Exam CS0-003 topic 1 question 337 discussion

The most appropriate phase for the analyst to include the detection is: **C. Tactics** In the MITRE ATT&CK framework, **Tactics** represent the overall goals or objectives of the adversary during an attack. The behavior described—attempting to achieve unauthorized access to the system—aligns with the objective of gaining access, which is part of the **Initial Access** tactic in the ATT&CK framework. Techniques and subtechniques describe specific methods adversaries use to achieve those tactical goals, while procedures refer to how specific adversaries implement those techniques.