6.6.4 Unanswered changed-condition cases
§6 — Chapter 6 | 6.6 Study aids
These are unanswered paper exercises. Attempt a case before opening its explanations. Do not execute commands or infer practical competence from this page.
For each case write: observed facts; unsupported claim; missing prerequisite; one exact numbered next check and its expected decisive evidence; how the changed condition changes the decision.
6.6.4.1 Case 01 — Membership
The account query shows Domain Users and Support. A teammate calls the account a local administrator on APP01. No host-right evidence is provided. Then Support membership is removed while the existing shell remains open.
What is established? What is still inconclusive or ruled out? Which numbered subsection would you use next, and why?
6.6.4.2 Case 02 — Share boundary
SMB authentication and directory listing succeed. Reading config.ini is denied. A different script can be read and names FS01. Then a new credential is recovered from a different authorized artifact.
What is established? What is still inconclusive or ruled out? Which numbered subsection would you use next, and why?
6.6.4.3 Case 03 — Service identity
A user account owns an MSSQLSvc SPN. No useful rights are known, and offline candidate testing is exhausted. Then a verified directory permission makes that account materially more useful.
What is established? What is still inconclusive or ruled out? Which numbered subsection would you use next, and why?
6.6.4.4 Case 04 — ACE applicability
A visible member-write ACE names an unresolved SID. You know the selected object is a group. Then the SID resolves to a group unrelated to every controlled identity.
What is established? What is still inconclusive or ruled out? Which numbered subsection would you use next, and why?
6.6.4.5 Case 05 — Collection scope
A DCOnly import contains group and ACL relationships but no session edges. A colleague concludes no administrators are logged on. Then a targeted host collection returns access denied.
What is established? What is still inconclusive or ruled out? Which numbered subsection would you use next, and why?
6.6.4.6 Review after your attempt
Compare the reasoning with the relevant numbered chapter. General notes are allowed; record any hint and independently retest an equivalent changed-condition case later. No answer key is embedded in these cases.