The course material describes the attack life cycle as always being a quick, single-session event.

### Why this is right The material warns that attacks are often not quick hits. It describes intrusions lasting for months, with attackers returning through back doors to continue their activity. ### The concept A multi-stage intrusion can involve periods of preparation, access, discovery, and later activity. Maintaining a back door allows an attacker to return rather than repeat the original compromise. The material notes that some statistics report a lag of seven months or more before detection, but that is presented as a reported statistic, not a universal duration. ### The other options - **True**: This would describe a rapid, single-session attack, which conflicts with the course material's warning about extended intrusions. ### Terms - **Back door**: A concealed or unauthorized route that lets an attacker regain access. - **Detection lag**: The time between an intrusion and its discovery. ### Remember Treat the life cycle as potentially prolonged, not necessarily a one-time event.