Exam Bundle

It would address a 24-hour assessment has only a two-hour approved production change window for exploitation. The relevant reason in that case is: Operational windows may differ by activity and production sensitivity. Here the required success condition is the evidence sample is redacted and securely transferred to the named contact. The appropriate action is: Minimize access, protect the evidence, and follow the agreed privacy reporting path.

This action applies to a different case: A client and supplier agree on ongoing terms, but the current test's exact hosts and dates are unrecorded. The statement of work defines this particular engagement's operational boundaries. It does not establish the present requirement, where the evidence sample is redacted and securely transferred to the named contact. The appropriate action is: Minimize access, protect the evidence, and follow the agreed privacy reporting path.

That relates to a different issue: A client shares a URL containing a deep path but excludes the administrative console on the same host. URL-level exclusions can narrow a host-level test authorization. That is not a direct remedy for the requested outcome: The evidence sample is redacted and securely transferred to the named contact. The appropriate action is: Minimize access, protect the evidence, and follow the agreed privacy reporting path.

That relates to a different issue: A tester needs broad public-domain subdomain candidates without hitting customer hosts. Passive subdomain enumeration collects third-party DNS and certificate evidence. That is not a direct remedy for the requested outcome: The result differentiates live DNS from historical third-party observations. The relevant evidence is: The result differentiates live DNS from historical third-party observations.

It would address a client wants known public internet hosts indexed by certificate and service metadata. The relevant reason in that case is: Internet-wide indices provide exposure intelligence but not proof of asset ownership. Here the required success condition is the result differentiates live DNS from historical third-party observations. The relevant evidence is: The result differentiates live DNS from historical third-party observations.

This result applies to a different case: A test team needs a reusable OSINT collection workflow across public providers. A framework can automate repeatable public-data collection with source controls. It does not establish the present requirement, where the result differentiates live DNS from historical third-party observations. The relevant evidence is: The result differentiates live DNS from historical third-party observations.

That approach concerns a different situation: a tester sees an employee hold open a restricted office door for a visitor without checking credentials. Tailgating involves following an authorized entrant through a secured access point. The required result is that the review identifies a legitimate maintenance event or escalates suspicious access. The appropriate action is: Correlate physical reader events with camera and shift records through authorized review.

That relates to a different issue: A data center relies on a turnstile that permits multiple people to pass behind one badge. One-factor door systems may fail to enforce one-person admission. That is not a direct remedy for the requested outcome: The review identifies a legitimate maintenance event or escalates suspicious access. The appropriate action is: Correlate physical reader events with camera and shift records through authorized review.

It would address a client wants to determine whether an employee can remotely open a door with another person's proximity badge. The relevant reason in that case is: Authentication properties must be demonstrated without using actual employee identifiers. Here the required success condition is the review identifies a legitimate maintenance event or escalates suspicious access. The appropriate action is: Correlate physical reader events with camera and shift records through authorized review.

This result applies to a different case: A stolen application bearer token allows an API call without further challenge in a lab. Bearer tokens can authorize access for whoever possesses them. It does not establish the present requirement, where unsolicited test prompts cannot complete authentication without user-approved context. The relevant evidence is: Unsolicited test prompts cannot complete authentication without user-approved context.

That approach concerns a different situation: an application accepts arbitrary SAML assertions lacking strict issuer verification. Federation trust requires correct issuer, audience, expiry, and signatures. The required result is that unsolicited test prompts cannot complete authentication without user-approved context. The relevant evidence is: Unsolicited test prompts cannot complete authentication without user-approved context.

That relates to a different issue: A website returns a different error for nonexisting usernames even when all passwords fail. Error consistency prevents disclosure of valid account identities. That is not a direct remedy for the requested outcome: Unsolicited test prompts cannot complete authentication without user-approved context. The relevant evidence is: Unsolicited test prompts cannot complete authentication without user-approved context.

It would address a service startup configuration references an executable removed during a software upgrade. The relevant reason in that case is: Missing service executables are not exploitable without a controllable replacement path. Here the required success condition is a scoped permission review confirms the unnecessary elevated bit. The appropriate action is: Assess effective privilege and file ownership before recommending removal.

This action applies to a different case: A client wants a Mimikatz demonstration but its authorization excludes any extraction of live credentials. Credential tools can expose sensitive data beyond the intended objective. It does not establish the present requirement, where a scoped permission review confirms the unnecessary elevated bit. The appropriate action is: Assess effective privilege and file ownership before recommending removal.

That approach concerns a different situation: a Windows service binary directory is writable by ordinary users while the service runs as a privileged identity. Writable privileged service artifacts can cross user-to-system trust boundaries. The required result is that a scoped permission review confirms the unnecessary elevated bit. The appropriate action is: Assess effective privilege and file ownership before recommending removal.

That relates to a different issue: A client wants to evaluate an old Telnet management interface without reading passwords. Telnet lacks built-in encrypted session protection. That is not a direct remedy for the requested outcome: A test guest cannot open the management endpoint after remediation. The appropriate action is: Recommend enforcing management-plane separation and restricted ingress.

