In Phase 5 Covering Tracks, which action is described as part of the phase?

In Phase 5 Covering Tracks, which action is described as part of the phase?

• A. Patching vulnerabilities
• B. Many do not want others to know they were there
• C. Deleting logs
• D. Escalating privileges

Answer: (A)

Covering Tracks is about hiding the attacker’s footprints after gaining access, so the actions involved aim to avoid detection and forensic tracing. Deleting logs directly reduces the evidence left behind—clearing event logs, log files, and other records that could reveal that an intrusion occurred, when it happened, and what tools were used. This makes it harder for defenders or investigators to reconstruct the breach. Patching vulnerabilities, while important for security, is about fixing weaknesses and is not a tactic used to conceal a break-in. The statement that “many do not want others to know they were there” describes an intent, not a concrete technique, and escalating privileges is about gaining higher access, not about erasing traces.

Covering Tracks is about hiding the attacker’s footprints after gaining access, so the actions involved aim to avoid detection and forensic tracing. Deleting logs directly reduces the evidence left behind—clearing event logs, log files, and other records that could reveal that an intrusion occurred, when it happened, and what tools were used. This makes it harder for defenders or investigators to reconstruct the breach.

Patching vulnerabilities, while important for security, is about fixing weaknesses and is not a tactic used to conceal a break-in. The statement that “many do not want others to know they were there” describes an intent, not a concrete technique, and escalating privileges is about gaining higher access, not about erasing traces.