A court network authorized test must keep evidence-locker subnets out of vulnerability scanners. What practice meets that requirement?
Select an answer to reveal the explanation.
Short Explanation
Some court networks are sacred—evidence lockers stay off the scan list when ROE says so. Write the exclusions into the tool and the paperwork. Quietly ignoring exclusions or letting AI widen scope is how you get a legal meltdown.
Full Explanation
Court networks often include evidence-locker or similarly sensitive subnets that authorized tests must not disturb. Applying explicit scope exclusions for evidence-locker subnets in both the scanning configuration and the ROE meets the requirement: tooling enforces the boundary, paperwork authorizes it, and reports can explain intentional coverage gaps without implying the locker was assessed. Municipal judicial IT depends on that dual control—config plus ROE—not tribal knowledge.
Scanning every subnet including evidence lockers to maximize coverage metrics violates the stated constraint and can disrupt evidentiary integrity or chain-of-custody systems. Letting an AI agent expand scope automatically whenever it sees interesting hostnames is uncontrolled scope creep and is incompatible with court authorization practice. Hiding exclusion rules from the report so stakeholders cannot challenge coverage gaps undermines transparency and can mislead judges, CISOs, or auditors about residual risk.
Exam caveat: scope exclusions are not cheating; they are authorized risk acceptance. Candidates should expect questions that punish both overscanning sacred subnets and concealing exclusions from stakeholders.
Operational check: encode exclusions in scanner target lists and blackout ranges, mirror them in ROE appendices, verify with a dry-run that locker subnets receive no probes, and publish an explicit exclusions section in the final court assessment report.