During a municipal AD engagement, an anxious stakeholder asks the tester to “disable the entire domain to stop the test.” What is the professional next step?
Select an answer to reveal the explanation.
Short Explanation
Stopping a pentest is not the same as torching the forest. Testers do not “fix” domains by knocking over DCs or wiping privileged groups. The grown-up move is to pause active work and hand containment decisions to the client’s IR team under the agreed process.
Full Explanation
Rules of engagement and professional methodology require testers to avoid reckless domain-wide disruption. If stakeholders want testing stopped or systems contained, the correct path is coordinated communication with designated incident response or operations contacts, following change and safety procedures. Forest-wide resets, DC shutdowns, or destructive group deletions by the tester create outages and destroy forensic value. CPTS-style AD work prioritizes controlled containment over unilateral breakage.