Exam Bundle

That approach concerns a different situation: a cloud customer expects a penetration tester to patch provider-managed hypervisor vulnerabilities. The infrastructure provider retains responsibility for managed platform layers. The required result is that each risk and task has an identified accountable party. The appropriate action is: Record responsibilities for platform operation, tenant configuration, and test conduct.

That relates to a different issue: A requester claims to own a customer-facing app but cannot prove authority to authorize testing. A verbal request from an unverified party is insufficient legal approval. That is not a direct remedy for the requested outcome: Each risk and task has an identified accountable party. The appropriate action is: Record responsibilities for platform operation, tenant configuration, and test conduct.

It would address an approved web test discovers a hostname used by the client's separate billing provider. The relevant reason in that case is: Discovery alone does not extend legal authorization to another owner. Here the required success condition is each risk and task has an identified accountable party. The appropriate action is: Record responsibilities for platform operation, tenant configuration, and test conduct.

This action applies to a different case: A tester needs to determine whether a reverse DNS entry identifies an assigned in-scope public address. Reverse names provide attribution hints but are not reliable proof of asset ownership. It does not establish the present requirement, where a list of candidate names includes timestamps and ownership verification notes. The appropriate action is: Review certificate transparency records and attribute names to in-scope assets.

That relates to a different issue: A client wants the passive discovery of hosts from public certificate names and DNS records. Multiple passive sources reduce the chance of relying on a stale artifact. That is not a direct remedy for the requested outcome: A list of candidate names includes timestamps and ownership verification notes. The appropriate action is: Review certificate transparency records and attribute names to in-scope assets.

It would address a client wants to discover previously published but now removed endpoint documentation. The relevant reason in that case is: Web caches may preserve older public information no longer linked. Here the required success condition is a list of candidate names includes timestamps and ownership verification notes. The appropriate action is: Review certificate transparency records and attribute names to in-scope assets.

It would address a Python test harness submits the same harmless API validation twice after a timeout. The relevant reason in that case is: Retries must not produce duplicate state changes in a target app. Here the required success condition is a separate low-right user cannot read the test artifacts. The relevant evidence is: A separate low-right user cannot read the test artifacts.

That approach concerns a different situation: an organization needs to compare simulated adversary behavior across controlled lab systems. Simulation frameworks automate observable behaviors and require careful scoping. The required result is that a separate low-right user cannot read the test artifacts. The relevant evidence is: A separate low-right user cannot read the test artifacts.

That relates to a different issue: A tester wants to use PowerShell functions for recurring approved AD inventory steps. Reusable scripted functions improve repeatability and limit accidental actions. That is not a direct remedy for the requested outcome: A separate low-right user cannot read the test artifacts. The relevant evidence is: A separate low-right user cannot read the test artifacts.

That relates to a different issue: An assessment delivered a security finding while the last test proxy still listens on a public address. Temporary test infrastructure can itself become an internet exposure. That is not a direct remedy for the requested outcome: The resource inventory has no unmanaged test VM, IP, or disk. The appropriate action is: Decommission the infrastructure and verify removal of associated cloud resources.

It would address an application security exercise saved a proof-of-concept script in an application document root. The relevant reason in that case is: Residual files in a web root can become unintended access points. Here the required success condition is the resource inventory has no unmanaged test VM, IP, or disk. The appropriate action is: Decommission the infrastructure and verify removal of associated cloud resources.

That approach concerns a different situation: an engagement installed a scheduled laboratory test task that remains after testing is complete. Persistence artifacts must not survive beyond signed testing authorization. The required result is that the resource inventory has no unmanaged test VM, IP, or disk. The appropriate action is: Decommission the infrastructure and verify removal of associated cloud resources.

That approach concerns a different situation: a small wireless network has neighboring SSIDs that must not be included in the client's assessment. SSID alone does not establish radio identity or scope ownership. The required result is that the scan report includes current feed revision and update provenance. The appropriate action is: Verify signature database age and update via approved offline distribution.

That relates to a different issue: A cloud product exposes IAM policies that allow wildcard administrative actions. Cloud identity misconfiguration is a control-plane issue. That is not a direct remedy for the requested outcome: The scan report includes current feed revision and update provenance. The appropriate action is: Verify signature database age and update via approved offline distribution.

This action applies to a different case: A test engineer wishes to find vulnerable applications in managed serverless services. Serverless resources lack direct host scanning but still have code and identity risks. It does not establish the present requirement, where the scan report includes current feed revision and update provenance. The appropriate action is: Verify signature database age and update via approved offline distribution.

That approach concerns a different situation: a test team wants to assess whether confidential files could be moved to personal web text storage. Public paste sites may provide an outbound data path not intended for business use. The required result is that the incident narrative attributes the transfer to the initiating identity and target. The appropriate action is: Correlate process, data access, and network telemetry rather than treating TLS as proof of safety.

