A municipal engagement objective is proving a path to a crown-jewel file server via Active Directory. The tester already has a viable path but considers dumping NTDS "for completeness." What methodology stance is correct?
Select an answer to reveal the explanation.
Short Explanation
Show you can reach the crown jewel — do not empty the vault onto a USB "just because." Extra secret dumps raise real-world harm without proving more. Least exposure still tells a clear story.
Full Explanation
Professional AD methodology aligns collection with engagement objectives and minimizes unnecessary exposure of credential material. Demonstrating a path to a named crown-jewel asset can be evidenced without wholesale NTDS extraction when that dump is not required. Maximizing secret collection is not synonymous with RoE compliance. Reporting should still document impact with careful, minimal artifacts.