An attacker finds the target data and transfers it in small, irregular increments to avoid raising alarm. Which life-cycle stage does this illustrate?

### Why this is right The course material places the removal, alteration, destruction, or theft of targeted data in the mission-completion stage. Moving stolen data in small, irregular increments is an example of carrying out the objective while trying not to attract attention. ### The concept Earlier stages prepare access and position the attacker to reach the target. Mission completion is the point at which the attacker acts on what they sought. The objective can involve more than theft: the material also includes changing or destroying data. The small increments in the scenario describe a way of moving stolen data, not a separate life-cycle stage. ### The other options - **A. Reconnaissance**: This is information gathering before entry, not the taking of target data. - **B. Escalating privileges**: This is seeking greater permissions to expand what the attacker can do. - **D. Initial compromise**: This is gaining first access, which occurs before the attacker reaches and steals the target data. ### Terms - **Data exfiltration**: Unauthorized movement of data out of an environment. - **Mission completion**: The stage in which the attacker acts on the intended objective. ### Remember Once the attacker acts on the target data, the lifecycle has reached mission completion.