This phase involves maintaining access to the target system, including evading endpoint security devices and establishing ongoing access until data use ends.

This phase involves maintaining access to the target system, including evading endpoint security devices and establishing ongoing access until data use ends.

• A. Initial Access
• B. Lateral Movement
• C. Data Destruction
• D. Persistence

Answer: (D)

Persistence is the concept being tested. It focuses on how an attacker keeps a foothold in the target over time, even in the face of defenses, by establishing long‑term access that can survive reboots and evasion attempts. This includes setting up backdoors or mechanisms that remain active and hidden, such as new user accounts, hidden services, scheduled tasks, or startup entries, so the attacker can return and continue operations until the data use ends. Initial Access is about how the attacker first gains entry, Lateral Movement is about moving through the network after gaining a foothold, and Data Destruction is about harming or removing data rather than maintaining access.

Persistence is the concept being tested. It focuses on how an attacker keeps a foothold in the target over time, even in the face of defenses, by establishing long‑term access that can survive reboots and evasion attempts. This includes setting up backdoors or mechanisms that remain active and hidden, such as new user accounts, hidden services, scheduled tasks, or startup entries, so the attacker can return and continue operations until the data use ends. Initial Access is about how the attacker first gains entry, Lateral Movement is about moving through the network after gaining a foothold, and Data Destruction is about harming or removing data rather than maintaining access.