1. Home
2. All questions
3. Question 69

CISSP study material · question 69 of 500

An adversary edits the endpoint detection agent's configuration and deletes the log forwarding pipeline, so alerts stop reaching the security operations centre and analysts can no longer trust their consoles. In the current MITRE ATT&CK Enterprise matrix of fifteen tactics, which tactic describes this behaviour?

• Security operations
• Security assessment

1. Stealth, concealing the adversary's actions so that they pass for normal behaviour in the environment
2. Defense Impairment, disabling defensive tooling and telemetry pipelines so analysts lose visibility
3. Impact, disrupting the availability or integrity of the organisation's business systems and data
4. Persistence, holding the foothold across restarts, credential changes and routine maintenance work

Challenge yourself on this topic → Study as cards