Follow these guidelines to make your scenario engaging and meaningful:
The scenario should be plausible. Focus on typical events rather than relatively rare occurrences or unrealistic characters.
Your IT administrator tasks the members of your department with performing the yearly ethical hacking audit for the company. During last year’s exercise, one of the IT engineers went outside the scope of the ethical hacking contract and accessed HR files. This was deemed a deliberate violation of the plan, and the employee was fired. However, the vulnerability to access the records was included in the ethical hacking audit report. Knowing that this vulnerability existed last year, how would you proceed in this year’s audit?