Which of the following should the tester be sure to remove from the system?

A penetration tester is cleaning up and covering tracks at the conclusion of a penetration test.

Which of the following should the tester be sure to remove from the system? (Choose two.)
A . Spawned shells
B. Created user accounts
C. Server logs
D. Administrator accounts
E. Reboot system
F. ARP cache

View Answer

Answer: A,B

Explanation:

Removing shells: Remove any shell programs installed when performing the pentest.

Removing tester-created credentials: Be sure to remove any user accounts created during the pentest. This includes backdoor accounts.

Removing tools: Remove any software tools that were installed on the customer’s systems that were used to aid in the exploitation of systems.