A civic app tier is compromised; the database tier is segmented. What should the tester assume about DB access?
Select an answer to reveal the explanation.
Short Explanation
Owning the café counter does not mean you already have keys to the locked vault in the back—there might be a real door and a real policy in between. Segmentation can block paths even after an app foothold. Check reachability and scope before assuming the database is yours to poke.
Full Explanation
Network segmentation may prevent direct movement from an application tier to a database tier despite related business functions. Testers must verify reachability and authorization before treating the DB as in play. Assuming automatic access or copying production data offsite bypasses both technical and engagement controls. Segmentation awareness is central to lateral-movement judgment.