-scope host during a permitted probe. A SYN-ACK is evidence of a listening TCP service under ordinary conditions. It does not establish the present requirement, where new service candidates are reported with source and destination metadata. The relevant evidence is: New service candidates are reported with source and destination metadata.

That relates to a different issue: A site requires an inventory of TLS-enabled services without attempting authentication. TLS handshakes can describe certificate names and supported protocol families. That is not a direct remedy for the requested outcome: New service candidates are reported with source and destination metadata. The relevant evidence is: New service candidates are reported with source and destination metadata.

That relates to a different issue: A login form is vulnerable to injected SQL fragments in a parameter. Bound query parameters prevent user input from becoming SQL syntax. That is not a direct remedy for the requested outcome: The server reports the fixed version and the prior finding no longer reproduces. The appropriate action is: Recommend a tested patch within a risk-based remediation window.

It would address an administrator can reach production backups using the same broad privileges as developers. The relevant reason in that case is: Privilege separation limits destructive access from routine accounts. Here the required success condition is the server reports the fixed version and the prior finding no longer reproduces. The appropriate action is: Recommend a tested patch within a risk-based remediation window.

That approach concerns a different situation: a production app stores an API key in a publicly readable deployment manifest. Secret revocation is necessary after disclosure; merely hiding a file is insufficient. The required result is that the server reports the fixed version and the prior finding no longer reproduces. The appropriate action is: Recommend a tested patch within a risk-based remediation window.

That approach concerns a different situation: an application sends staged content through an unapproved HTTPS endpoint but network controls permit all egress. Confidentiality of transit does not establish transfer authorization. The required result is that the incident narrative attributes the transfer to the initiating identity and target. The relevant evidence is: The incident narrative attributes the transfer to the initiating identity and target.

That relates to a different issue: A Windows host maps a cloud-backed virtual drive through an unauthorized sync client. Mapped storage can move data outside conventional removable drives. That is not a direct remedy for the requested outcome: The incident narrative attributes the transfer to the initiating identity and target. The relevant evidence is: The incident narrative attributes the transfer to the initiating identity and target.

This result applies to a different case: A data movement alert reports a compressed archive but its creation may belong to normal backups. Legitimate backups also compress and move files. It does not establish the present requirement, where the incident narrative attributes the transfer to the initiating identity and target. The relevant evidence is: The incident narrative attributes the transfer to the initiating identity and target.

This result applies to a different case: An attacker-created process launches inside a legitimate application's process tree after untrusted DLL loading. Untrusted library loading can execute code under another application's privileges. It does not establish the present requirement, where a standard account cannot stop the protected service. The relevant evidence is: A standard account cannot stop the protected service.

That relates to a different issue: A Windows service binary directory is writable by ordinary users while the service runs as a privileged identity. Writable privileged service artifacts can cross user-to-system trust boundaries. That is not a direct remedy for the requested outcome: A standard account cannot stop the protected service. The relevant evidence is: A standard account cannot stop the protected service.

It would address a sandboxed application allows launching an unrestricted terminal through a helper menu. The relevant reason in that case is: Process spawning can bypass an application's intended restricted environment. Here the required success condition is a standard account cannot stop the protected service. The relevant evidence is: A standard account cannot stop the protected service.

This action applies to a different case: An organization wants publicly exposed SSL certificate history for a retired hostname. Certificates can reveal previously registered names and issuance chronology. It does not establish the present requirement, where the report contains only role patterns and privacy-appropriate citations. The appropriate action is: Review permitted professional-profile OSINT and minimize collection of personal details.

That approach concerns a different situation: a tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. Reverse names provide attribution hints but are not reliable proof of asset ownership. The required result is that the report contains only role patterns and privacy-appropriate citations. The appropriate action is: Review permitted professional-profile OSINT and minimize collection of personal details.

That relates to a different issue: A cloud team worries that an old object storage endpoint is indexed in search results. Search indices can disclose public paths even after application navigation changes. That is not a direct remedy for the requested outcome: The report contains only role patterns and privacy-appropriate citations. The appropriate action is: Review permitted professional-profile OSINT and minimize collection of personal details.

That relates to a different issue: A customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. That is not a direct remedy for the requested outcome: The finding links the proper identifier to each type of evidence. The relevant evidence is: The finding links the proper identifier to each type of evidence.

It would address a tester selects an attack tool because it is familiar, not because it matches target protocol. The relevant reason in that case is: Tool choice should be threat-led and technically appropriate. Here the required success condition is the finding links the proper identifier to each type of evidence. The relevant evidence is: The finding links the proper identifier to each type of evidence.

