A municipal SOC notices unexpected reverse connections from a workstation used as a pivot. Beyond stopping the noise, what should the tester ensure for the engagement record?
Select an answer to reveal the explanation.
Short Explanation
If the SOC sees weird reverse connections, your job is not to gaslight them—it is to have a clean notebook of every tunnel and forward you stood up. Documenting pivot channels is like leaving a labeled map of temporary detours. Cleanup goes faster, and nobody wonders what mystery wires you left behind.
Full Explanation
When a municipal SOC notices unexpected reverse connections from a workstation used as a pivot, the tester—beyond stopping harmful noise—must document pivot and tunnel channels clearly so cleanup and transparency are possible. Deleting all logs so the SOC cannot investigate further destroys forensic cooperation and professional trust. Denying that any pivot existed because reverse connections are “normal” is dishonest reporting. Moving the same undocumented tunnels to a second host overnight doubles opacity and incident risk. Exam caveat: authorized testing still requires defender-visible accountability when channels look like intrusions. Operational check: maintain a live channel inventory (hosts, ports, protocols, purpose), share IOCs with the SOC per RoE liaison rules, and confirm teardown evidence at stop or when asked to halt a noisy path. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.