A penetration tester ran the following commands on a Windows server: Which of the following should the tester do AFTER delivering the final report?

The correct answer is D. Remove the tester-created credentials. Post-engagement cleanup is a critical responsibility of a penetration tester. After delivering the final report, all artifacts created during the test must be removed to return the target environment to its original state. Tester-created credentials are a significant security…

Engagement management

Question

A penetration tester ran the following commands on a Windows server:

Which of the following should the tester do AFTER delivering the final report?

Exhibit

Options

ADelete the scheduled batch job.
BClose the reverse shell connection.
CDowngrade the svsaccount permissions.
DRemove the tester-created credentials.

How the community answered

(30 responses)

A
17% (5)
B
3% (1)
C
7% (2)
D
73% (22)

Explanation

Post-engagement cleanup is a critical responsibility of a penetration tester. After delivering the final report, all artifacts created during the test must be removed to return the target environment to its original state. Tester-created credentials are a significant security risk if left behind - they could be discovered and exploited by malicious actors. Removing these credentials (D) is the highest-priority cleanup action. While closing reverse shells (B), deleting batch jobs (A), and downgrading permissions (C) are also cleanup tasks, the scenario's commands suggest credential creation was performed, making credential removal the most critical remediation item to address after report delivery.

Topics

#Post-engagement activities#Cleanup#Ethical hacking#Artifact removal

Community Discussion

No community discussion yet for this question.

Full PT0-002 Practice