My first guess would be being able to log into a machine through whatever method and gaining access, easily readable "secret" files, etc etc...all the while someone's looking at the syslogs which are sent to another machine (tripwire, syslog, mail logs, etc). If it seems too easy, that could be a big sign but since I don't jump on machines to break them, I wouldn't really know. Wargame servers are different as the rules are set and it's open season.
How do I realise the computer I'm on is in fact a big set up. Is there any way to know this before hand?