Cyber Kill Chain Methodology CEH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A penetration tester is preparing a phishing campaign for a client. The tester has identified that the client's employees use a specific PDF viewer that has a known unpatched vulnerability. The tester creates a malicious PDF that exploits this vulnerability and embeds it in an email attachment. Which two phases of the Cyber Kill Chain are directly demonstrated by these actions?

   • AExploitation and Installation
   • BReconnaissance and Weaponization
   • CWeaponization and Delivery
   • DDelivery and Command and Control
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is implementing a data loss prevention (DLP) solution that monitors outbound network traffic for sensitive data patterns and blocks unauthorized transfers. Which phase of the Cyber Kill Chain is this control primarily designed to disrupt?

   • ACommand and Control
   • BActions on Objectives
   • CInstallation
   • DExploitation
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security team is analyzing a breach. The attacker used publicly available employee information to send a spear-phishing email with a malicious macro document. The document downloaded a backdoor that established a C2 channel using HTTPS. The backdoor then exfiltrated data. The team wants to implement controls that disrupt the attack at the earliest possible phase. Which control should they prioritize?

   • AMonitor outbound HTTPS traffic for C2 activity
   • BImplement email filtering and macro security policies
   • CImplement data loss prevention (DLP) to block exfiltration
   • DDeploy endpoint detection and response (EDR) to detect the backdoor
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which action is most characteristic of the weaponization phase?

   • AInstalling a backdoor on a compromised server to maintain access
   • BScanning the target's website for SQL injection vulnerabilities
   • CSending a phishing email with a link to a malicious website
   • DEmbedding a remote access trojan into a PDF document that exploits a known reader vulnerability
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security team is evaluating the effectiveness of their defenses. They have implemented email filtering, endpoint protection, and network monitoring. However, they are still experiencing successful attacks that reach the Actions on Objectives phase. Which phase of the Cyber Kill Chain is most likely being under-defended?

   • AReconnaissance
   • BDelivery
   • CWeaponization
   • DInstallation
   Reveal Solution Discussion Select an answer first