A municipal tester proposes spraying AD passwords during the city’s lunch peak without checking lockout policy. What constraint should shape that decision first?
Select an answer to reveal the explanation.
Short Explanation
Lunch rush is when help desks already drown in tickets — do not add a wave of locked civic accounts. Spray-class tests live or die on lockout math and the RoE clock. Speed without those checks is just how you become the outage.
Full Explanation
Password spraying against Active Directory must respect account lockout policy and rules-of-engagement timing windows before any spray-class testing. A municipal tester proposing lunch-peak sprays without checking lockout first risks locking staff out of citizen-service systems and violating engagement constraints. Safety and authorization shape the decision before wordlist cleverness.
Spraying as fast as possible to “finish lockouts before lunch ends” is reckless. Short wordlists do not make sprays always safe. Lockout policies apply to domain users, not only local SAM accounts.
Exam caveat: CPTS professionalism ranks RoE and availability above aggressive credential attacks. Confirm lockout thresholds, exclusions, and approved windows in writing.
Operational check: read domain lockout policy with the civic tech contact, choose rates and windows that avoid mass lockout, monitor helpdesk signals during any approved spray, and stop immediately if impact exceeds agreement. Capture pre-approved spray parameters in the RoE appendix so lunch-hour pressure never overrides lockout math for municipal account availability. If lockout math is unclear, do not spray—escalate to the municipal technical point of contact first.