A transit team debates dropping many binaries on a pivot host versus running tools remotely over an established tunnel. What footprint advantage can the tunnel approach offer?
Select an answer to reveal the explanation.
Short Explanation
Every binary you drop is another breadcrumb for the SOC—and for your own cleanup checklist. Running tools from your side over a tunnel can keep the pivot host less cluttered when that fits the job. Less litter on the floor, same ability to work.
Full Explanation
When a transit team debates dropping many binaries on a pivot host versus running tools remotely over an established tunnel, a footprint advantage of the tunnel approach—when appropriate—is reduced on-host artifacts compared with mass binary drops. Remote tooling does not always increase forensic residue versus dropping many files; often the opposite is true. Tunnels do not legally require every tool to be compiled on the target. Footprint matters for pivots in municipal environments where defenders and forensic readiness are stakeholders, not only for phishing assessments. Exam caveat: choose the lower-impact operational pattern that still meets objectives under RoE. Operational check: prefer remote execution over the approved tunnel when feasible, inventory any binaries that must be placed, remove them at closeout, and list artifacts for the transit blue team. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.