Customization and Forensics

Building a custom ISO with live-build, adding your own tooling and persistence scripts, using forensics mode where nothing automounts, and hardening the attacker machine itself. Interviewers ask because a compromised or evidence-contaminating tester box is a real engagement risk.