During business hours, a municipal tester begins a very large, noisy Active Directory data pull that conflicts with the agreed RoE timing. What should the tester do?
Select an answer to reveal the explanation.
Short Explanation
Big directory vacuums during peak hours are like running a leaf blower in a quiet library. RoE timing exists so ops are not blindsided. Slow down, schedule smarter — do not "fix" the problem by going darker or dumping more.
Full Explanation
Rules of engagement govern timing and operational impact. When a municipal tester starts a very large, noisy Active Directory data pull during business hours against agreed RoE timing, the correct stance is to throttle and reschedule enumeration to respect the agreement and reduce risk to citizen-facing directory load. Professional AD assessment is constrained by authorization and production care, not by maximum possible speed.
Directory reads are not guaranteed harmless at unlimited scale—DCs and replication can feel bulk enumeration. Disabling logging to appear quieter violates defender visibility expectations and often RoE ethics. Jumping to NTDS dumping to “finish faster” escalates sensitivity and may violate objectives and authorization.
Exam caveat: CPTS methodology prizes controlled, RoE-aligned progression; noisy or out-of-window actions are process failures even if technically interesting. Report methodology discipline alongside technical findings.
Operational check: pause the pull, notify the civic technical point of contact if required by RoE, reschedule into the approved window with rate limits, and document the adjustment in the engagement log. Civic directory health and citizen-facing authentication should not be collateral damage of an over-eager enumeration burst outside the approved window.