Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)

### Why this is right Phishing can support initial compromise, weak default accounts can expose access, and scanning can support attacker reconnaissance. ### The concept Attack activity may occur at different stages and should be considered during detection and planning. ### The other options - **D. Updating a response playbook**: is a defensive improvement action, not an attacker behavior. ### Remember Separate attacker techniques from defender response work.