The audit department at a company requires proof of exploitation when conducting internal network penetration tests. Which of the following provides the MOST conclusive proof of compromise without…

Question

Options

• AProvide a list of grabbed service banners.
• BModify a file on the system and include the path in the test's report.
• CTake a packet capture of the test activity.
• DAdd a new test user account on the system.

• A
  4% (1)
• B
  14% (4)
• C
  75% (21)
• D
  7% (2)

Explanation

A packet capture records the full network conversation between the tester and the target system, including the exploit payload sent and the system's response-which may include command output, shell banners, file contents, or other proof that code execution or unauthorized access was achieved. Critically, capturing network traffic is entirely passive with respect to the target system; it does not modify any files, create accounts, or alter system state, preserving forensic integrity. Providing grabbed service banners (A) only proves that a connection was made, not that exploitation succeeded. Modifying a file on the system (B) is direct evidence of access but constitutes an intentional change to system integrity, which the question explicitly forbids. Adding a new test user account (D) similarly modifies system state (the SAM database, AD, or /etc/passwd), which also compromises integrity. The packet capture is therefore the gold standard: it is conclusive, reproducible, and non-destructive.

No community discussion yet for this question.