A municipal tester proposes running every Active Directory attack tool simultaneously on day one. What is the better professional approach?
Select an answer to reveal the explanation.
Short Explanation
A toolbox dump is not a plan. Start with what you can see, then pick the next technique that the evidence supports. Shotgun AD tooling is loud, messy, and often outside the spirit of the RoE.
Full Explanation
If a municipal tester proposes running every Active Directory attack tool simultaneously on day one, the better professional approach is to enumerate purposefully and choose follow-on techniques driven by discoveries rather than shotgun tooling. Launching all tools at once maximizes noise and collision risk regardless of findings or RoE limits. Avoiding all AD enumeration because any directory query supposedly violates privacy law by default is an overbroad freeze that would block authorized internal assessments. Running attack tools only after deleting all logs so blue teams cannot rate the engagement destroys cooperation and evidence integrity. Exam caveat: purposeful sequencing beats tool spam on CPTS-style AD questions. Operational check: build an enumeration backlog from initial context, run one technique class at a time with notes, and escalate only when evidence and RoE support the next step. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.