From the approved test VLAN, a city domain controller still permits null-session enumeration of users and shares. What should the tester report?
Select an answer to reveal the explanation.
Short Explanation
A null session is like browsing the directory board in the lobby without signing in. Even without a badge, names and room lists can leak. That free intel feeds the next moves — shut it down where policy allows.
Full Explanation
Anonymous or null sessions against a city domain controller can still disclose account lists, share names, and related metadata useful for further targeting. From an approved test VLAN, that enumeration is a real information-leak finding for municipal identity infrastructure: free reconnaissance feeds password spraying, phishing pretexting, and share hunting without proving Domain Admin rights.
Null sessions are not obsolete on every modern DC—harden configurations still matter where anonymous IPC or related access remains. Null-session access is an enumeration finding, not evidence the tester already holds Domain Admin. Kerberos ticket renewal does not require leaving anonymous SMB/IPC enumeration open; that claim confuses protocol necessity with unnecessary exposure.
Exam caveat: report null/anonymous disclosure as reconnaissance risk and align remediation with RoE and client hardening baselines—do not inflate it into full domain compromise. CPTS judgments separate “what leaked” from “what privilege was achieved.”
Operational check: from the approved VLAN, re-verify whether anonymous enumeration of users/shares still succeeds after hardening, capture before/after evidence for the civic AD report, and confirm monitoring alerts on anonymous bind or null-session patterns against DCs.