In an internal security audit, the white hat hacker gains control over a user account and attempts to acquire access to another account's confidential files and information. How can he achieve this?

Port scanning discovers open ports and services on a target host but does not grant access to another account's files.

Hacking Active Directory is a specific attack category targeting directory services infrastructure, not a general method for accessing another user account's files.

Privilege escalation is the process of exploiting misconfigurations, vulnerabilities, or weak permissions to move from a lower-privileged account to access resources owned by another account or a higher-privileged role. In this scenario, the attacker already controls one user account and leverages privilege escalation to reach another account's confidential files. This is a core post-exploitation technique in penetration testing and ethical hacking.

Shoulder-surfing is a physical/social engineering technique of visually observing credentials being entered, not a method for programmatically accessing another account's data.