After completing a penetration test, a tester is in the cleanup phase and wants to remove all artifacts left on compromised systems. Which artifact type is MOST critical to remove to reduce evidence of the engagement?

Question

Accepted Answer

B. Web shells, backdoors, and persistence mechanisms installed during the test. Web shells, backdoors, and persistence mechanisms installed during testing are the most critical artifacts to remove during cleanup. If left in place, they create ongoing security vulnerabilities that could be exploited by real attackers after the engagement ends. Log files from legitimate services should be preserved, and the tester should not modify firewall rules unless explicitly agreed.

After completing a penetration test, a tester is in the cleanup phase and wants to remove all artifacts left on compromised systems. Which artifact type is MOST critical to remove to reduce evidence of the engagement?

Related Questions

Discussion