A transit internal compromise needs to be explained in the report. What should the attack-path section emphasize?
Select an answer to reveal the explanation.
Short Explanation
Tell the story of how the pieces clicked—door, hallway, records room—with proof photos. Do not hand strangers a printed burglary manual.
Full Explanation
A transit internal compromise narrative should emphasize a coherent attack path from entry to impact with professional evidence, without publishing a ready-to-reuse exploit cookbook. Readers need causality and proof, not a public weaponization guide.
A step-by-step weaponization guide for anyone on the internet is inappropriate. A single screenshot with no narrative fails to connect findings. Claiming attack paths are unnecessary if CVSS scores exist ignores how municipal defenders triage chained risk.
Exam caveat: include enough detail for remediation and verification while omitting gratuitous exploit packaging.
Operational check: write the path as ordered stages with evidence pointers, redact weaponizing minutiae, and validate that transit IT can replay defensive detections from the narrative. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services.