The Cyber Kill Chain Methodology TIE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which phase of the Cyber Kill Chain is characterized by the attacker establishing a persistent communication channel with the compromised system to issue commands and receive data?

   • AActions on Objectives
   • BCommand and Control
   • CExploitation
   • DInstallation
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A threat intelligence team is using the Cyber Kill Chain to analyze a supply chain attack where the adversary compromised a software vendor's build server and injected malicious code into a legitimate software update. The team finds that the kill chain does not adequately describe the attack because the adversary did not directly target the end organization until the update was installed. Which limitation of the Cyber Kill Chain is most relevant here?

   • AIt assumes the attacker directly targets the victim organization.
   • BIt requires the attacker to use malware to be applicable.
   • CIt does not account for the use of legitimate tools by attackers.
   • DIt focuses on external threats and ignores insider threats.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security team is evaluating the Cyber Kill Chain to improve their detection capabilities. They notice that the model does not account for insider threats or attacks that originate from within the network. Which complementary model should they consider to address this gap?

   • AThe Diamond Model
   • BThe OODA loop
   • CThe MITRE ATT&CK framework
   • DThe STRIDE model
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A threat intelligence analyst is mapping an attack to the Cyber Kill Chain. The analyst notices that the attacker used a legitimate cloud storage service to host their malware and used encrypted HTTPS traffic for C2 communication. Which limitation of the Cyber Kill Chain does this scenario highlight?

   • AThe model is too granular for practical use
   • BThe model does not account for the use of legitimate services or encrypted traffic
   • CThe model focuses on external threats and may miss insider actions
   • DThe model assumes a linear progression through phases
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In the Cyber Kill Chain, which phase immediately follows the 'Delivery' phase and involves the attacker's code being triggered on the target system?

   • AWeaponization
   • BExploitation
   • CActions on Objectives
   • DInstallation
   Reveal Solution Discussion Select an answer first