Which term refers to the discrete technical steps that constitute an APT and differentiate it from other cyberattacks?

Which term refers to the discrete technical steps that constitute an APT and differentiate it from other cyberattacks?

• A. Actions
• B. Attack Origination Points
• C. Knowledge Source
• D. Resources

Answer: (A)

APTs are defined by a sequence of actions—the discrete steps the attacker takes at each phase of the campaign. Those actions form a coordinated, multi-stage flow that sustains the intrusion over time, enables persistence, and leads to objectives like data access or exfiltration. Because of this, the term actions best captures the procedural, step-by-step nature that sets an APT apart from more opportunistic or single-stage attacks. Attack origination points describe where the attack comes from, not how it unfolds. Knowledge source refers to where the attacker obtained information or tools, not to the sequence of operations. Resources cover what tools or infrastructure the attacker uses, not the ordered steps of the campaign.

APTs are defined by a sequence of actions—the discrete steps the attacker takes at each phase of the campaign. Those actions form a coordinated, multi-stage flow that sustains the intrusion over time, enables persistence, and leads to objectives like data access or exfiltration. Because of this, the term actions best captures the procedural, step-by-step nature that sets an APT apart from more opportunistic or single-stage attacks.

Attack origination points describe where the attack comes from, not how it unfolds. Knowledge source refers to where the attacker obtained information or tools, not to the sequence of operations. Resources cover what tools or infrastructure the attacker uses, not the ordered steps of the campaign.