The Cyber Kill Chain Methodology TIE Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which phase of the Cyber Kill Chain involves the attacker gathering information about the target, such as email addresses, network ranges, and system vulnerabilities?

   • AReconnaissance
   • BDelivery
   • CCommand and Control
   • DWeaponization
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization's security team is reviewing an attack where the attacker used a USB drop attack. The USB device contained a malicious executable that, when run, installed a keylogger. The keylogger then sent keystrokes to an external server. Which two phases of the Cyber Kill Chain are most directly demonstrated by the USB drop and the keylogger installation?

   • ADelivery and Command and Control
   • BWeaponization and Exploitation
   • CDelivery and Installation
   • DInstallation and Actions on Objectives
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A malware analyst is reverse-engineering a trojan that was delivered via a malicious email attachment. The trojan creates a scheduled task to run a PowerShell script that downloads a second-stage payload from a remote server. The analyst wants to document the phase where the trojan establishes persistence on the system. Which Cyber Kill Chain phase should the analyst assign to the creation of the scheduled task?

   • AExploitation
   • BCommand and Control
   • CInstallation
   • DActions on Objectives
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   During a threat-hunting exercise, an analyst observes that an attacker has been scanning the company's external IP range for open ports, then cross-referencing the results with employee LinkedIn profiles to identify potential targets. According to the Cyber Kill Chain, which phase is the attacker currently in?

   • AActions on Objectives
   • BReconnaissance
   • CWeaponization
   • DDelivery
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   During an incident investigation, a security team finds that an attacker used a vulnerability in a web server to upload a web shell, then used the web shell to execute commands and eventually exfiltrated a database. According to the Cyber Kill Chain, which phase is represented by the attacker uploading the web shell?

   • AActions on Objectives
   • BInstallation
   • CDelivery
   • DWeaponization
   Reveal Solution Discussion Select an answer first