Exam CFR-310 topic 1 question 23 discussion

D. Persistence Explanation: The installation of remote access software and unapproved updates suggests that the malicious actor is trying to ensure continued access to the system, which is a key indicator of persistence in the attack process. Why the other answers are incorrect: A. Expanding access: Expanding access typically refers to the attacker escalating privileges or moving laterally through the network. While the attacker may have installed remote access software, this is more about maintaining control than expanding access. B. Covering tracks: This refers to actions like deleting logs or obfuscating malicious activity to avoid detection. Installing remote access software doesn't necessarily indicate covering tracks. C. Scanning: Scanning is the phase where an attacker gathers information about the system or network. The observed activity (installing software and updates) is not related to scanning.

D. Persistence The activity described, where an attacker gains access to a system, installs remote access software, and performs unauthorized actions, indicates the attacker's attempt to establish persistence on the compromised system.