An attacker has prepared a malicious document that exploits a vulnerability in a word processing application. The attacker wants to deliver this document to a specific employee at a target company. Which delivery method is most likely to be used in a targeted attack?

Uploading the document to a public file-sharing site and hoping it gets downloaded

Spear-phishing email with the malicious document attached

Sending the document via a USB drive left in the company parking lot

Broad spam campaign to thousands of random recipients

EC-CouncilCertified Threat Intelligence Analyst (CTIA)

Domain 2Objective 2

Cyber Kill Chain and MITRE ATT&CK Frameworks CTIA Practice Questions (Page 10)

Part of the Cyber Threats and Attack Frameworks domain, which makes up ~13% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–10 in this domain), expect 4–5 from this objective — we provide 54 practice questions to prepare you well beyond it. (estimate)

54questions here

11free pages

14concepts

Questions 46–50

46foundation · easy
In the Cyber Kill Chain model, which phase directly follows the 'Weaponization' phase?
Select an answer first
47application · medium
A security analyst is reviewing an incident where an employee clicked a link in a phishing email, which downloaded a document that exploited a browser vulnerability and installed a remote access tool. The tool then connected to an external server and the attacker exfiltrated customer data. The analyst wants to map this to the Cyber Kill Chain to identify where existing controls failed. Which phase should the analyst focus on first to determine why the initial access was successful?
Select an answer first
48application · medium
An attacker has prepared a malicious document that exploits a vulnerability in a word processing application. The attacker wants to deliver this document to a specific employee at a target company. Which delivery method is most likely to be used in a targeted attack?
Select an answer first
49application · medium
A security analyst is investigating a breach where employees received emails with a link to a legitimate-looking website that had been compromised to serve a malicious download. The emails were personalized with the employees' names and job titles. Which Cyber Kill Chain phase is represented by the act of sending these emails?
Select an answer first
50foundation · easy
Which Cyber Kill Chain phase corresponds to the ATT&CK tactic 'Exfiltration'?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CTIA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “CTIA” is a trademark of its owner, used for identification only.

Cyber Kill Chain and MITRE ATT&CK Frameworks CTIA Practice Questions (Page 10)

Questions 46–50

In the Cyber Kill Chain model, which phase directly follows the 'Weaponization' phase?

An attacker has prepared a malicious document that exploits a vulnerability in a word processing application. The attacker wants to deliver this document to a specific employee at a target company. Which delivery method is most likely to be used in a targeted attack?

Which Cyber Kill Chain phase corresponds to the ATT&CK tactic 'Exfiltration'?

Keep studying — Cyber Threats and Attack Frameworks