A city wants the tester to exercise browser-based admin apps that are only reachable through an internal path after foothold. Which pivoting pattern fits that use-case?
Select an answer to reveal the explanation.
Short Explanation
Internal admin sites that only load through the pivot path are awkward if every click needs a brand-new one-port forward. A dynamic SOCKS-style proxy is like giving your browser a temporary on-site tour guide. It flexes with whatever URLs those admin apps throw at you—still inside the rules.
Full Explanation
When a city wants browser-based admin apps reachable only through an internal path after foothold, a dynamic proxy (SOCKS-class) through the foothold fits flexible web access better than rigid single-port hacks alone. Screenshotting apps from memory without a network path does not provide interactive testing of those admin UIs. Publishing the admin apps to the public Internet for easier testing expands attack surface and is not a tester’s change to make. Relying solely on ICMP echo replies cannot drive HTTP(S) admin workflows. Exam caveat: choose pivot patterns that match the application interaction model under RoE. Operational check: stand up an approved dynamic proxy through the foothold, point the tester browser via that path, verify each admin app host is in-scope, and tear the proxy down after the municipal web-admin test window. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.