Disclaimer:
Educational Use Only:
The website links provided are to be used strictly for educational and knowledge-gaining purposes only.
No Misuse:
Do not misuse the links or the information contained therein for any commercial, illegal, or unethical activities.
Respect for Websites and Businesses:
Respect the intellectual property and business interests of the websites and their owners. Do not attempt to alter, copy, or redistribute content without proper authorization.
Acknowledge Value of Knowledge:
Recognize and value the knowledge and resources shared by these websites. Use the information responsibly and ethically.
No Endorsement:
The provision of these links does not imply endorsement of the linked sites, their content, or their products and services. Users are responsible for evaluating the suitability and accuracy of the information.
User Responsibility:
By accessing these links, you agree to use the information at your own risk and to comply with all applicable laws and website terms of use.
- What is the first stage of the Cyber Kill Chain?
a. Delivery
b. Installation
c. Reconnaissance
d. Exploitation
Answer: c. Reconnaissance
Source: Lockheed Martin; Darktracedarktrace+1 - During which phase does the attacker create the malicious payload?
a. Weaponization
b. Reconnaissance
c. Command and Control
d. Actions on Objectives
Answer: a. Weaponization
Source: Lockheed Martin; Crowdstrikecrowdstrike+1 - Which stage involves the attacker transmitting the payload to the target?
a. Delivery
b. Installation
c. Exploitation
d. Reconnaissance
Answer: a. Delivery
Source: RSVR Tech; SentinelOnersvrtech+1 - What happens in the Exploitation phase?
a. Establishing persistent access
b. Taking advantage of vulnerabilities to execute code
c. Gathering target information
d. Setting up communication channels
Answer: b. Taking advantage of vulnerabilities to execute code
Source: RSVR Tech; Lockheed Martinwikipedia+1 - In which phase does the malware install backdoors or persistent mechanisms?
a. Command and Control
b. Installation
c. Weaponization
d. Delivery
Answer: b. Installation
Source: Lockheed Martin; Crowdstrikecrowdstrike+1 - What is the purpose of the Command and Control (C2) phase?
a. To send the initial payload
b. To gather reconnaissance data
c. To maintain communications to control compromised systems
d. To delete logs
Answer: c. To maintain communications to control compromised systems
Source: RSVR Tech; Darktracedarktrace+1 - Actions on Objectives typically include:
a. Data exfiltration or system disruption
b. Sending phishing emails
c. Researching vulnerabilities
d. Installing malware
Answer: a. Data exfiltration or system disruption
Source: Lockheed Martin; SentinelOnesentinelone+1 - The Cyber Kill Chain concept was originally developed by:
a. Microsoft
b. Lockheed Martin
c. NSA
d. Cisco
Answer: b. Lockheed Martin
Source: Lockheed Martin official infolockheedmartin+1 - Reconnaissance can be performed:
a. Only through active scans
b. Only offline
c. Both online and offline using passive and active methods
d. Only by social engineering
Answer: c. Both online and offline using passive and active methods
Source: Crowdstrike; Darktracedarktrace+1 - Weaponization often involves:
a. Creating phishing emails
b. Developing malware tailored for specific vulnerabilities
c. Uploading files to cloud storage
d. Conducting penetration tests
Answer: b. Developing malware tailored for specific vulnerabilities
Source: Lockheed Martin; RSVR Techrsvrtech+1 - Which of the following is NOT a recognized stage of the Cyber Kill Chain?
a. Scanning
b. Delivery
c. Exploitation
d. Installation
Answer: a. Scanning
Source: Lockheed Martin model stageswikipedia - Delivery mechanisms can include:
a. USB drives
b. Malicious websites
c. Email attachments
d. All of the above
Answer: d. All of the above
Source: RSVR Tech; SentinelOnesentinelone+1 - Exploitation vulnerabilities may include:
a. Buffer overflows
b. Misconfigurations
c. Privilege escalations
d. All of the above
Answer: d. All of the above
Source: RSVR Techrsvrtech - Installation techniques can include:
a. Rootkits
b. Registry edits
c. Living off the land techniques
d. All of the above
Answer: d. All of the above
Source: RSVR Techrsvrtech - Which phase allows attackers to “have hands on the keyboard” remotely?
a. Reconnaissance
b. Command and Control
c. Weaponization
d. Actions on Objectives
Answer: b. Command and Control
Source: Darktrace; RSVR Techdarktrace+1 - Actions on Objectives could involve:
a. Data destruction
b. Data encryption for ransom
c. Data theft
d. All of the above
Answer: d. All of the above
Source: Lockheed Martin; Crowdstrikecrowdstrike+1 - The Kill Chain framework helps defenders by:
a. Understanding attacker progression
b. Identifying defensive gaps
c. Mapping attack phases to countermeasures
d. All of the above
Answer: d. All of the above
Source: Crowdstrike; RSVR Techcrowdstrike+1 - Reconnaissance techniques include:
a. Social media analysis
b. Network scanning
c. Open-source intelligence gathering
d. All of the above
Answer: d. All of the above
Source: Darktrace; Crowdstrikedarktrace+1 - How can organizations defend against weaponization?
