Free PenTest+ PT0-003 Practice Test

B. Get written authorization from the hosting provider, then amend the scope document to match.

A client can only authorize systems it actually controls. A host living in a third party's address space needs that provider's written sign-off first, and the scope document gets amended so the paperwork matches what you tested. Port scanning is not a legal exemption either — it is active traffic aimed at someone else's asset.

C. Kerberoasting

Kerberoasting is the fit: any authenticated domain user can request a service ticket for an account with an SPN, and that ticket is encrypted with the service account's password hash, so cracking happens offline where no lockout policy applies. AS-REP roasting targets accounts with Kerberos pre-authentication disabled and needs no credentials at all. Pass-the-hash replays a hash you already stole, and a golden ticket needs the krbtgt hash — at which point you already own the domain.

D. Trigger the escalation path in the rules of engagement and notify the client's named contact now.

Evidence of a prior compromise triggers the escalation process defined in your rules of engagement — you notify the contact the RoE designates and hand it to the client's incident responders, alongside critical findings and anything that raises a safety or legal concern. Eviction and patching are their call, not the tester's, and riding the attacker's shell would trample the evidence that IR team needs.