An attacker already has the city treasurer's mailbox password and now enrolls a new MFA method and creates hidden mailbox rules. Which term best describes this stage?
Select an answer to reveal the explanation.
Short Explanation
The thief already has the treasurer's keys and is changing the locks — new MFA, sneaky inbox rules. That is account takeover: control of a real civic identity, not a DDoS, not a vendor implant, not a Windows registry trick.
Full Explanation
An attacker already has the city treasurer's mailbox password and now enrolls a new MFA method and creates hidden mailbox rules. The best term for this stage is account takeover of a legitimate civic identity: the adversary operates as the real treasurer account rather than merely knocking services offline or implanting unrelated host tricks. Civic framing matters because treasurer mailboxes control municipal payments and approvals; MFA enrollment and stealth rules are classic consolidation steps after credential theft.
Calling it a DDoS against the city's identity provider fails by concept: DDoS damages availability with volume, whereas MFA enrollment and mailbox-rule creation show successful control of an account. Labeling it a supply-chain compromise of the mail gateway vendor fails by concept: supply chain alters vendor-delivered components, and the evidence is abuse of a stolen civic identity, not a gateway implant. Calling it a registry-only persistence technique on a clerk PC fails by concept: registry persistence is endpoint malware survival, not cloud-mailbox MFA and rule manipulation.
Exam caveat: SPLK-5001 identity questions treat account takeover as control of a legitimate account—do not relabel post-password MFA and rule abuse as availability attacks or host registry persistence.
Operational check: Pull MFA enrollment and mailbox-rule audit logs for the treasurer, revoke attacker-added factors and forwarding/hidden rules, force credential reset and session revocation, and disposition the case as account takeover of a civic identity.