Cyber Kill Chain Methodology CEH Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which activity is an example of exploitation in the Cyber Kill Chain?

   • AInstalling a backdoor to maintain persistence
   • BCreating a malicious PDF with an embedded exploit
   • CUsing a buffer overflow to execute arbitrary code on a vulnerable service
   • DSending a spear-phishing email with a malicious link
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary purpose of the installation phase in the Cyber Kill Chain?

   • ATo install malware or backdoors to maintain persistence on the compromised system
   • BTo exfiltrate sensitive data from the target
   • CTo deliver the malicious payload to the target
   • DTo gather information about the target's network
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   During a ransomware incident, the attacker has already established C2 and is beginning to encrypt files. The incident response team must choose a course of action. Which action best balances the need to stop the encryption with the need to preserve evidence?

   • AImmediately power off the affected systems
   • BAllow the encryption to complete to preserve evidence
   • CIsolate the affected systems from the network while preserving disk images for analysis
   • DDisconnect the C2 channel but leave the systems running
   Reveal Solution Discussion Select an answer first
5. 24expert · hard · select all that apply

   A security team is analyzing a sophisticated attack. The attacker used a malicious macro in a Word document delivered via email. The macro downloaded a second-stage payload that established persistence via a scheduled task and communicated with a C2 server using DNS tunneling. The team is planning defensive measures. Which of the following controls would be effective in disrupting multiple phases of the Cyber Kill Chain? (Select all that apply.)

   • AUsing a signature-based antivirus solution
   • BImplementing application whitelisting to prevent unknown executables
   • CDisabling macros in Office documents by default
   • DMonitoring DNS traffic for anomalies
   Check answers Discussion Select an answer first
6. 25foundation · easy

   Which activity is associated with the command and control phase?

   • AA compromised host beaconing to an external server for instructions
   • BA user clicking a malicious link in an email
   • CAn attacker installing a backdoor on the system
   • DAn attacker scanning the target's network for open ports
   Reveal Solution Discussion Select an answer first