An attacker has entered one machine and investigates connections to that machine and other internal systems. Which stage is being described?

### Why this is right Internal reconnaissance is the investigation of connections to the initially compromised or currently controlled machine. The attacker is already inside and is learning about the internal environment. ### The concept The word “internal” distinguishes this stage from reconnaissance against the target before entry. Internal investigation may reveal systems or connections that could support later movement. The course material gives scanning with Nmap as one possible way to uncover connections, depending on the attacker's view of detection risk. ### The other options - **A. Reconnaissance**: This is the earlier gathering of information about the target before compromise. - **C. Initial compromise**: This is the act of gaining entry, not exploring connections afterward. - **D. Complete the mission**: This is the final stage, when the attacker acts on the objective. ### Terms - **Nmap**: A network scanning tool named in the material as one way to investigate connections. - **Compromised machine**: A system that an unauthorized actor has gained control of or access to. ### Remember If the attacker is already inside and mapping connections, think internal reconnaissance.