A water utility marks a SCADA Windows host as forbidden for any privilege-escalation testing. What is the correct professional response?
Select an answer to reveal the explanation.
Short Explanation
If the client puts a red rope around a fragile plant system, you do not hop the rope. You write down what you could not test and what risk remains so nobody pretends it was proven safe.
Full Explanation
When a water utility marks a SCADA Windows host as forbidden for privilege-escalation testing, the professional response is to honor the exclusion, document that local elevation was not tested, and note residual risk for operators. Safety-critical systems require strict scope discipline.
Ignoring the exclusion because SCADA hosts are 'usually fake' is unethical and dangerous. Replacing SCADA testing with unsolicited denial-of-service to prove criticality violates RoE and can harm physical processes. Skipping priv-esc only when no ports are open invents a rule that still breaks explicit exclusions.
Exam caveat: exclusions should appear in limitations; do not silently imply the host was fully assessed.
Operational check: confirm the SCADA asset in the out-of-scope list, refrain from elevation testing, and write a clear residual-risk statement for the utility's authorizing officials. In municipal operations, record the rationale in the engagement notes so future assessors know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same finding class still applies under the estate's current patch and configuration baseline.