A municipal SOC notices unexpected reverse connections from a workstation used as a pivot. Beyond stopping the noise, what should the tester ensure for the engagement record?
Select an answer to reveal the explanation.
Short Explanation
If the SOC sees weird reverse connections, your job is not to gaslight them—it is to have a clean notebook of every tunnel and forward you stood up. Documenting pivot channels is like leaving a labeled map of temporary detours. Cleanup goes faster, and nobody wonders what mystery wires you left behind.
Full Explanation
Pivot and tunnel artifacts should be recorded for evidence appendices and coordinated cleanup. Transparent documentation helps the SOC distinguish tester activity from unrelated compromise. Hiding channels, deleting logs, or relocating undocumented tunnels undermines trust and operational safety. Professional lateral movement includes bookkeeping of how reachability was extended.