A county wants stealthy scan timing but also has a short engagement window. How should the tester judge the tradeoff?
Select an answer to reveal the explanation.
Short Explanation
Stealth and a ticking clock pull in opposite directions. RoE and the engagement goals tell you which way to lean this week. There is no universal 'always slow' or 'always loud' medal.
Full Explanation
When a county wants stealthy scan timing but also has a short engagement window, the tester must balance timing against deadlines and detectability expectations using rules of engagement and stated goals. Always choosing the slowest timing can burn the window without finishing critical assets. Always choosing the fastest aggressive profile ignores stealth requirements the county may need for production stability or SOC readiness. Ignoring both timing and deadlines while relying on a single packet cannot fingerprint an entire network responsibly. Exam caveat: different segments may receive different timing profiles—fragile VLANs slower, hardened lab subnets faster—if RoE allows. Operational check: propose a timing plan that covers crown-jewel county systems first at acceptable noise levels, get SOC acknowledgment, and adjust mid-week based on alert volume and remaining calendar time. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services. Document the rationale in the municipal engagement notes so later civic responders know which boundary was honored and which failure modes the rejected options would create for public services.