After malware executes on a city clerk workstation, the host opens a periodic encrypted session to an attacker-controlled VPS and waits for instructions. Which term describes that ongoing remote channel?

After malware executes on a city clerk workstation, the host opens a periodic encrypted session to an attacker-controlled VPS and waits for instructions. The correct term for that ongoing remote channel is command-and-control (C2). Civic framing matters because clerk endpoints hold municipal identity and records access; a live beacon means the adversary can still task the host, so the SOC treats presence as active rather than as a finished theft.

Calling the activity exfiltration of the entire tax-roll database in one burst fails by concept: exfiltration is data leaving in a transfer, whereas periodic keep-alive and tasking describe a control channel, not a completed dump. Labeling it a supply-chain attack on the clerk's keyboard firmware fails by concept: supply chain alters vendor delivery of software or hardware, which is not evidenced by a post-compromise VPS beacon. Calling it zero trust continuous verification of the clerk identity fails by concept: zero trust is a defensive access model, not an attacker remote channel.

Exam caveat: SPLK-5001 objective 2.2 lists C2 as distinct because later stages—theft, ransomware, lateral movement—ride that channel; do not rename a beacon as exfil or supply chain when the telemetry is periodic encrypted tasking.

Operational check: Hunt the VPS destination in proxy, DNS, TLS, and firewall logs for periodic beacons from the clerk host, isolate or network-contain the endpoint, preserve the C2 timeline, and only then pivot to whether follow-on exfil or other stages occurred.