Incident responders find that an attacker held access for nine months, maintained several backdoors, rotated command infrastructure, exfiltrated data slowly, and regained access after a partial cleanup. Which term best describes this threat?
Select an answer to reveal the explanation.
Short Explanation
Think of a squatter who's copied every key to the building and comes right back in through another door when you change one lock. Long dwell time, multiple backdoors and a quick return after cleanup -- that's an APT. The "P" for persistent is the part you need to remember here.
Full Explanation
An advanced persistent threat is a well-resourced adversary that gains access to a target and deliberately maintains it over a long period while avoiding detection. Advanced refers to the capability to develop or adapt tools and tradecraft, and persistent refers to the intent and mechanisms that keep access in place. Nine months of dwell time, several redundant backdoors, rotating infrastructure, slow exfiltration to avoid volume alerts and rapid re-entry after partial remediation are all hallmarks of this threat. A worm outbreak spreads automatically and noisily from host to host; it does not selectively exfiltrate data or re-establish targeted access after cleanup. A distributed denial-of-service campaign aims to exhaust bandwidth or service capacity, which produces visible outages rather than covert long-term access. An unskilled attacker running a one-time scanning tool lacks both the capability and the patience the scenario describes. Exam caveat: APT describes the behavior and resourcing of the adversary, often but not always state-sponsored, and is listed as a threat source in its own right. Operational check: plan coordinated eradication that removes all known backdoors at once, reset credentials broadly, block identified infrastructure, and monitor closely for re-entry attempts afterward.