That approach concerns a different situation: a cloud service is misconfigured but the contract forbids modification of production access policies. Exploitation must respect both target scope and permitted change types. The required result is that the finding links the proper identifier to each type of evidence. The relevant evidence is: The finding links the proper identifier to each type of evidence.

That relates to a different issue: A tester finds a second service account created during an old assessment with no recorded owner. Residual identities can preserve unauthorized access after a project ends. That is not a direct remedy for the requested outcome: The report separates verified unauthorized persistence from normal updates. The appropriate action is: Correlate executable hash, task action, publisher, and timing before classifying it.

It would address a C2 simulation in a sandbox uses periodic HTTP check-ins from an agent. The relevant reason in that case is: Periodic callbacks can sustain remote tasking between interactions. Here the required success condition is the report separates verified unauthorized persistence from normal updates. The appropriate action is: Correlate executable hash, task action, publisher, and timing before classifying it.

This action applies to a different case: A lab user regains access after every reboot because an unexpected scheduled task launches a hidden program. Scheduled execution can restore a foothold without an interactive login. It does not establish the present requirement, where the report separates verified unauthorized persistence from normal updates. The appropriate action is: Correlate executable hash, task action, publisher, and timing before classifying it.

This result applies to a different case: A test team discovers sensitive paper records in an unattended office recycling bin. Physical information leakage may occur without network exploitation. It does not establish the present requirement, where the test confirms the second entrant cannot enter on the same credential. The relevant evidence is: The test confirms the second entrant cannot enter on the same credential.

That approach concerns a different situation: employees frequently enter a controlled warehouse door by carrying boxes that obstruct badge presentation. Operational processes can unintentionally defeat physical control design. The required result is that the test confirms the second entrant cannot enter on the same credential. The relevant evidence is: The test confirms the second entrant cannot enter on the same credential.

That relates to a different issue: A lock's manufacturer documentation suggests weak mechanical tolerances, but the client excludes destructive opening. Physical test methods are bounded by damage and permission constraints. That is not a direct remedy for the requested outcome: The test confirms the second entrant cannot enter on the same credential. The relevant evidence is: The test confirms the second entrant cannot enter on the same credential.

It would address a network team wants safe evidence that its service account cannot authenticate to unrelated SMB hosts. The relevant reason in that case is: A service account's trust scope affects lateral movement potential. Here the required success condition is a test guest cannot open the management endpoint after remediation. The relevant evidence is: A test guest cannot open the management endpoint after remediation.

This result applies to a different case: A printer fleet retains manufacturer default passwords on its administrative pages. Default credentials can expose management functions without any software exploit. It does not establish the present requirement, where a test guest cannot open the management endpoint after remediation. The relevant evidence is: A test guest cannot open the management endpoint after remediation.

That relates to a different issue: A legacy SSL VPN service is exposed behind an unchanged default configuration. Default network configurations can create easily reachable attack surfaces. That is not a direct remedy for the requested outcome: A test guest cannot open the management endpoint after remediation. The relevant evidence is: A test guest cannot open the management endpoint after remediation.

It would address a workload pod mounts the host filesystem and runs privileged with no operational need. The relevant reason in that case is: Weak container isolation increases opportunities for host-level impact. Here the required success condition is a test unapproved artifact cannot replace the trusted release. The appropriate action is: Require protected publication credentials, approval, and immutable artifact provenance.

This action applies to a different case: A CI pipeline uses an external build action pinned only to a mutable branch name. Mutable third-party build dependencies can change unexpectedly. It does not establish the present requirement, where a test unapproved artifact cannot replace the trusted release. The appropriate action is: Require protected publication credentials, approval, and immutable artifact provenance.

That approach concerns a different situation: a cloud VM snapshot is shared with another account unintentionally. Data snapshots can disclose sensitive disk content outside running systems. The required result is that a test unapproved artifact cannot replace the trusted release. The appropriate action is: Require protected publication credentials, approval, and immutable artifact provenance.

That approach concerns a different situation: a cloud customer expects a penetration tester to patch provider-managed hypervisor vulnerabilities. The infrastructure provider retains responsibility for managed platform layers. The required result is that each risk and task has an identified accountable party. The appropriate action is: Record responsibilities for platform operation, tenant configuration, and test conduct.

That relates to a different issue: A requester claims to own a customer-facing app but cannot prove authority to authorize testing. A verbal request from an unverified party is insufficient legal approval. That is not a direct remedy for the requested outcome: Each risk and task has an identified accountable party. The appropriate action is: Record responsibilities for platform operation, tenant configuration, and test conduct.

It would address an approved web test discovers a hostname used by the client's separate billing provider. The relevant reason in that case is: Discovery alone does not extend legal authorization to another owner. Here the required success condition is each risk and task has an identified accountable party. The appropriate action is: Record responsibilities for platform operation, tenant configuration, and test conduct.