The audit department at a company requires proof of exploitation when conducting internal network penetration tests. Which of the following provides the MOST conclusive proof of compromise without…

Service banners only confirm that a service is reachable and reveal version information; they do not prove that the tester successfully exploited a vulnerability and gained unauthorized access.

Modifying a file constitutes a change to the system's integrity and could interfere with production data, violating the requirement to avoid further compromise.

A packet capture of the test activity records the actual network traffic exchanged during exploitation, including payloads, session establishment, and data transfer, providing irrefutable forensic evidence of compromise. Unlike file modifications or new accounts, a packet capture is a read-only artifact that does not change the system's integrity. It can be reviewed by auditors to confirm both the method and the success of the exploit.

Adding a test user account alters the system's security posture and could be exploited by other parties if not removed promptly, making it a higher-risk method of proving compromise.