After trying multiple exploits, you've gained root access to a Centos 6 server. To ensure you maintain access, what would you do first?

Creating a new privileged user account establishes access that survives reboots, persists after the original vulnerability is patched, and does not disrupt running services that would alert administrators. It is the preferred initial persistence mechanism because it blends into normal system activity and requires no additional tooling, giving the attacker a reliable re-entry point throughout the engagement.

Disabling key services causes visible system disruption that is likely to trigger alerts and incident response, directly threatening the attacker's continued access.

Disabling IPTables removes firewall rules but does not itself create a persistent access mechanism and may be noticed by monitoring systems or administrators.

Installing Netcat creates a temporary reverse shell channel but requires re-launching each session and leaves forensic artifacts on disk, making it less reliable and stealthier than a persistent user account.