a. Threat intelligence and vulnerability management
b. Deploying firewalls only
c. Disabling user accounts
d. Ignoring suspicious emails
Answer: a. Threat intelligence and vulnerability management
Source: RSVR Techrsvrtech - What is a common delivery vector?
a. Phishing emails
b. Physical break-ins
c. Firewalls
d. Password policies
Answer: a. Phishing emails
Source: RSVR Tech; SentinelOnesentinelone+1 - Exploitation is successful when:
a. The payload executes on the victim system
b. The attacker is detected
c. The payload is delivered only
d. Reconnaissance is complete
Answer: a. The payload executes on the victim system
Source: RSVR Techrsvrtech - Which defensive measure helps prevent installation persistence?
a. Application whitelisting
b. Scanning ports
c. Changing passwords
d. Blocking USB
Answer: a. Application whitelisting
Source: RSVR Techrsvrtech - Command and Control channels often use:
a. Encrypted HTTPS traffic
b. Plaintext email
c. FTP without encryption
d. Public television broadcasts
Answer: a. Encrypted HTTPS traffic
Source: RSVR Techrsvrtech - Which phase is the last in the Cyber Kill Chain?
a. Actions on Objectives
b. Exploitation
c. Installation
d. Weaponization
Answer: a. Actions on Objectives
Source: Lockheed Martin; Crowdstrikewikipedia+1 - Which phase is focused on establishing long-term access?
a. Reconnaissance
b. Installation
c. Delivery
d. Exploitation
Answer: b. Installation
Source: RSVR Techrsvrtech - What is a major goal during reconnaissance?
a. Identifying vulnerabilities
b. Creating malware
c. Sending phishing emails
d. Encrypting files
Answer: a. Identifying vulnerabilities
Source: Crowdstrikecrowdstrike - Weaponization might involve:
a. Combining exploit code with a backdoor
b. Scanning target networks
c. Stealing user credentials
d. Encrypting files on the victim machine
Answer: a. Combining exploit code with a backdoor
Source: LinkedIn; RSVR Techlinkedin+1 - What type of payload delivery might be used?
a. Malicious links
b. USB drives
c. Email attachments
d. All of the above
Answer: d. All of the above
Source: RSVR Tech; SentinelOnesentinelone+1 - Exploitation occurs after:
a. Delivery
b. Installation
c. Reconnaissance
d. Command and Control
Answer: a. Delivery
Source: RSVR Techrsvrtech - Installation is important for:
a. Persistence within a target network
b. Initial gathering of information
c. Delivering malware
d. Phishing the target
Answer: a. Persistence within a target network
Source: Lockheed Martinwikipedia - The Cyber Kill Chain is based on:
a. Military attack modeling
b. Marketing principles
c. Software development lifecycle
d. Project management techniques
Answer: a. Military attack modeling
Source: GeeksForGeeks; RSVR Techgeeksforgeeks+1 - The delivery phase includes:
a. Delivering the weaponized payload to the victim
b. Communicating with established backdoors
c. Encrypting collected data
d. Releasing the source code
Answer: a. Delivering the weaponized payload to the victim
Source: RSVR Techrsvrtech - Which phase involves lateral movement to expand control?
a. Actions on Objectives
b. Command and Control
c. Installation
d. Weaponization
Answer: b. Command and Control
Source: SentinelOne; RSVR Techsentinelone+1 - How does the Cyber Kill Chain help defenders?
a. Pinpoints phases to disrupt attacks
b. Removes vulnerabilities automatically
c. Guarantees no attacks
d. Bans all incoming email
Answer: a. Pinpoints phases to disrupt attacks
Source: Crowdstrike; Lockheed Martinwikipedia+1 - In recon, attackers may use OSINT. What does OSINT mean?
a. Open Source Intelligence
b. Online Security Interaction
c. Official System Integration
d. Organizational Software Interface
Answer: a. Open Source Intelligence
Source: Crowdstrikecrowdstrike - Which technique is often combined with Delivery to increase attack success?
a. Social engineering
b. Automated patching
c. Firewall configuration
d. User training
Answer: a. Social engineering
Source: RSVR Techrsvrtech - Exploitation often targets:
a. Software vulnerabilities
b. Physical devices only
c. Firewalls exclusively
d. Backup servers
Answer: a. Software vulnerabilities
Source: RSVR Tech; Lockheed Martinwikipedia+1 - Which defensive controls help detect exploitation?
