A county blue team requests an IOC-style list of all pivot ports and protocols used during the engagement. What should already be true of the tester's working notes?
Select an answer to reveal the explanation.
Short Explanation
If you opened doors for yourself, write down which doors. Pivot ports and protocols are breadcrumbs the blue team needs to tell your traffic from a real break-in. Good notes make cleanup and correlation painless.
Full Explanation
If a county blue team requests an IOC-style list of pivot ports and protocols used, the tester’s working notes should already accurately record pivot listeners, ports, protocols, and related hosts so defenders can correlate and clean up. Intentionally omitting ports so outside attackers cannot learn the technique class misunderstands authorized collaboration with the defending SOC. Relying only on final report screenshots while skipping live pivot tracking loses time-synced detail defenders need during the engagement. Refusing blue-team IOC requests because sharing ports would void the letter of engagement invents a legal fear that contradicts normal municipal liaison practice when RoE expects cooperation. Exam caveat: transparency with the client’s defenders is part of professional internal testing. Operational check: maintain a running channel ledger, deliver the IOC extract on request, and verify teardown matches the listed listeners. In municipal operations, record the rationale in the engagement notes so future testers and city defenders understand which approach was chosen and which failure modes the rejected options would create for civic services. Re-validate the same judgment after the next change window so the control still holds under the city’s current tooling, identity posture, and RoE amendments.