A housing-authority purple team disables tamper protection on lab VMs to observe certain evasion behaviors. What lesson should the after-action emphasize?
Select an answer to reveal the explanation.
Short Explanation
If you take the lock off the lab door, of course the test sneak looks talented. Call that out in the AAR so nobody thinks production is equally wide open. Keep tamper protection on where residents' data actually lives.
Full Explanation
When a housing-authority purple team disables tamper protection on lab VMs to observe certain evasion behaviors, the after-action should emphasize that weakened lab configurations can make evasion look easier than it would against hardened production endpoints. Tamper protection is a hardening control that resists unauthorized changes to Defender settings; turning it off changes the defensive baseline and can inflate apparent attacker success. Decision-makers need that caveat so lab brilliance is not mistaken for production exposure.
Disabling tamper protection on all production housing workstations for consistency would intentionally weaken resident-facing defenses and is the wrong lesson. Lab results with tamper protection off are not always identical to production outcomes. Tamper protection is not a macOS-only setting in municipal Windows estates; treating it as irrelevant to Windows housing endpoints is incorrect.
Exam caveat: lab-vs-prod hardening differences are a common AAR theme—call out weakened controls rather than recommending production parity-by-weakening.
Operational check for housing-authority purple teams: record which protections were disabled; compare findings to production baselines with tamper protection on; never recommend production disablement for tester convenience; and keep tamper protection enabled where resident data and housing operations systems run.