Exam CAS-005 topic 1 question 54 discussion

✅ B. Persistence 🔍 Explanation: The MITRE ATT&CK for ICS (Industrial Control Systems) framework includes tactics and techniques tailored to ICS environments. In this scenario: The firmware of controllers was modified with a non-official version (evidenced by the checksum mismatch). This suggests an attacker modified the firmware to maintain long-term access or influence over the system. This behavior aligns with the Persistence tactic — which involves techniques that allow the adversary to maintain their foothold in the ICS environment even after reboots or disconnections. ❌ Why the other options are incorrect: A. Evasion: Involves avoiding detection. While custom firmware might help evade detection, the main purpose here is continued access, not stealth. C. Collection: Involves gathering information, such as process data or credentials — not modifying firmware. D. Lateral Movement: Involves moving between systems to expand access — this scenario is more about establishing a foothold, not expanding access.