That relates to a different issue: A malicious process appears to send compressed data archives to external cloud storage. Compression can stage data for transfer but is not itself proof of theft. That is not a direct remedy for the requested outcome: The incident narrative attributes the transfer to the initiating identity and target. The appropriate action is: Correlate process, data access, and network telemetry rather than treating TLS as proof of safety.

It would address a security engineer suspects steganography in images uploaded to an external content site. The relevant reason in that case is: Hidden payloads may exist within apparently benign media files. Here the required success condition is the incident narrative attributes the transfer to the initiating identity and target. The appropriate action is: Correlate process, data access, and network telemetry rather than treating TLS as proof of safety.

It would address an infrastructure scan ran during a maintenance restart and marked many endpoints as unavailable. The relevant reason in that case is: Transient maintenance can cause misleading service detection. Here the required success condition is the final assessment ties each finding to a dated build and advisory. The relevant evidence is: The final assessment ties each finding to a dated build and advisory.

That approach concerns a different situation: a vulnerability ID references a flaw fixed in a backported enterprise Linux package. Vendor backports can remediate CVEs without changing upstream major version. The required result is that the final assessment ties each finding to a dated build and advisory. The relevant evidence is: The final assessment ties each finding to a dated build and advisory.

That relates to a different issue: A credentialed scan finds no missing patches but several hosts never accepted the scan account. Unscanned hosts cannot be treated as confirmed patched. That is not a direct remedy for the requested outcome: The final assessment ties each finding to a dated build and advisory. The relevant evidence is: The final assessment ties each finding to a dated build and advisory.

It would address an engagement installed a scheduled laboratory test task that remains after testing is complete. The relevant reason in that case is: Persistence artifacts must not survive beyond signed testing authorization. Here the required success condition is the owner signs off on the baseline-diff and outstanding exceptions. The appropriate action is: Compare approved baseline configurations to post-test state and document differences.

This action applies to a different case: An application security exercise saved a proof-of-concept script in an application document root. Residual files in a web root can become unintended access points. It does not establish the present requirement, where the owner signs off on the baseline-diff and outstanding exceptions. The appropriate action is: Compare approved baseline configurations to post-test state and document differences.

That approach concerns a different situation: a temporary password was set on an approved test account during a proof. Temporary authentication changes can create lingering security risk. The required result is that the owner signs off on the baseline-diff and outstanding exceptions. The appropriate action is: Compare approved baseline configurations to post-test state and document differences.

That approach concerns a different situation: a corporate access point sends users to a captive portal that allows arbitrary external form pages. Captive portals can be impersonated to harvest user credentials. The required result is that the test supplicant rejects the mismatched certificate. The relevant evidence is: The test supplicant rejects the mismatched certificate.

That relates to a different issue: A tester wants to map an organization's access points while driving around neighboring offices. Radio proximity does not establish permission for active testing. That is not a direct remedy for the requested outcome: The test supplicant rejects the mismatched certificate. The relevant evidence is: The test supplicant rejects the mismatched certificate.

It would address a company finds a rogue access point advertising the same SSID as its legitimate Wi-Fi. The relevant reason in that case is: Impersonated wireless infrastructure can redirect or harvest client connections. Here the required success condition is the test supplicant rejects the mismatched certificate. The relevant evidence is: The test supplicant rejects the mismatched certificate.

This action applies to a different case: A theme installer accepts an external URL that is included into server-side code execution. Server execution should not import untrusted remote code. It does not establish the present requirement, where two synthetic users never receive each other's cached private content. The appropriate action is: Add authorization-aware cache partitioning and no-store rules for private responses.

That relates to a different issue: A web gateway trusts an unsigned JWT claim that a user is an administrator. Untrusted token content must never grant privileged API access. That is not a direct remedy for the requested outcome: Two synthetic users never receive each other's cached private content. The appropriate action is: Add authorization-aware cache partitioning and no-store rules for private responses.

It would address a user logs out but an old test session cookie continues granting access. The relevant reason in that case is: Removing a cookie client-side does not necessarily revoke server authority. Here the required success condition is two synthetic users never receive each other's cached private content. The appropriate action is: Add authorization-aware cache partitioning and no-store rules for private responses.

It would address a 24-hour assessment has only a two-hour approved production change window for exploitation. The relevant reason in that case is: Operational windows may differ by activity and production sensitivity. Here the required success condition is the evidence sample is redacted and securely transferred to the named contact. The appropriate action is: Minimize access, protect the evidence, and follow the agreed privacy reporting path.

This action applies to a different case: A client and supplier agree on ongoing terms, but the current test's exact hosts and dates are unrecorded. The statement of work defines this particular engagement's operational boundaries. It does not establish the present requirement, where the evidence sample is redacted and securely transferred to the named contact. The appropriate action is: Minimize access, protect the evidence, and follow the agreed privacy reporting path.

That relates to a different issue: A client shares a URL containing a deep path but excludes the administrative console on the same host. URL-level exclusions can narrow a host-level test authorization. That is not a direct remedy for the requested outcome: The evidence sample is redacted and securely transferred to the named contact. The appropriate action is: Minimize access, protect the evidence, and follow the agreed privacy reporting path.