A county IR team finds that a clerk PC was compromised through a browser vulnerability, after which a remote-access tool ran. How should they separate those two concepts?
Select an answer to reveal the explanation.
Short Explanation
Think of picking a lock versus walking through the door with a toolkit. The exploit is the lock-pick that got code running; the RAT is the toolkit that showed up after. County IR keeps those labels apart so reports stay clear.
Full Explanation
Exploits abuse a vulnerability to achieve code execution or elevated control; payloads are the tooling or code that runs after that foothold is obtained. When a county IR team finds a clerk PC compromised through a browser vulnerability and later observes a remote-access tool running, those are two linked but distinct concepts: the browser flaw enabled exploitation and initial execution, while the remote-access tool is the subsequent payload that provides interactive control. Separating exploit from payload keeps the incident narrative accurate for municipal reporting, evidence timelines, and remediation—patching the browser vulnerability addresses the entry method, while removing the RAT and related persistence addresses the follow-on tooling.
Claiming the remote-access tool was the exploit and the browser flaw was only cosmetic fails because the vulnerability is what enabled execution; the RAT is not the exploit itself. Treating both steps as persistence mechanisms collapses the kill chain incorrectly: persistence is how malware survives reboot or logoff, not the initial exploit or the payload identity. Calling the browser vulnerability anti-analysis and the tool a propagation vector misapplies Domain 6 categories; anti-analysis frustrates labs, and propagation moves malware between hosts—neither matches the exploit-then-RAT sequence described.
Exam caveat: questions often tempt you to mash stages together. GOAA expects precise vocabulary—exploit versus payload versus persistence versus propagation—even when all appear in one civic incident.
Operational check for county IR: timeline the browser crash/exploit indicators separately from RAT process creation, collect browser and endpoint telemetry, remediate the vulnerable browser/component, eradicate the remote-access tool and any stay-behind mechanisms, and verify the clerk PC cannot re-establish remote control before returning it to service.