A city IT lead wants Metasploit used for every exploitation task on the engagement. What is the soundest way to position the framework?
Select an answer to reveal the explanation.
Short Explanation
Think of Metasploit like a power drill in a toolbox—not the whole workshop. It shines for modules, sessions, and post tasks, but you still need hands-on checks to confirm what actually matters to the city. Automation helps; judgment finishes the job.
Full Explanation
On a city engagement, Metasploit is best positioned as a module and session framework that accelerates recon helpers, delivery paths, and post-session work—not as a substitute for professional judgment. Manual validation remains essential where false positives, fragile municipal services, or impact nuance matter. Replacing all manual testing with modules for “consistency” trades rigor for automation theater and can miss context the framework never models. Avoiding Metasploit entirely because frameworks supposedly invalidate findings is an extreme that discards useful, widely accepted tooling when RoE allows it. Using Metasploit only for report screenshots after exploitation elsewhere underuses its legitimate session and post capabilities and invents an artificial split. Exam caveat: tool success banners are not business impact; CPTS-style questions reward measured use plus evidence. Operational check: for each municipal target, note whether a module was used for access or convenience, then confirm the finding with independent evidence (manual reproduction, config proof, or controlled session output) before severity is finalized in the city report. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.