Which term describes attacker movement within a network after initial access?

• A. Lateral movement describes routine maintenance tasks.
• B. Lateral movement is attacker movement within a network after initial access.
• C. Lateral movement refers to data being exfiltrated across the network.
• D. Lateral movement is when an attacker escalates privileges on a single host only.

Answer: (B)

Lateral movement describes attacker movement within a network after initial access. After gaining a foothold on one system, an attacker looks to propagate to additional machines to reach more valuable data, access higher-privilege accounts, and extend control without re-entering the network from outside. This often involves using stolen credentials, exploiting trust between systems, and remote administration tools to hop from host to host, staying hidden while expanding reach.

The other descriptions don’t fit because routine maintenance tasks are legitimate admin actions, not attacker movement within a network. Data exfiltration refers to transferring stolen data out of the network, not moving laterally between systems. Privilege escalation on a single host describes increasing rights on one machine without moving to other devices.