The Cyber Kill Chain Methodology TIE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the Cyber Kill Chain, what is the primary purpose of the Weaponization phase?

   • ATo execute the payload on the target system
   • BTo identify vulnerabilities in the target's systems
   • CTo establish a communication channel with the compromised system
   • DTo create a deliverable payload that combines malware with an exploit
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A threat intelligence analyst is writing a report on an attack that used a supply-chain compromise. The attacker compromised a software vendor and injected malicious code into a legitimate update. The update was distributed to many organizations. The analyst is trying to map this to the Cyber Kill Chain. Which phase is most directly associated with the compromised update?

   • AExploitation
   • BWeaponization
   • CDelivery
   • DInstallation
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   A penetration tester is simulating an attack for a client. The tester has identified a vulnerability in the client's web application and has crafted a custom exploit payload. According to the Cyber Kill Chain, which phase is the tester currently in?

   • AExploitation
   • BWeaponization
   • CDelivery
   • DReconnaissance
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security team is considering using the Cyber Kill Chain to model a potential insider threat scenario where an employee with legitimate access exfiltrates data. Which limitation of the Cyber Kill Chain is most relevant to this scenario?

   • AIt does not include a command and control phase
   • BIt assumes a linear progression of phases
   • CIt is too detailed for insider threat analysis
   • DIt focuses on external threats and may not account for insider actions
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A threat hunter is reviewing network logs and identifies a series of DNS queries to a domain that is known to be a command-and-control server. The hunter also notices that the compromised host has been sending large amounts of data to an external IP address. Which two phases of the Cyber Kill Chain are the hunter observing?

   • ACommand and Control and Actions on Objectives
   • BInstallation and Command and Control
   • CReconnaissance and Weaponization
   • DDelivery and Exploitation
   Reveal Solution Discussion Select an answer first