A water utility marks a SCADA Windows host as forbidden for any privilege-escalation testing. What is the correct professional response?
Select an answer to reveal the explanation.
Short Explanation
If the client puts a red rope around a fragile plant system, you do not hop the rope. You write down what you could not test and what risk remains so nobody pretends it was proven safe.
Full Explanation
Rules of engagement and explicit exclusions take precedence over technical curiosity, especially on fragile operational technology hosts. Testers must not attempt local privilege escalation where forbidden. The report should clearly state the exclusion, the testing not performed, and residual risk so stakeholders do not over-interpret coverage. Alternative discovery within allowed scope can still inform overall posture without violating constraints.