What is a likely admin response to deliberate backdoors during testing?

• A. They will be shut down during testing and avoid detection
• B. They will be kept intact
• C. They will be upgraded
• D. They will be renamed

Answer: (A)

In a sanctioned test, deliberate backdoors are treated as temporary, controlled footholds. The administrator’s typical response is to shut them down during testing to prevent any uncontrolled access, limit the attack surface, and keep the engagement within its defined scope. This containment ensures the environment remains safe, the test results stay reliable, and no persistent backdoor lingers after the engagement ends. Once the test is complete, the backdoors are removed or disabled so they cannot be exploited outside the authorized window.

Keeping backdoors intact would create ongoing risk beyond the test. Upgrading them would alter the test conditions and potentially bypass controls. Renaming them doesn’t address containment or risk and would just add confusion.