A county sponsor wants every password in a huge list tried against production OWA tonight. What is the correct response?
Select an answer to reveal the explanation.
Short Explanation
Dumping a giant list at production mail is like leaning on every doorbell in the building until someone yells. Lockouts and outages are real, and RoE usually forbids that kind of noise. Push back, propose safer limits, and keep the service standing.
Full Explanation
Online brute force against production authentication can trigger account lockouts, overwhelm logging, and degrade availability for legitimate users. Rules of Engagement commonly constrain attempt rates, windows, and target sets precisely to prevent those outcomes. Testers should refuse unbounded campaigns, document constraints, and use approved low-impact alternatives when credential testing is allowed. Availability risk is a first-class decision factor, not an afterthought once a wordlist is ready.