Post-exploitation phase tasks.

• A. Initial port scanning.
• B. Credential stuffing.
• C. OS installation.
• D. Privilege escalation, data collection, pivoting, and maintaining access.

Answer: (D)

Post-exploitation focuses on what you do after you have gained access to a system. At this stage, the goal is to expand control, gather valuable information, and establish ongoing presence so you can move deeper into the network. Privilege escalation is essential because higher privileges unlock access to restricted resources and sensitive data. Data collection or exfiltration is the core objective of many engagements—obtaining useful information from the compromised host. Pivoting (lateral movement) lets you reach other machines and extend your foothold within the environment. Maintaining access (persistence) ensures you can return to the system even if the initial foothold is detected or disrupted. Together, these tasks define the post-exploitation phase and align with how a tester would continue operations after breaking in.

In contrast, starting with port scanning happens earlier in the engagement to discover targets and entry points, not after access is established. Credential stuffing is an initial access technique that tries large numbers of credentials to break in, rather than a post-exploitation activity. OS installation is not a typical objective or action within post-exploitation; it’s not related to the usual goals of expanding access or collecting data once inside.