A municipal engagement objective is proving a path to a crown-jewel file server via Active Directory. The tester already has a viable path but considers dumping NTDS "for completeness." What methodology stance is correct?
Select an answer to reveal the explanation.
Short Explanation
Show you can reach the crown jewel — do not empty the vault onto a USB "just because." Extra secret dumps raise real-world harm without proving more. Least exposure still tells a clear story.
Full Explanation
Professional methodology proves impact with minimal sensitive data exposure. If a municipal engagement objective is a path to a crown-jewel file server via Active Directory and a viable path is already shown, dumping NTDS “for completeness” is usually unnecessary and increases handling risk for citizen-adjacent identity data. Prefer screenshots, limited proofs, and path diagrams over wholesale secret collection beyond objectives and RoE.
Always dumping NTDS whenever DA is reached ignores data-minimization and objective focus. Maximizing collected secrets does not improve RoE compliance—it can violate it. Stopping all reporting because a path exists is also wrong; report the path thoroughly without gratuitous secret dumps.
Exam caveat: CPTS judgment questions often test restraint and objective alignment, not maximum destructiveness. Distinguish proving access from exfiltrating the entire credential database.
Operational check: document the proven AD path to the file server with least-sensitive evidence, confirm with the civic point of contact whether any additional proof is authorized, and avoid NTDS extraction unless explicitly in scope and necessary. Data minimization protects residents whose identities live in the same directory the assessment just proved it could reach.