A county assessor asks why enumeration is not the same as exploitation during a CPTS-style engagement. What is the clearest distinction?
Select an answer to reveal the explanation.
Short Explanation
Enumeration is taking inventory of doors, locks, and windows. Exploitation is carefully checking whether a weak lock actually opens under permission. Counting hinges is not the same as walking inside.
Full Explanation
Enumeration and exploitation are distinct phases on a county engagement. Enumeration maps services, users, shares, configurations, and other attack-surface detail so the tester understands what exists. Exploitation attempts to leverage weaknesses to gain unauthorized control or demonstrate impact within authorized scope. They are not synonyms in commercial templates, and treating them as such obscures how far testing actually progressed for the county assessor. Enumeration does not always require malware droppers, nor is exploitation limited to password spraying. Exploitation before enumeration is backwards methodology and does not speed credible labeling. Exam caveat: some tools blur lines with 'safe checks,' but reporting should still separate inventory from proven compromise on assessor systems. Operational check: in notes and the report, tag activities as enumeration versus exploitation, list what was only observed versus what was successfully leveraged, and ensure RoE thresholds for exploit attempts were respected before any impact demonstration. In municipal operations, record the decision and residual risk in the engagement notes so future civic responders understand which control or boundary was honored and which failure modes the rejected approaches would create for public services. Re-check the same control at the next maintenance window or retest cycle.