What is the most valuable part of exploitation from a tester's perspective?

• A. Demonstrating vulnerabilities exist and enabling post-exploitation actions to show business impact.
• B. Maximizing quiet operation without detection.
• C. Deleting logs to cover tracks.
• D. Breaking the test environment.

Answer: (C)

The most valuable part of exploitation in a penetration test is proving that a vulnerability can be exploited and, crucially, showing the real business impact through post-exploitation actions. This framing turns technical finding into actionable risk: it demonstrates what an attacker could access or control, how long they could persist, and what business consequences (data loss, downtime, regulatory impact) might result. That evidence-based impact helps stakeholders prioritize fixes, justify resources, and guide remediation and security controls.

Bootstrapping stealth or cover-up aspects isn’t the goal of a legitimate test. While stealth might matter in adversary simulations, the primary value here is tangible risk demonstration with verifiable evidence. Deleting logs or hiding tracks is inappropriate and often illegal in a testing engagement; it removes the verifiable evidence teams rely on to learn from the test and address the gaps. Disrupting or breaking the test environment also undermines the assessment and erodes trust in the results.