A county sponsor wants every password in a huge list tried against production OWA tonight. What is the correct response?
Select an answer to reveal the explanation.
Short Explanation
Dumping a giant list at production mail is like leaning on every doorbell in the building until someone yells. Lockouts and outages are real, and RoE usually forbids that kind of noise. Push back, propose safer limits, and keep the service standing.
Full Explanation
If a county sponsor wants every password in a huge list tried against production OWA tonight, the correct response is to reject unbounded online brute force that risks lockouts or denial of service and to stay inside RoE rate and availability limits. Popularity of a wordlist is not authorization; civic mail portals are production services for staff continuity. Proceeding after hours without documenting the method still violates caps and hides risky technique choices from the report. Throttling to one guess per second while ignoring remaining RoE caps invents a personal rule that may still exceed approved volume or banned windows. Exam caveat: online attacks are constrained by operational safety even when lockout appears absent or weak. Operational check: cite the RoE rate, concurrency, and time-window clauses back to the sponsor, propose an approved spray-class alternative if in scope, and record the refusal so the engagement file shows safety over sponsorship pressure. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services.