A city authorized assessment team plans work against the permitting VLAN under an approved ROE. Which activity should come before any exploitation discussion?
Select an answer to reveal the explanation.
Short Explanation
You don’t remodel a building before you walk the floor plan—enumerate first under the ROE. Permitting VLAN work starts with hosts, ports, and services, not smash-first bravado. City teams that skip the map invent risk.
Full Explanation
Authorized municipal assessments place network enumeration ahead of exploitation discussion so teams understand in-scope hosts, ports, and services under an approved rules of engagement. A city authorized assessment team planning work against the permitting VLAN should therefore perform network enumeration to map assets within scope before any exploitation discussion. That discipline protects civic operations, keeps evidence grounded, and prevents smash-first behavior that invents risk on permitting systems serving the public.
Immediate exploitation of every discovered CVE without mapping fails methodology and ROE hygiene; you cannot responsibly discuss exploitation without knowing what is in scope and reachable. Uploading live OT controller firmware to a public LLM for bypass ideas fails OPSEC and safety—public models are not a place for sensitive civic/OT artifacts. Skipping scans because AI can invent the network diagram from memory fails because invented diagrams are not evidence and can drive out-of-scope or false assumptions.
Exam caveat: Domain 7 emphasizes enumeration methodology as a disciplined precursor. The learning goal is authorized process recognition, not exploit recipes.
Operational check for the city team: confirm ROE and scope in writing, enumerate only the permitting VLAN ranges authorized, document hosts/ports/services with tool evidence, brief findings to humans before any exploit discussion, and refuse steps that export OT firmware or other sensitive civic data to public AI services.