Explain why attackers may use a back door during an extended intrusion, and describe how it relates to a foothold and later movement.

### Why this is right The course material describes a back door as a way for attackers to come and go after establishing a foothold. This matters when an intrusion continues over an extended period and the attacker wants to resume activity later. ### The concept A foothold is an initial position inside an environment that supports continued access. A back door helps preserve or regain that access. It does not itself mean the attacker has completed the mission or gained every needed privilege. From the foothold, the attacker may investigate connections, seek greater permissions, move to other systems, and eventually act on the objective. The material also describes rootkits as a means of modifying system files and leaving back doors. ### What a good answer covers - Defines a back door as a way to return to a system. - Explains how it supports continued access over time. - Connects the foothold to later investigation and movement. - Distinguishes persistence from mission completion. ### Terms - **Persistence**: Maintaining a way to retain or regain access over time. - **Rootkit**: Malicious software that can modify system files and support concealed access. ### Remember A back door keeps a route open; it is not the attacker's final objective.