a. Behavioral monitoring, patch management
b. Physical security guards
c. Password resets only
d. Open Wi-Fi zoning
Answer: a. Behavioral monitoring, patch management
Source: RSVR Techrsvrtech - What does Command and Control enable cyber attackers to do?
a. Send additional commands and steal data remotely
b. Scan open ports
c. Remove malware
d. Log into admin accounts
Answer: a. Send additional commands and steal data remotely
Source: SentinelOnesentinelone - What is the primary goal of Actions on Objectives?
a. Achieving attacker goals such as theft or disruption
b. Identifying network topology
c. Gathering intelligence
d. Scanning for vulnerabilities
Answer: a. Achieving attacker goals such as theft or disruption
Source: RSVR Techrsvrtech - The Cyber Kill Chain concept helps in:
a. Designing security solutions mapped to attack stages
b. Creating firewalls from scratch
c. Writing software bugs
d. Setting default passwords
Answer: a. Designing security solutions mapped to attack stages
Source: Crowdstrike; Lockheed Martincrowdstrike+1 - At which stage might attackers use phishing to deliver malware?
a. Delivery
b. Weaponization
c. Installation
d. Reconnaissance
Answer: a. Delivery
Source: RSVR Tech; SentinelOnesentinelone+1 - What is key to disrupting Command and Control?
a. DNS filtering and network monitoring
b. Rebooting servers
c. Deleting logs only
d. Changing user passwords
Answer: a. DNS filtering and network monitoring
Source: RSVR Techrsvrtech - Detection and prevention efforts focus on:
a. Interrupting each phase of the kill chain
b. Ignoring suspicious activity
c. Only blocking emails
d. Only updating software
Answer: a. Interrupting each phase of the kill chain
Source: Lockheed Martin; Crowdstrikewikipedia+1 - What can help detect early stages like reconnaissance?
a. Monitoring network traffic and social media
b. Disabling email
c. Turning off Wi-Fi
d. Avoiding all internet use
Answer: a. Monitoring network traffic and social media
Source: Crowdstrikecrowdstrike - The Cyber Kill Chain stages are:
a. Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives
b. Preparation, Response, Recovery
c. Scan, Analysis, Cleanup
d. Research, Design, Build, Test
Answer: a. Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives
Source: Lockheed Martinwikipedia - Lateral movement in networks happens during which phase?
a. Command and Control
b. Reconnaissance
c. Installation
d. Delivery
Answer: a. Command and Control
Source: RSVR Techrsvrtech - What is one main criticism of the Cyber Kill Chain?
a. It assumes attacks are linear and sequential
b. It focuses only on insiders
c. It ignores network monitoring
d. It is outdated and irrelevant
Answer: a. It assumes attacks are linear and sequential
Source: Darktracedarktrace - Which phase can be targeted by sandboxing emails and attachments?
a. Delivery
b. Reconnaissance
c. Exploitation
d. Command and Control
Answer: a. Delivery
Source: RSVR Techrsvrtech - The kill chain approach is useful because:
a. It helps break attacks into manageable stages for defense
b. It stops all phishing automatically
c. It requires no human monitoring
d. It replaces firewalls
Answer: a. It helps break attacks into manageable stages for defense
Source: Lockheed Martin; Crowdstrikecrowdstrike+1
- https://www.darktrace.com/cyber-ai-glossary/cyber-kill-chain
- https://en.wikipedia.org/wiki/Cyber_kill_chain
- https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/cyber-kill-chain/
- https://www.rsvrtech.com/blog/cyber-kill-chain-guide-2025/
- https://www.sentinelone.com/cybersecurity-101/threat-intelligence/cyber-kill-chain/
- https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
- https://www.linkedin.com/pulse/cyber-kill-chain-explained-applying-2025-strongbox-it-pvt-ltd-s9lzf
- https://www.geeksforgeeks.org/ethical-hacking/cyber-kill-chain/
- https://www.splunk.com/en_us/blog/learn/cyber-kill-chains.html
- https://www.eccouncil.org/cybersecurity-exchange/threat-intelligence/cyber-kill-chain-seven-steps-cyberattack/
- https://www.netskope.com/security-defined/cyber-security-kill-chain
- https://saviynt.com/glossary-listing/cyber-kill-chain
- https://www.ek.co/publications/the-7-steps-of-the-cyber-kill-chain/
- https://blog.securelayer7.net/cyber-kill-chain/
- https://www.microsoft.com/en-us/security/business/security-101/what-is-cyber-kill-chain
- https://www.aquasec.com/cloud-native-academy/application-security/cyber-kill-chain/
- https://www.exabeam.com/explainers/mitre-attck/cyber-kill-chain-vs-mitre-attck-4-key-differences-and-synergies/
