1.1 Demonstrate Knowledge of the Cyber Kill Chain (e.g., Reconnaissance, Scanning, Enumeration, Gaining Access, Escalation of Privileges, Maintaining Access, Covering Tracks) and Recognize Intelligence Gaps CCFH Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is investigating an alert where a user clicked a link in a phishing email, which downloaded and executed a macro-enabled document. The document then ran a PowerShell script that downloaded a payload from an external URL. Which phase of the cyber kill chain does the initial click and execution represent, and what is the primary intelligence gap?

   • AEscalation of privileges; the gap is whether the payload runs with admin rights.
   • BMaintaining access; the gap is whether the payload is persistent.
   • CReconnaissance; the gap is whether the attacker researched the user's role.
   • DGaining access; the gap is whether the payload has established a foothold on the host.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is the correct sequence of the seven phases in the cyber kill chain?

   • AReconnaissance, Delivery, Weaponization, Exploitation, Installation, Actions on Objectives, Command and Control
   • BReconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives
   • CDelivery, Weaponization, Reconnaissance, Exploitation, Installation, Actions on Objectives, Command and Control
   • DReconnaissance, Scanning, Enumeration, Gaining Access, Escalation of Privileges, Maintaining Access, Covering Tracks
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common persistence mechanism used by adversaries?

   • AClearing the Windows event log
   • BExploiting a vulnerability in a web application
   • CCreating a scheduled task that runs a malicious script
   • DUsing a port scanner to identify open ports
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An organization discovers that an attacker used a valid employee's credentials to log into a VPN. Which kill chain phase does this represent?

   • AEscalation of Privileges
   • BMaintaining Access
   • CGaining Access
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A threat hunting team is assessing their detection coverage. They have excellent visibility into initial access (phishing alerts) and command-and-control (network alerts), but they lack visibility into the middle of the attack chain. They cannot see internal network scans, lateral movement, or privilege escalation attempts. According to the cyber kill chain, which phases have the most significant intelligence gaps?

   • AReconnaissance, maintaining access, and covering tracks.
   • BScanning/enumeration, gaining access (lateral), and escalation of privileges.
   • CGaining access (initial), escalation of privileges, and maintaining access.
   • DAll phases have equal coverage.
   Reveal Solution Discussion Select an answer first