A municipal tester discovers a trust route into a partner extranet. What must happen before testing across that trust?
Select an answer to reveal the explanation.
Short Explanation
A trust route is a bridge to someone else’s neighborhood—not a coupon for free roaming. Spotting it is great; walking across without asking is not. Get scope confirmation before the partner extranet becomes a test target.
Full Explanation
When a municipal tester discovers a trust route into a partner extranet, scope covering the partner path must be confirmed before treating the trust as fair game. Beginning immediately because any route implies full authorization is incorrect. Partner extranets do not automatically inherit the city’s RoE. Exploiting first and asking about scope only if alerts fire inverts ethics and can damage third-party relationships. Exam caveat: trusts extend possible paths; they do not silently extend paperwork. Operational check: document the trust observation, pause cross-domain testing, obtain written scope confirmation for the partner domain, and only then pursue authorized path analysis. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments. Keep secret material and session artifacts in the approved vaulted workflow rather than chat paste or unprotected tickets used by mixed municipal teams.