This action applies to a different case: A legacy SSL VPN service is exposed behind an unchanged default configuration. Default network configurations can create easily reachable attack surfaces. It does not establish the present requirement, where a test guest cannot open the management endpoint after remediation. The appropriate action is: Recommend enforcing management-plane separation and restricted ingress.

That approach concerns a different situation: a lab server accepts SMB authentication relayed from another service without enforcing signing. Unsigned authentication flows can be replayed or relayed across trust boundaries. The required result is that a test guest cannot open the management endpoint after remediation. The appropriate action is: Recommend enforcing management-plane separation and restricted ingress.

That approach concerns a different situation: a Trojan-labeled binary claims to be a legitimate installer but performs unauthorized background operations. A Trojan conceals unwanted activity behind an apparently useful program. The required result is that the isolated web root no longer contains the unauthorized component. The relevant evidence is: The isolated web root no longer contains the unauthorized component.

That relates to a different issue: A tester's controlled payload survives reboots through an unapproved login script. Login scripts can reestablish code execution repeatedly. That is not a direct remedy for the requested outcome: The isolated web root no longer contains the unauthorized component. The relevant evidence is: The isolated web root no longer contains the unauthorized component.

It would address a lab host has a process listening locally for remote command connections. The relevant reason in that case is: Bind shells expose a local listening endpoint. Here the required success condition is the isolated web root no longer contains the unauthorized component. The relevant evidence is: The isolated web root no longer contains the unauthorized component.

This result applies to a different case: An assessment needs an inventory of publicly accessible cloud buckets under the customer's account. Cloud access posture must be confirmed at both resource and data-plane levels. It does not establish the present requirement, where only client-approved access point identifiers appear in active testing. The relevant evidence is: Only client-approved access point identifiers appear in active testing.

That approach concerns a different situation: an assessment discovers a DNS alias that points from an approved hostname to a provider-owned domain. Aliases do not extend consent to the target infrastructure automatically. The required result is that only client-approved access point identifiers appear in active testing. The relevant evidence is: Only client-approved access point identifiers appear in active testing.

It would address an API returns sequential customer identifiers in JSON responses to a normal account. The relevant reason in that case is: Guessable IDs alone are not proof of broken object authorization. Here the required success condition is only client-approved access point identifiers appear in active testing. The relevant evidence is: Only client-approved access point identifiers appear in active testing.

This result applies to a different case: A cloud team needs to check insecure Terraform settings before applying a new deployment. IaC scanning catches misconfigurations before infrastructure exists. It does not establish the present requirement, where the finding lists the exact workload image and exposed control. The relevant evidence is: The finding lists the exact workload image and exposed control.

That approach concerns a different situation: a distributed application uses API test accounts that create actual billable orders during DAST. Application scans must not produce unapproved business transactions. The required result is that the finding lists the exact workload image and exposed control. The relevant evidence is: The finding lists the exact workload image and exposed control.

That relates to a different issue: A team wants to detect weak API authorization in a running staging application. DAST evaluates behavior from the application's external interface. That is not a direct remedy for the requested outcome: The finding lists the exact workload image and exposed control. The relevant evidence is: The finding lists the exact workload image and exposed control.

That relates to a different issue: A service sends files to an external mailbox instead of a sanctioned business archive. Email offers a familiar outbound path that may bypass specialized DLP controls. That is not a direct remedy for the requested outcome: The timeline links the archive to its outbound destination. The relevant evidence is: The timeline links the archive to its outbound destination.

It would address an application makes encrypted HTTPS requests to a newly registered domain after accessing a sensitive database. The relevant reason in that case is: Encrypted transport can conceal unauthorized data transfer. Here the required success condition is the timeline links the archive to its outbound destination. The relevant evidence is: The timeline links the archive to its outbound destination.

This result applies to a different case: DNS queries carry unusually long encoded-looking subdomain labels during a simulated incident. DNS can carry data in query names when abused as a covert channel. It does not establish the present requirement, where the timeline links the archive to its outbound destination. The relevant evidence is: The timeline links the archive to its outbound destination.

That relates to a different issue: A shell loop sends every possible path to a fragile production app at full speed. Rate and volume controls are required to respect engagement limits. That is not a direct remedy for the requested outcome: Two fixtures yield consistent certificate fields from the same function. The relevant evidence is: Two fixtures yield consistent certificate fields from the same function.

It would address a PowerShell inventory includes duplicate IPs from multiple subnets and scans them repeatedly. The relevant reason in that case is: Unnecessary probes increase risk and distort evidence counts. Here the required success condition is two fixtures yield consistent certificate fields from the same function. The relevant evidence is: Two fixtures yield consistent certificate fields from the same function.

This result applies to a different case: A PowerShell lookup script hard-codes a client password in its source file. Hard-coded secrets can leak through code repositories and logs. It does not establish the present requirement, where two fixtures yield consistent certificate fields from the same function. The relevant evidence is: Two fixtures yield consistent certificate fields from the same function.