Cyber Kill Chain Methodology CEH Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which of the following is an example of a delivery mechanism for a weaponized payload?

   • AA security patch applied to close a known vulnerability
   • BA command and control server sending instructions to compromised hosts
   • CA vulnerability scanner identifying open ports on a server
   • DA USB drive left in a parking lot with a malicious autorun file
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which statement best describes the Cyber Kill Chain methodology?

   • AA linear sequence of steps that attackers follow, which defenders can use to break the attack chain
   • BA set of legal rules that govern how organizations must respond to data breaches
   • CA method for encrypting data to prevent unauthorized access during transmission
   • DA tool that automatically patches vulnerabilities in software systems
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is the final phase of the Cyber Kill Chain?

   • AInstallation
   • BActions on objectives
   • CCommand and control
   • DExploitation
   Reveal Solution Discussion Select an answer first
5. 44expert · hard

   A security team is reviewing a recent intrusion. The attacker used publicly available information to craft a spear-phishing email with a malicious attachment. The attachment exploited a zero-day vulnerability in the email client. After execution, the malware established persistence via a registry run key and communicated with an external server using HTTPS. The attacker then exfiltrated sensitive data. The team wants to implement controls that would have the most impact across multiple phases of the Cyber Kill Chain. Which control would be most effective?

   • AImplementing email filtering and attachment sandboxing
   • BEnforcing application whitelisting on all endpoints
   • CDeploying endpoint detection and response (EDR) with behavioral analytics
   • DConducting regular vulnerability scans and patch management
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   An incident response team is analyzing a breach. The attacker used a watering hole attack to compromise a website frequented by employees. The malware then used a legitimate cloud service for C2 and exfiltrated data via encrypted HTTPS traffic. The team is considering whether to block the cloud service domain. What is the most important consideration before blocking?

   • AThe attacker will simply use a different domain
   • BThe cloud service may be used by legitimate business applications
   • CThe cloud service is likely not the only C2 channel
   • DThe domain is encrypted, so blocking it is ineffective
   Reveal Solution Discussion Select an answer first