John is a malicious attacker. He illegally accesses the server of We-are-secure Inc. He then places a backdoor in the We-are-secure server and alters its log files. Which of the following steps of…

Reconnaissance is the initial information-gathering phase where the attacker collects data about the target before launching any attack, not post-exploitation cleanup.

Maintaining access refers to installing backdoors, rootkits, or remote access tools to ensure persistent entry - not to erasing evidence of the attack.

Covering tracks is the final phase of a malicious hacking cycle where an attacker removes or modifies audit logs, event logs, and other forensic artifacts to prevent investigators from detecting the intrusion or tracing activity back to them. Altering server log files is a classic covering-tracks technique because logs record authentication attempts, command execution, and file access. The backdoor installation described separately in the question corresponds to the maintaining-access phase.

Gaining access is the exploitation phase where the attacker leverages vulnerabilities to initially compromise the system, not a post-compromise cleanup activity.