During an authorized engagement at IronClad Financial Services in Charlotte, the red team successfully exploits...

The correct answer is C. Maintaining Access.

The red team has already gained administrative access. Installing a backdoor to preserve continued access after the initial vulnerability is remediated represents the Maintaining Access phase.

CEH methodology identifies five hacking phases: Reconnaissance, Scanning, Gaining Access, Maintaining Access, and Clearing Tracks. It explains that Maintaining Access is the phase where an attacker tries to maintain ownership and control over compromised systems, commonly using backdoors, rootkits, or Trojans to retain access . Another EC-Council-aligned reference states that Maintaining Access refers to retaining ownership of the system and securing continued access with backdoors, rootkits, Trojans, or Trojan horse backdoors .

Option A. Reconnaissance is incorrect because reconnaissance occurs before exploitation and focuses on information gathering.

Option B. Vulnerability Scanning is incorrect because scanning identifies weaknesses but does not involve installing persistence.

Option D. Clearing Tracks is incorrect because clearing tracks involves hiding evidence, altering logs, or avoiding detection.

Option C. Maintaining Access is correct because the backdoor is installed to preserve long-term access.

Therefore, the best answer is C. Maintaining Access.