An attacker gains unauthorized access to the management application of a data protection environment.

The management application in a data protection environment is the control plane through which administrators configure backup jobs, retention policies, replication targets, and recovery operations; an attacker who compromises this application gains the same operational control an authorized administrator would have. The most direct and likely consequence of this level of access is the attacker altering system configurations, such as disabling scheduled jobs, changing retention or replication settings, or redirecting backup destinations, in order to disrupt or sabotage the organization's data protection operations, potentially leaving the organization without valid, recoverable backups precisely when they are needed most. This is the realistic and commonly observed objective behind attacks that target backup and data protection management consoles specifically. Installing a firewall to monitor activities (B) describes a defensive action an organization would take, not something an attacker would do after gaining unauthorized access, making this option logically inconsistent with the premise of the question. Modifying the application's underlying source code (C) is a far more technically demanding and less common outcome than simply misusing existing administrative functionality already exposed through the compromised management interface. Moving data from backup to archive (D) is a legitimate operational action with comparatively limited disruptive value and is not the most likely or damaging outcome of this breach. Configuration modification is correct.

Reference topic: Securing the Data Protection Environment - Management Application Compromise.