The most professional and effective approach is to educate the stakeholder on the risk. A WAF is a mitigation, not a remediation for the root cause (flawed code). Providing a controlled demonstration makes the risk tangible and actionable, fostering collaboration rather than conflict, which aligns with the communication and reporting objectives of the PT0-003 exam.

The `query user` command is a native Windows utility that displays information about user sessions on a Remote Desktop Session Host server, including locally logged-on users. This is a common post-exploitation enumeration technique to understand the environment and identify potential targets for lateral movement. `netstat` shows network connections, `whoami` shows privileges for the current user, and `systeminfo` shows general system configuration.

A core competency for the PT0-003 is effective communication. Executive stakeholders need to understand the business impact, not the technical minutiae. The report must bridge the gap between technical findings (like a specific vulnerability) and business risk (like potential data breach, financial loss, or reputational damage), with clear, actionable recommendations prioritized by risk.

In a black-box test with limited knowledge, careful manual reconnaissance is key. Automated, noisy scans or exploit attempts should be avoided early on. Manually exploring the web application helps understand its functionality, discover hidden directories, identify technologies in use (like forms, APIs, frameworks), and plan a more targeted, stealthy attack approach later, which is a fundamental aspect of the planning and scoping phase.

While SSH (port 22) is common on many servers for administration, the presence of nginx (a popular web server/reverse proxy) on the standard HTTPS port (443) strongly suggests the system’s primary function is to serve web content. Penetration testers use this kind of service fingerprinting to hypothesize about a system’s purpose and tailor their subsequent attacks (e.g., focusing on web application testing rather than brute-forcing SMB shares).

While `netstat -tulpn` is excellent for enumerating network connections, filtering specifically for port 443 (HTTPS) is too narrow for the task of finding local Host-based Intrusion Detection System (HIDS) agents. Commands checking running processes (`ps`), searching for known HIDS file names (`find`), and listing all running services (`systemctl`) are direct and broad methods to identify security software like SELinux, auditd, OSSEC, or AIDE.

Proper scoping and authorization are critical, legally and ethically. Adding a new, significant target type (serverless functions) requires a formal change to the agreement. The updated SOW must detail what will be tested, how, from where (e.g., are the functions triggered from the internet or only internally?), and get formal sign-off. This ensures the tester is protected and the client understands exactly what they are authorizing.

A series of TCP SYN packets to many different ports on one host, without completing the three-way handshake (no SYN-ACK), is a classic signature of a TCP SYN scan (or a half-open scan). This is a common reconnaissance technique used to identify open ports on a target while being somewhat stealthier than a full connect scan, as it doesn’t establish a full connection. Recognizing scan patterns in network data is a key analysis skill.

The format shown is the standard output from tools like `secretsdump.py` (Impacket) or `pwdump` when extracting hashes from the local Windows SAM database. The SAM hive stores local user account information, including the LAN Manager (LM) and NT LAN Manager (NTLM) password hashes. Dumping these hashes for offline cracking is a common post-exploitation technique on Windows systems.

The most professional and effective approach is to educate the stakeholder on the risk. A WAF is a mitigation, not a remediation for the root cause (flawed code). Providing a controlled demonstration makes the risk tangible and actionable, fostering collaboration rather than conflict, which aligns with the communication and reporting objectives of the PT0-003 exam.0