CertNexus Certified Cyber Secure Coder (CSC) — Question 54

If a hacker is attempting to alter or delete system audit logs, in which of the following attack phases is the hacker involved?

Answer options

• A. Covering tracks
• B. Expanding access
• C. Gaining persistence
• D. Performing reconnaissance

Correct answer: A

Explanation

The correct answer is A, as 'Covering tracks' refers to actions taken to hide evidence of an attack, such as altering logs. Options B, C, and D are not relevant in this context; they focus on gaining further access, maintaining presence, and gathering information, respectively.