200-201 Question 32

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• 1

  B. The threat actor gained access to the system by known credentials.

• 2

  I think 'B' because if the threat actor know the right credential he can also delete logs file and seem to be never entered in to the system

• 1

  the question stated clearly that the suspicious activity "made unapproved changes, files are out of order, and several documents have been placed in the recycle bin." If the attacker used known credentials, then this will appear in the system logs under that credential. I am going with answer D