During a municipal AD engagement, an anxious stakeholder asks the tester to “disable the entire domain to stop the test.” What is the professional next step?
Select an answer to reveal the explanation.
Short Explanation
Stopping a pentest is not the same as torching the forest. Testers do not “fix” domains by knocking over DCs or wiping privileged groups. The grown-up move is to pause active work and hand containment decisions to the client’s IR team under the agreed process.
Full Explanation
When an anxious municipal stakeholder asks the tester to “disable the entire domain to stop the test,” the professional next step is coordinated, controlled containment with the client’s incident response contacts—not reckless forest-wide breakage. Engagements serving cities must protect citizen-facing authentication continuity while addressing risk; panicking into domain-wide outages creates a worse incident than the assessment itself.
Forcing a forest-wide password reset from the tester’s laptop without change control is unauthorized chaos. Shutting down every DC to stop scanning damages availability for public services. Deleting Domain Admins is destructive and not a containment method.
Exam caveat: CPTS professionalism includes knowing when to stop technical actions and escalate to the client’s IR/change process. Testers advise and coordinate; they do not unilaterally wreck the forest.
Operational check: pause aggressive testing if requested, contact the named civic IR/technical authorities per RoE, document containment choices, and resume only under explicit updated authorization. Document who authorized pause/resume decisions in the engagement log so future municipal assessments inherit the same IR coordination discipline.