Cyber Kill Chain Methodology CEH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security team detects that a compromised workstation is periodically sending encrypted HTTPS traffic to a known malicious IP address. The traffic is used to issue commands to the installed malware. Which Cyber Kill Chain phase does this activity represent?

   • ACommand and Control
   • BActions on Objectives
   • CDelivery
   • DInstallation
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An incident responder is analyzing a malware infection. The malware was delivered via a malicious macro in a Word document. When the user opened the document and enabled macros, the malware executed and created a scheduled task to run a script every time the system boots. Which two phases of the Cyber Kill Chain are directly observed in this sequence?

   • AExploitation and Actions on Objectives
   • BExploitation and Installation
   • CDelivery and Weaponization
   • DInstallation and Command and Control
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A penetration tester is performing an assessment. The tester uses Shodan to find internet-facing servers, then uses a vulnerability scanner to identify specific weaknesses on those servers. Which type of reconnaissance is the tester performing?

   • AActive reconnaissance
   • BWeaponization
   • CPassive reconnaissance
   • DDelivery
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is implementing defenses against a known threat actor that uses water-holing attacks. The actor compromises websites that the company's employees frequently visit. Which two Cyber Kill Chain phases should the company focus on to mitigate this specific attack vector?

   • AActions on Objectives and Installation
   • BInstallation and Command and Control
   • CReconnaissance and Weaponization
   • DDelivery and Exploitation
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is reviewing logs after a suspected breach. The analyst notices that an attacker used publicly available LinkedIn profiles and Google dorking to identify employees and their email addresses before sending a targeted phishing email. In which phase of the Cyber Kill Chain did this activity occur?

   • AExploitation
   • BReconnaissance
   • CWeaponization
   • DDelivery
   Reveal Solution Discussion Select an answer first