A red-team tester has been contracted to emulate the threat posed by a malicious insider on a company's network, with the constrained objective of gaining access to sensitive personnel files.
During the assessment, the red-team tester identifies an artifact indicating possible prior compromise within the target environment.
Which of the following actions should the tester take?

Question

A red-team tester has been contracted to emulate the threat posed by a malicious insider on a company's network, with the constrained objective of gaining access to sensitive personnel files.

During the assessment, the red-team tester identifies an artifact indicating possible prior compromise within the target environment.

Which of the following actions should the tester take?

Aygul Korkmazlar · Accepted Answer

Halt the assessment and follow the reporting procedures as outlined in the contract.

Aygul Korkmazlar · Answer

Perform forensic analysis to isolate the means of compromise and determine attribution.

Aygul Korkmazlar · Answer

Incorporate the newly identified method of compromise into the red team's approach.

Aygul Korkmazlar · Answer

Create a detailed document of findings before continuing with the assessment.

Question list

List of questions

Question 1

(0)

Question 2

(0)

Question 3

(0)

Question 4

(0)

Question 5

(0)

Question 6

(0)

Question 7

(0)

Question 8

(0)

Question 9

(0)

Question 10

(0)

Related questions

Question 77 - PT0-002 discussion

Suggested answer: D

0 comments