Which of the following steps in the attack process does this activity indicate?

While performing routing maintenance on a Windows Server, a technician notices several unapproved Windows Updates and that remote access software has been installed. The technician suspects that a malicious actor has gained access to the system.

Which of the following steps in the attack process does this activity indicate?
A . Expanding access
B . Covering tracks
C . Scanning
D . Persistence

View Answer

Answer: A