An attacker has gained access and is scanning connected systems to learn what is inside the environment. Which life-cycle stage best describes this activity?

### Why this is right The attacker is already inside and is learning about connected systems, which matches internal reconnaissance. The timing and target of the information gathering distinguish it from reconnaissance before entry. ### The concept An attacker can gather information before attempting entry and again after gaining access. Internal reconnaissance focuses on the environment the attacker has entered. Scanning may help reveal connected systems, but the material treats scanning as an example rather than defining it as the whole stage. ### The other options - **A. Reconnaissance before entry**: This describes pre-entry information gathering, not exploration of connected systems after access. - **C. Complete mission**: This is the mission outcome, such as stealing or changing data, not system discovery. - **D. Initial compromise**: This is the first successful entry, which has already occurred in the scenario. ### Terms - **Scanning**: Checking systems or connections to gather information about them. - **Initial compromise**: The attacker’s first successful entry. ### Remember If the attacker is already inside and mapping the environment, think internal reconnaissance.