Exam Bundle

This action applies to a different case: An enterprise scans an image for packages but ignores application-specific authorization flaws. Dependency CVEs and logic vulnerabilities need different testing techniques. It does not establish the present requirement, where the results reference the exact staging route and reproducible observed condition. The appropriate action is: Use authorized dynamic application security testing with controlled test accounts.

That approach concerns a different situation: an enterprise wants to find missing patches that unauthenticated perimeter scans cannot verify. Authenticated scans can inspect local package or registry state beyond network banners. The required result is that the results reference the exact staging route and reproducible observed condition. The appropriate action is: Use authorized dynamic application security testing with controlled test accounts.

That relates to a different issue: An application security team needs to test live behavior after new API endpoints are deployed. Runtime behavior may differ from static source expectations. That is not a direct remedy for the requested outcome: The results reference the exact staging route and reproducible observed condition. The appropriate action is: Use authorized dynamic application security testing with controlled test accounts.

That relates to a different issue: A service exposes its administrative interface to every network segment. Limiting reachability reduces opportunities for credential and service abuse. That is not a direct remedy for the requested outcome: A TLS test rejects obsolete suites and accepts the approved configuration. The appropriate action is: Disable weak protocol and cipher suites and validate modern client compatibility.

It would address a login form is vulnerable to injected SQL fragments in a parameter. The relevant reason in that case is: Bound query parameters prevent user input from becoming SQL syntax. Here the required success condition is a TLS test rejects obsolete suites and accepts the approved configuration. The appropriate action is: Disable weak protocol and cipher suites and validate modern client compatibility.

This action applies to a different case: An administrator can reach production backups using the same broad privileges as developers. Privilege separation limits destructive access from routine accounts. It does not establish the present requirement, where a TLS test rejects obsolete suites and accepts the approved configuration. The appropriate action is: Disable weak protocol and cipher suites and validate modern client compatibility.

That approach concerns a different situation: a web scanner claims SQL injection because a quote produces an HTTP 500 response. Generic server errors do not prove attacker-controlled SQL execution. The required result is that an unapproved external redirect is blocked. The appropriate action is: Apply a relative-path or destination allowlist for redirect parameters.

That relates to a different issue: An OAuth API lets a read-only token change a different user's account settings. A valid token is insufficient when it lacks the required action or object access. That is not a direct remedy for the requested outcome: An unapproved external redirect is blocked. The appropriate action is: Apply a relative-path or destination allowlist for redirect parameters.

It would address a theme installer accepts an external URL that is included into server-side code execution. The relevant reason in that case is: Server execution should not import untrusted remote code. Here the required success condition is an unapproved external redirect is blocked. The appropriate action is: Apply a relative-path or destination allowlist for redirect parameters.

This action applies to a different case: A server reports a plugin directory but no plugin version in HTTP headers. Plugin presence is not proof of a particular exploitable release. It does not establish the present requirement, where the notes distinguish observed proxy denial from backend application response. The appropriate action is: Perform approved benign fingerprint observations before risk-bearing parameter tests.

That approach concerns a different situation: an internet search engine lists a public RDP endpoint whose owner may have changed. Search-engine indexes can lag infrastructure reassignment. The required result is that the notes distinguish observed proxy denial from backend application response. The appropriate action is: Perform approved benign fingerprint observations before risk-bearing parameter tests.

That relates to a different issue: A permitted SMB account lists a share with write permission although the business expected read-only access. Authorization may differ between share and filesystem permission layers. That is not a direct remedy for the requested outcome: The notes distinguish observed proxy denial from backend application response. The appropriate action is: Perform approved benign fingerprint observations before risk-bearing parameter tests.

This result applies to a different case: An endpoint accepts unsigned drivers from a normal user context in an authorized lab. Unsigned kernel components can threaten host integrity. It does not establish the present requirement, where the finding shows the suspicious behavior rather than binary name alone. The relevant evidence is: The finding shows the suspicious behavior rather than binary name alone.

That approach concerns a different situation: a Windows service binary directory is writable by ordinary users while the service runs as a privileged identity. Writable privileged service artifacts can cross user-to-system trust boundaries. The required result is that the finding shows the suspicious behavior rather than binary name alone. The relevant evidence is: The finding shows the suspicious behavior rather than binary name alone.

That relates to a different issue: A sandboxed application allows launching an unrestricted terminal through a helper menu. Process spawning can bypass an application's intended restricted environment. That is not a direct remedy for the requested outcome: The finding shows the suspicious behavior rather than binary name alone. The relevant evidence is: The finding shows the suspicious behavior rather than binary name alone.

That relates to a different issue: A client's lab shows a service accepts authentication using an old expired ticket. Kerberos security depends on correctly enforced validity intervals. That is not a direct remedy for the requested outcome: The report identifies weak authentication design without collecting production hashes. The appropriate action is: Classify the weakness as pass-the-hash exposure and recommend protocol hardening.

This action applies to a different case: A password audit tests a curated wordlist against approved offline synthetic hashes. Dictionary attacks try likely words instead of exhaustive permutations. It does not establish the present requirement, where the report identifies weak authentication design without collecting production hashes. The appropriate action is: Classify the weakness as pass-the-hash exposure and recommend protocol hardening.

