The Cyber Kill Chain Methodology TIE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is reviewing an incident where an employee received a spear-phishing email with a malicious macro document. The document, when opened, downloaded a remote access tool from a file-sharing site. The tool then established an outbound connection to a command-and-control server and began collecting files from the employee's workstation. At which two phases of the Cyber Kill Chain did the attacker's actions most directly align?

   • ADelivery and Installation
   • BDelivery and Command and Control
   • CExploitation and Actions on Objectives
   • DInstallation and Command and Control
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is a recognized limitation of the Cyber Kill Chain when analyzing modern cyber attacks?

   • AIt is designed primarily for insider threat detection and not for external attacks
   • BIt models attacks as a linear sequence of phases, which may not reflect non-linear or multi-stage attacks
   • CIt assumes the attacker is an insider with physical access to the target
   • DIt requires the use of commercial threat intelligence feeds to be effective
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst is investigating a breach where the attacker gained access to a database and exfiltrated customer records. The analyst notes that the attacker used a previously compromised administrator account to log in. According to the Cyber Kill Chain, which phase does the use of the compromised administrator account represent?

   • AExploitation
   • BWeaponization
   • CDelivery
   • DActions on Objectives
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An incident responder is analyzing a ransomware attack. The initial vector was a phishing email with a malicious macro that downloaded and executed ransomware. The ransomware encrypted files and displayed a ransom note. The responder needs to map the actions to the Cyber Kill Chain. Which sequence correctly maps the macro execution, the ransomware download, and the file encryption?

   • AExploitation, Installation, Actions on Objectives
   • BExploitation, Command and Control, Actions on Objectives
   • CDelivery, Exploitation, Actions on Objectives
   • DWeaponization, Delivery, Exploitation
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A security team is evaluating the Cyber Kill Chain for use in their threat intelligence program. They have a mix of external and insider threats. They want a model that can handle both. Which approach is most effective?

   • AUse the Diamond Model for both because it covers all threat actors
   • BUse the Cyber Kill Chain for external threats and MITRE ATT&CK for insider threats
   • CUse the Cyber Kill Chain for both external and insider threats because it is the industry standard
   • DUse MITRE ATT&CK for both external and insider threats because it covers both and provides more detail
   Reveal Solution Discussion Select an answer first