Exam CFR-310 topic 1 question 32 discussion

A. Covering tracks Explanation: Covering tracks is the phase in which a hacker attempts to erase or alter evidence of their activities, such as modifying or deleting system audit logs. This is done to avoid detection after the compromise of the system. Why the other answers are incorrect: B. Expanding access: Involves the hacker escalating privileges or moving laterally across systems, not removing traces of their activities. C. Gaining persistence: Involves ensuring continued access to the compromised system, such as installing backdoors, not modifying audit logs. D. Performing reconnaissance: This is the information-gathering phase, where the attacker gathers data about the system or network, not covering up their tracks.