Exam 200-201 topic 1 question 35 discussion

B. The threat actor gained access to the system by known credentials.

I think 'B' because if the threat actor know the right credential he can also delete logs file and seem to be never entered in to the system

the question stated clearly that the suspicious activity "made unapproved changes, files are out of order, and several documents have been placed in the recycle bin." If the attacker used known credentials, then this will appear in the system logs under that credential. I am going with answer D

If the attacker used valid credentials to access the employee's system, it would explain why there were no failed login attempts in the logs, and why there were no alerts from antivirus. In this scenario, the attacker would not need to use a dictionary-based password attack to obtain credentials or exploit an unknown vulnerability in the operating system. The fact that the security specialist found nothing suspicious in the system logs could also suggest that the attacker used legitimate credentials to access the system, making it difficult to detect the attack through traditional security monitoring methods.

B is the correct answer for me. Certification exams are always tricky. Cisco wants you to overthink. So, I always go for the simplest but sensible answer during an exam.

I guess CIsco believes B to be the right answer

D IS CORRECT ZERO DAY ATTACK

The simplest is almost always the right answer. Think of the real world. An user complaining this: two options: a cat on the keyboard (I know because I have one) or another person/bot with user credentials.

A lot of these questions are horrible and could go either way in my opinion. I really hate the way these certs word questions and answers

I think answer is D - zero day exploit