A security team wants to use Metasploit to check a system. Explain the conditions needed for responsible testing and identify two limitations of the framework from the course material.

### What a good answer covers - Testing is limited to systems for which the team has explicit permission. - The team uses a test network or virtual machine when possible to contain effects. - The team reviews the module and understands that a successful test can cause damage. - The framework may omit exploits or lack the latest exploits. - The framework may lack logging or reports, and its host machine may be compromised. ### The concept Metasploit is powerful because it simplifies the process of configuring and launching exploit modules. That same capability creates risk: a poorly controlled test can affect systems or data, and unauthorized testing can violate laws. Isolation reduces exposure but does not make an unauthorized test acceptable. The framework also has operational limitations, so its output should not be treated as a complete record or a complete inventory of known weaknesses. A tester should document work through approved organizational processes and interpret results in context. ### Terms - **Scope**: The systems and activities included in an approved security test. - **Logging**: Recording events or actions so they can be reviewed later. - **Virtual machine**: A software-based computer that can be used to run an isolated test environment. ### Remember Permission, scope, and containment come before running an exploit module.