Select ALL methods or tools that the course material associates with maintaining access or investigating an environment.

### Why this is right - **A** is true: a back door is described as a way for attackers to return to a compromised system. - **B** is true: the material identifies Nmap as a possible tool for uncovering connections during internal reconnaissance. - **C** is true: rootkits may modify system files and leave back doors that support continued access. ### The concept Persistence means retaining a way to access an environment over time. A back door provides a route back in, while a rootkit can alter system files and help conceal or maintain unauthorized access. Scanning can help an attacker learn about internal connections. Patching is a defensive control intended to correct weaknesses, not a method the material identifies for an attacker to maintain access. ### The other options - **D. Patching systems to remove vulnerabilities**: This is a defensive action that reduces weaknesses, rather than an attacker technique described here. ### Terms - **Nmap**: A network scanning tool mentioned as a way to uncover connections. - **Rootkit**: Malicious software that can modify system files and support concealed access. ### Remember Back doors and rootkits support persistence; scanning supports discovery.