A court IT manager frames success as 'get in and root everything,' while the engagement objective is protecting case data. What should the tester reinforce?
Select an answer to reveal the explanation.
Short Explanation
CTF high scores feel great; clients pay for risk answers. If the goal is protecting case data, show paths that threaten that data — not just every root shell you can collect. Objectives steer the work.
Full Explanation
When court IT frames success as 'get in and root everything' but the engagement objective is protecting case data, the tester should reinforce alignment with agreed business risk objectives. Demonstrating paths that expose sealed records, case files, or custody systems may matter more than collecting shells on every host for CTF-style scoring. Abandoning written objectives to chase domain admin everywhere prioritizes ego over judicial data protection. Counting only reverse shells while ignoring data-exposure paths understates risk to the court. Refusing impact narratives leaves executives without decision-ready context. Exam caveat: privilege escalation can still be in scope when it supports the data-protection story; the point is purposeful testing, not scoreboard maximalism on court hosts. Operational check: map each major finding to case-data confidentiality, integrity, or availability impact, cite evidence of exposure or control failure, and keep remediation advice tied to the court's stated objective in the commercial report. In municipal operations, record the decision and residual risk in the engagement notes so future civic responders understand which control or boundary was honored and which failure modes the rejected approaches would create for public services. Re-check the same control at the next maintenance window or retest cycle.