PT0-002 Practice Question: A client wants a penetration test that simulates…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Continue testing with the elevated privileges because they were provided

  Why it's wrong here

  Continuing with the elevated privileges assumes that access granted by the environment implies authorization, which is a dangerous misinterpretation of the rules of engagement. A client requesting a disgruntled insider simulation typically expects testing from a standard, lower-privileged user context, not from an unintended local admin account. Proceeding without confirming the client's intent could invalidate the entire test, since the actual attack path an insider would use is bypassed, and it may expose the tester to legal or contractual liability for exceeding the explicit scope.

• ✗

  Use the privileges to escalate to domain admin and test further

  Why it's wrong here

  Actively using the unexpected privilege to escalate to domain admin is a clear expansion of the test's scope and goes far beyond the client's stated objective of simulating a disgruntled insider. This action would involve attacking the domain controller or Active Directory infrastructure without authorization, potentially causing lateral movement, data exposure, or service disruption that the client never approved. Unlike merely continuing with the provided privileges, this option requires the tester to intentionally perform additional exploitation steps, which compounds the scope violation and is more likely to trigger business-critical consequences or legal action.

• ✓

  Pause testing and inform the client of the unexpected privilege level for guidance

  Why this is correct

  Pausing testing and informing the client is the only correct action because the tester must never assume that an unexpected privilege level is intended by the client. The rules of engagement define the exact boundaries of the test, and any deviation—whether the privilege is a misconfiguration, a leftover from a previous admin, or a deliberate invitation—must be clarified in writing before proceeding. This communication allows the client to either amend the scope to authorize the elevated access or provide a new low-privileged account, ensuring that the test remains legally valid and that findings are relevant to the original threat model.

• ✗

  Revert to a lower-privileged account provided by the client

  Why it's wrong here

  Reverting to a lower-privileged account may seem cautious, but it is not a substitute for client communication because the tester does not have the authority to unilaterally redefine the engagement. If the client provided only one account, reverting may be impossible without disrupting the test, and silently changing course could leave the discovered privilege issue unreported, which would be a disservice to the client’s security posture. The proper approach is to notify the client of the observed condition and let them decide whether to accept, remediate, or ignore it, rather than making that decision behind their back.

Go deeper

Related to this question