Exam PT0-002 topic 1 question 230 discussion

According to the CompTIA PenTest+ Study Guide, "Post‐exploitation activities also include cleanup, concealment, and retaining access for longer‐term penetration testing activities. You should make sure you know how to hide the evidence of your actions by cleaning up log files, removing the files created by your tools, and ensuring that other artifacts are not easily discoverable by defenders."

C. Log out and migrate to a new session. Never delete Client logs.

Ok this is hard question. Normally you cleanup, clear logs. However if this is a real pentest for a client you should never remove logs unless told so...

you should never delete or modify logs

You should never modify or delete logs of a client as they need these to be able to remediate and identify methodologies. You should migrate to a new session to avoid detection and continue with the penetration testing

This step helps in covering the tracks of the tester and makes it more difficult for defenders to understand exactly what was done during the penetration test. This is a typical step in the post-exploitation phase of a penetration test, especially when the goal is to simulate the behavior of an actual attacker and assess the organization's ability to detect and respond to the breach. The other options do not follow the logical progression of a penetration test after the described actions have already been taken.

The next step for the penetration tester after conducting data exfiltration should be to log out and migrate to a new session. This will help to cover their tracks and minimize the chances of being detected. Changing or deleting the logs may also be a good idea to avoid being discovered, but it should not be the next step since the penetration tester may need to access the system later on for additional attacks or data exfiltration. Determining what data is available on the web server and logging in as the new user are also not appropriate next steps since the penetration tester has already accomplished their goals by successfully infiltrating the server and exfiltrating data.

Logging out and migrating to a new session would be the best option for the penetration tester’s next step in this scenario because it would allow them to maintain access to the system while avoiding detection.

you should never modify of delete the logs on any machine.

answer B

B is the answer

B - Delete the log files or change the log files using time stomp. This will not show that the data has been modified.

D is my answer.