Which term describes how long the attacker remains undetected in the target network?

Which term describes how long the attacker remains undetected in the target network?

• A. Timeliness
• B. Numbers Involved in the Attack
• C. Risk Tolerance
• D. Attack Origination Points

Answer: (C)

The idea being tested is dwell time—the length of time an attacker can stay inside a target network before being detected. Dwell time measures how long the attacker operates undetected, from initial foothold to discovery. It matters because the longer they remain, the more opportunity they have to move laterally, escalate privileges, and exfiltrate data, increasing the potential impact of the breach. Risk tolerance describes how much risk an organization is willing to accept, not how long an attacker remains in the network, so it doesn’t describe the undetected period. The practical takeaway is to minimize dwell time by strengthening detection, logging, and incident response so you notice and contain intrusions quickly. Continuous monitoring, endpoint detection and response, regular threat hunting, and rapid containment are all ways to shorten this window.

The idea being tested is dwell time—the length of time an attacker can stay inside a target network before being detected. Dwell time measures how long the attacker operates undetected, from initial foothold to discovery. It matters because the longer they remain, the more opportunity they have to move laterally, escalate privileges, and exfiltrate data, increasing the potential impact of the breach. Risk tolerance describes how much risk an organization is willing to accept, not how long an attacker remains in the network, so it doesn’t describe the undetected period. The practical takeaway is to minimize dwell time by strengthening detection, logging, and incident response so you notice and contain intrusions quickly. Continuous monitoring, endpoint detection and response, regular threat hunting, and rapid containment are all ways to shorten this window.