The Cyber Kill Chain Methodology TIE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security operations center (SOC) is reviewing a multi-stage attack. The attacker first scanned the network and identified a vulnerable web application. They then exploited a SQL injection vulnerability to upload a web shell. The web shell was used to establish a reverse shell to a command-and-control server. The attacker then used the reverse shell to move laterally and eventually exfiltrated a database. The SOC wants to map this attack to the Cyber Kill Chain to identify detection opportunities. Which mapping is most accurate?

   • AWeaponization, Delivery, Exploitation, Command and Control
   • BReconnaissance, Exploitation, Installation, Actions on Objectives
   • CReconnaissance, Exploitation, Command and Control, Actions on Objectives
   • DReconnaissance, Delivery, Exploitation, Installation
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An analyst observes that an attacker sent a phishing email with a malicious attachment to an employee. The employee opened the attachment, which exploited a vulnerability in the PDF reader and installed a backdoor. The attacker then connected to the backdoor to access the corporate network. At which phase of the Cyber Kill Chain did the attacker connect to the backdoor?

   • AActions on Objectives
   • BCommand and Control
   • CDelivery
   • DExploitation
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is documenting an attack where the attacker used a publicly available exploit kit to deliver a payload that exploited a browser vulnerability. The payload then downloaded a banking trojan. The analyst needs to identify the phase where the attacker uses the exploit kit to deliver the payload. Which phase is this?

   • AWeaponization
   • BInstallation
   • CDelivery
   • DExploitation
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat intelligence analyst is documenting an attack where the adversary harvested email addresses from LinkedIn and used them to craft personalized phishing emails. The emails contained a link to a fake login page that captured credentials. The analyst needs to categorize the harvesting of email addresses and the crafting of the phishing emails into the correct kill chain phases. Which two phases should the analyst assign?

   • AReconnaissance and Weaponization
   • BWeaponization and Installation
   • CReconnaissance and Delivery
   • DDelivery and Exploitation
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   A security analyst is documenting an attack where the attacker sent a malicious PDF attachment via email. The PDF exploited a reader vulnerability and installed a backdoor. The backdoor then phoned home to a C2 server. Which phase of the Cyber Kill Chain is the 'phoning home' activity?

   • ADelivery
   • BActions on Objectives
   • CCommand and Control
   • DInstallation
   Reveal Solution Discussion Select an answer first