Exam Bundle

It would address a staff member can plug unknown USB devices into a sensitive workstation. The relevant reason in that case is: Technical device restrictions supplement awareness training. Here the required success condition is an anonymous request fails while authorized users retain protected access. The appropriate action is: Remove unnecessary public access and encrypt sensitive data under managed keys.

That approach concerns a different situation: staff retain elevated rights for months after changing roles. Role-based governance reduces excess privilege persistence. The required result is that an anonymous request fails while authorized users retain protected access. The appropriate action is: Remove unnecessary public access and encrypt sensitive data under managed keys.

That relates to a different issue: A service exposes its administrative interface to every network segment. Limiting reachability reduces opportunities for credential and service abuse. That is not a direct remedy for the requested outcome: An anonymous request fails while authorized users retain protected access. The appropriate action is: Remove unnecessary public access and encrypt sensitive data under managed keys.

That relates to a different issue: Two scans report conflicting CVEs for the same package after a patch rollout. Patch state and scanner signatures may change between observations. That is not a direct remedy for the requested outcome: The final report attributes downtime to documented maintenance or unresolved events. The appropriate action is: Retest only affected targets after services stabilize and retain timing context.

This action applies to a different case: A scan identifies a dangerous account permission but the permission is effectively denied by a higher-level policy. Effective access can depend on multiple policy layers. It does not establish the present requirement, where the final report attributes downtime to documented maintenance or unresolved events. The appropriate action is: Retest only affected targets after services stabilize and retain timing context.

That approach concerns a different situation: a host reports UDP ports as open-or-filtered and the analyst marks them definitely exploitable. Silence does not prove a UDP listener exists. The required result is that the final report attributes downtime to documented maintenance or unresolved events. The appropriate action is: Retest only affected targets after services stabilize and retain timing context.

That approach concerns a different situation: a public Git repository contains a historical path resembling a cloud access key. Source histories can retain credentials removed from current file versions. The required result is that the inventory distinguishes historical URLs from currently reachable endpoints. The appropriate action is: Examine authorized historical web snapshots for technology and path changes.

That relates to a different issue: A cloud team worries that an old object storage endpoint is indexed in search results. Search indices can disclose public paths even after application navigation changes. That is not a direct remedy for the requested outcome: The inventory distinguishes historical URLs from currently reachable endpoints. The appropriate action is: Examine authorized historical web snapshots for technology and path changes.

It would address a client asks testers to discover public subdomains without sending packets to the client's servers. The relevant reason in that case is: Certificate issuance logs expose hostnames passively but do not prove current ownership. Here the required success condition is the inventory distinguishes historical URLs from currently reachable endpoints. The appropriate action is: Examine authorized historical web snapshots for technology and path changes.

This action applies to a different case: A report needs proof that no unauthorized modification remained after a system-level assessment. Restoration requires verification, not a verbal cleanup statement. It does not establish the present requirement, where a safe follow-up request returns not found for the removed file. The appropriate action is: Remove the test file and verify that it is no longer remotely accessible.

That approach concerns a different situation: an assessment deployed a temporary cloud VM and associated public IP for a controlled attack simulation. Temporary test resources can create ongoing cost and exposure. The required result is that a safe follow-up request returns not found for the removed file. The appropriate action is: Remove the test file and verify that it is no longer remotely accessible.

That relates to a different issue: An exercise used a dedicated cloud API key that remains active after delivery. Leaving tester credentials active creates unnecessary future access. That is not a direct remedy for the requested outcome: A safe follow-up request returns not found for the removed file. The appropriate action is: Remove the test file and verify that it is no longer remotely accessible.

It would address a web login receives credentials from a known external breach list. The relevant reason in that case is: Credential stuffing reuses previously leaked username-password combinations. Here the required success condition is a synthetic account log shows the same password attempted across distinct users. The relevant evidence is: A synthetic account log shows the same password attempted across distinct users.

That approach concerns a different situation: an assessment sees valid Kerberos tickets used on another system outside their intended workflow. Kerberos tickets are bearer-like credentials within their valid scope. The required result is that a synthetic account log shows the same password attempted across distinct users. The relevant evidence is: A synthetic account log shows the same password attempted across distinct users.

That relates to a different issue: One account receives hundreds of password guesses in a short period. Brute force concentrates many guesses against one identity. That is not a direct remedy for the requested outcome: A synthetic account log shows the same password attempted across distinct users. The relevant evidence is: A synthetic account log shows the same password attempted across distinct users.

That relates to a different issue: A network weakness requires two earlier access conditions that are not present in the scoped lab. An attack chain is limited by its unmet prerequisite steps. That is not a direct remedy for the requested outcome: Only vetted, approved test components enter the lab environment. The relevant evidence is: Only vetted, approved test components enter the lab environment.

