A security company has been contracted to perform a scoped insider-threat assessment to try to gain access to the human resources server that houses PII and salary data. The penetration testers have…

Exploiting a configuration weakness in the SQL database, which is likely the direct target for PII and salary data, is a focused and controlled action directly related to the assessment's goal of gaining access to the HR server. This action tests the security posture of the specific target system without causing widespread disruption or collateral damage, making it ethical and within the typical bounds of a scoped penetration test.

Intercepting outbound TLS traffic involves snooping on communications that may not be directly related to the HR server, potentially violating privacy or affecting a broader scope than intended.

Injecting malware into an enterprise-wide update server would have a broad and uncontrolled impact across the entire organization, potentially causing significant disruption and damage, which is unethical in a scoped assessment.

Leveraging a vulnerability on an internal Certificate Authority (CA) to issue fraudulent client certificates could undermine the entire organization's trust infrastructure and has a very wide, uncontrolled impact, making it unethical for a scoped assessment.

Establishing and maintaining persistence on a domain controller implies taking control of a critical infrastructure component with wide-ranging privileges, which typically goes beyond the scope of merely gaining access to a specific HR server in an insider-threat assessment, risking broader compromise.