CCFR-201 practice

Q1 Single choice

Within the MITRE-Based Falcon Detections Framework, what is the correct way to interpret Keep Access > Persistence > Create Account?

A
An adversary is trying to keep access through persistence by creating an account
B
An adversary is trying to keep access through persistence using browser extensions
C
An adversary is trying to keep access through persistence using external remote services
D
adversary is trying to keep access through persistence using application skimming