This result applies to a different case: A customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. It does not establish the present requirement, where only vetted, approved test components enter the lab environment. The relevant evidence is: Only vetted, approved test components enter the lab environment.

That approach concerns a different situation: an old exposed service is at end of life with no maintained security updates. Unsupported systems may have unfixable exposure and high business risk. The required result is that only vetted, approved test components enter the lab environment. The relevant evidence is: Only vetted, approved test components enter the lab environment.

That approach concerns a different situation: a tester sees port 445 on an authorized server but has no credentials to enumerate its shares. Service availability is not the same as permission to enumerate protected resources. The required result is that a controlled capture demonstrates the sensitive protocol lacks protection. The relevant evidence is: A controlled capture demonstrates the sensitive protocol lacks protection.

It would address an assessor detects unsupported SMB dialects enabled for a legacy file service. The relevant reason in that case is: Older dialects can lack modern session security features. Here the required success condition is a controlled capture demonstrates the sensitive protocol lacks protection. The relevant evidence is: A controlled capture demonstrates the sensitive protocol lacks protection.

This result applies to a different case: A packet trace shows ARP responses for the same IP from conflicting MAC addresses. ARP trust can allow local interception when endpoint mappings are falsified. It does not establish the present requirement, where a controlled capture demonstrates the sensitive protocol lacks protection. The relevant evidence is: A controlled capture demonstrates the sensitive protocol lacks protection.

This result applies to a different case: A login system sends session cookies without Secure on an HTTPS-only site. Cookie attributes reduce exposure to transport and script risks. It does not establish the present requirement, where two synthetic users never receive each other's cached private content. The relevant evidence is: Two synthetic users never receive each other's cached private content.

That relates to a different issue: A user logs out but an old test session cookie continues granting access. Removing a cookie client-side does not necessarily revoke server authority. That is not a direct remedy for the requested outcome: Two synthetic users never receive each other's cached private content. The relevant evidence is: Two synthetic users never receive each other's cached private content.

It would address a picture import URL is fetched by a server with access to internal service endpoints. The relevant reason in that case is: User-supplied destinations can redirect server trust to internal resources. Here the required success condition is two synthetic users never receive each other's cached private content. The relevant evidence is: Two synthetic users never receive each other's cached private content.

It would address an office Wi-Fi assessment records a strong signal from a neighbor-owned access point. The relevant reason in that case is: Physical proximity does not establish authorization to test a wireless asset. Here the required success condition is the notes distinguish observed proxy denial from backend application response. The relevant evidence is: The notes distinguish observed proxy denial from backend application response.

That approach concerns a different situation: an assessment discovers a DNS alias that points from an approved hostname to a provider-owned domain. Aliases do not extend consent to the target infrastructure automatically. The required result is that the notes distinguish observed proxy denial from backend application response. The relevant evidence is: The notes distinguish observed proxy denial from backend application response.

That relates to a different issue: A security review wants to map paths from a low-privilege directory user to high-value assets. Attack paths may depend on indirect privilege edges rather than direct role grants. That is not a direct remedy for the requested outcome: The notes distinguish observed proxy denial from backend application response. The relevant evidence is: The notes distinguish observed proxy denial from backend application response.

That relates to a different issue: A temporary password was set on an approved test account during a proof. Temporary authentication changes can create lingering security risk. That is not a direct remedy for the requested outcome: The directory has no active assessment account and shows a removal record. The relevant evidence is: The directory has no active assessment account and shows a removal record.

This result applies to a different case: A temporary firewall exception was added to a test subnet under approved change control. Testing changes must not weaken production controls after the engagement. It does not establish the present requirement, where the directory has no active assessment account and shows a removal record. The relevant evidence is: The directory has no active assessment account and shows a removal record.

That approach concerns a different situation: a tester's temporary agent service remains installed after a sandbox demonstration. Removing the installer alone does not terminate active service components. The required result is that the directory has no active assessment account and shows a removal record. The relevant evidence is: The directory has no active assessment account and shows a removal record.

That approach concerns a different situation: the final demonstration was technically complete but the customer has not confirmed acceptance criteria. Contractual delivery is not identical to internal test completion. The required result is that the case has an acknowledged urgent notification and incident owner. The relevant evidence is: The case has an acknowledged urgent notification and incident owner.

It would address a security team wants to publish screenshots showing real account names in a public presentation. The relevant reason in that case is: Client confidentiality extends to demonstrations and marketing material. Here the required success condition is the case has an acknowledged urgent notification and incident owner. The relevant evidence is: The case has an acknowledged urgent notification and incident owner.

This result applies to a different case: A remote client asks testers to send raw extracted authentication tokens by ordinary email. Sensitive evidence needs confidentiality and controlled recipients. It does not establish the present requirement, where the case has an acknowledged urgent notification and incident owner. The relevant evidence is: The case has an acknowledged urgent notification and incident owner.