That approach concerns a different situation: an analyst needs an offline password strength assessment but policy prohibits online guessing. Offline password auditing can measure weakness without account lockouts. The required result is that the report identifies weak authentication design without collecting production hashes. The appropriate action is: Classify the weakness as pass-the-hash exposure and recommend protocol hardening.

That approach concerns a different situation: a client wants a recognized penetration-testing service accreditation model. CREST provides professional testing standards and assurance mechanisms. The required result is that the risk worksheet evaluates relevant DREAD factors consistently. The relevant evidence is: The risk worksheet evaluates relevant DREAD factors consistently.

That relates to a different issue: An industrial plant needs a diagram of enterprise, supervisory, and process-control zones. Purdue levels organize industrial control network functions and boundaries. That is not a direct remedy for the requested outcome: The risk worksheet evaluates relevant DREAD factors consistently. The relevant evidence is: The risk worksheet evaluates relevant DREAD factors consistently.

It would address a web application team wants a prioritized list of common application security risk categories. The relevant reason in that case is: OWASP Top 10 groups frequent web application security risks. Here the required success condition is the risk worksheet evaluates relevant DREAD factors consistently. The relevant evidence is: The risk worksheet evaluates relevant DREAD factors consistently.

That approach concerns a different situation: a customer wants an attack storyboard showing possible lateral movement through several systems. Attack narratives must separate proven links from hypothetical dependencies. The required result is that the engagement plan documents lifecycle status and safe validation limits. The appropriate action is: Assess compensating controls and replacement urgency before selecting any exploit.

That relates to a different issue: A tester selects an attack tool because it is familiar, not because it matches target protocol. Tool choice should be threat-led and technically appropriate. That is not a direct remedy for the requested outcome: The engagement plan documents lifecycle status and safe validation limits. The appropriate action is: Assess compensating controls and replacement urgency before selecting any exploit.

It would address an assessment uses only a CVSS number to estimate the likelihood of active exploitation. The relevant reason in that case is: EPSS estimates exploitation likelihood rather than vulnerability impact. Here the required success condition is the engagement plan documents lifecycle status and safe validation limits. The appropriate action is: Assess compensating controls and replacement urgency before selecting any exploit.

It would address a target's CDN returns the same default page for every unknown URL. The relevant reason in that case is: Uniform fallback responses can make missing endpoints appear valid. Here the required success condition is the report flags proxy observations and avoids unsupported origin claims. The appropriate action is: Differentiate reverse-proxy behavior from direct application behavior during enumeration.

This action applies to a different case: A security review wants to map paths from a low-privilege directory user to high-value assets. Attack paths may depend on indirect privilege edges rather than direct role grants. It does not establish the present requirement, where the report flags proxy observations and avoids unsupported origin claims. The appropriate action is: Differentiate reverse-proxy behavior from direct application behavior during enumeration.

That relates to a different issue: A route hidden from the site's navigation remains in the XML sitemap. Sitemaps are inventory aids and not access permissions. That is not a direct remedy for the requested outcome: The report flags proxy observations and avoids unsupported origin claims. The appropriate action is: Differentiate reverse-proxy behavior from direct application behavior during enumeration.

That relates to a different issue: A test engineer wishes to find vulnerable applications in managed serverless services. Serverless resources lack direct host scanning but still have code and identity risks. That is not a direct remedy for the requested outcome: The report distinguishes perimeter exposure from internal asset coverage. The relevant evidence is: The report distinguishes perimeter exposure from internal asset coverage.

It would address a CI pipeline contains an image registry scanner but scans only a mutable latest tag. The relevant reason in that case is: Mutable tags can change between scan and deployment, invalidating evidence. Here the required success condition is the report distinguishes perimeter exposure from internal asset coverage. The relevant evidence is: The report distinguishes perimeter exposure from internal asset coverage.

That approach concerns a different situation: a container repository may contain vulnerable dependencies absent from the running host inventory. Image-layer dependencies can be vulnerable even without an exposed network service. The required result is that the report distinguishes perimeter exposure from internal asset coverage. The relevant evidence is: The report distinguishes perimeter exposure from internal asset coverage.

That approach concerns a different situation: a target's apparent firewall gateway presents a branded error page instead of backend responses. Security intermediaries can mask backend versions and path behavior. The required result is that the report distinguishes normal access control from demonstrated weaknesses. The relevant evidence is: The report distinguishes normal access control from demonstrated weaknesses.

It would address a cloud endpoint returns a metadata document with instance identifiers visible only from inside the instance. The relevant reason in that case is: Instance metadata normally has context-specific network access boundaries. Here the required success condition is the report distinguishes normal access control from demonstrated weaknesses. The relevant evidence is: The report distinguishes normal access control from demonstrated weaknesses.

This result applies to a different case: A route hidden from the site's navigation remains in the XML sitemap. Sitemaps are inventory aids and not access permissions. It does not establish the present requirement, where the report distinguishes normal access control from demonstrated weaknesses. The relevant evidence is: The report distinguishes normal access control from demonstrated weaknesses.