A library engagement opens multiple Metasploit sessions across hosts. What session-management practice best protects scope?
Select an answer to reveal the explanation.
Short Explanation
Sessions are like borrowed keys—if you lose track of which door each one opens, you wander into rooms you were never invited to. Tag them, know the host, and pause at the property line. Scope discipline beats clever pivoting every time.
Full Explanation
When a library engagement opens multiple Metasploit sessions, scope protection depends on labeling and tracking each session to its in-scope target and stopping before any pivot that would leave the approved boundary. Unnamed sessions invite operator confusion and accidental interaction with the wrong host—exactly the failure mode civic RoE is written to prevent. Automatically pivoting from every new session into adjacent subnets maximizes coverage at the cost of authorization and can land in OT, partner, or citizen-data segments that were never approved. Closing all sessions immediately after opening them empties inventory but defeats legitimate post-exploitation and evidence collection the engagement may require. Exam caveat: technical reachability is not authorization; CPTS answers emphasize session hygiene tied to written scope. Operational check: maintain a session register (host, CIDR, purpose, time opened), verify each action against the library RoE CIDR list, and tear down or freeze any session whose next hop would cross an unapproved boundary. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.