As pan or a penetration lest, your team is tasked with discovering vulnerabilities that could be exploited from an inside threat vector. Which of the following activities fall within that scope?

Including all four options would add activities that target external attack surfaces, which are outside the defined scope of an inside threat assessment.

Including option A alongside B and D introduces an activity representing an external attack vector that is not relevant to simulating an inside threat.

Options B and D represent activities consistent with an inside threat vector - such as internal privilege escalation, lateral movement, or abuse of internal resources - which are the actions a rogue insider or compromised internal account could take. Option A likely involves an external or perimeter-based attack technique that falls outside the defined inside threat scope, making it the excluded item.

Including only A and D omits option B, which is an activity that falls squarely within inside threat simulation scope.