Alan is providing himself with a way to access the system at a later date through alternative channels. This is an example of persistence, allowing his access to the system to remain intact even if the original vulnerability he exploited is later patched. Pivoting and lateral movement are techniques where the attacker gains access to one system and then uses that access to gain access to other systems. That’s not what’s happening here. Finally, cleanup occurs when the attacker removes traces of their presence from the network. That hasn’t yet happened in this scenario.