A county foothold drops intermittently. The team wants to race into deep lateral movement immediately. What should come first?
Select an answer to reveal the explanation.
Short Explanation
Building a second story on a wobbly foundation is how you end up in the basement with no ladder. Steady the foothold, write down how you got it, then grow laterally. Deep moves on a dying shell just strand you mid-journey.
Full Explanation
When a county foothold drops intermittently and the team wants to race into deep lateral movement, stabilizing and documenting the foothold should come first. Expanding to every visible subnet before fixing access stability multiplies incomplete work and lost evidence. Deleting the unstable shell and hoping a better one appears later abandons recoverable access without cause. Skipping notes because unstable access makes evidence “pointless” guarantees an unusable engagement record. Exam caveat: persistence and documentation precede sprawling lateral campaigns. Operational check: restore reliable access within RoE (re-auth, approved persistence if allowed), write down host identity and path, then proceed with prioritized lateral objectives tied to county crown jewels. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments. Keep secret material and session artifacts in the approved vaulted workflow rather than chat paste or unprotected tickets used by mixed municipal teams.