Which sequence correctly represents the stages of the cyber kill chain?

Which sequence correctly represents the stages of the cyber kill chain?

• A. Delivery, reconnaissance, weaponization, installation, exploitation, command and control, actions on objective.
• B. Reconnaissance, delivery, weaponization, installation, exploitation, command and control, actions on objective.
• C. Weaponization, reconnaissance, delivery, installation, exploitation, command and control, actions on objective.
• D. Reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objective.

Answer: (D)

The sequence tests the order of actions an attacker typically follows from initial information gathering to achieving their goal. It starts with reconnaissance, where the attacker collects data about the target; then weaponization, where a payload is crafted to exploit a vulnerability; then delivery, which sends that payload to the target; followed by exploitation, where the vulnerability is triggered to run code; installation, where malware is placed to maintain access; command and control, which establishes a control channel back to the attacker; and finally actions on objectives, where the attacker completes the intended mission such as data theft or disruption. This exact progression—Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives—is why the correct sequence is chosen. The other options mix up the early stages (for example, delivering before gathering intel or weaponizing before reconnaissance), which breaks the logical flow of how an intrusion typically unfolds.

The sequence tests the order of actions an attacker typically follows from initial information gathering to achieving their goal. It starts with reconnaissance, where the attacker collects data about the target; then weaponization, where a payload is crafted to exploit a vulnerability; then delivery, which sends that payload to the target; followed by exploitation, where the vulnerability is triggered to run code; installation, where malware is placed to maintain access; command and control, which establishes a control channel back to the attacker; and finally actions on objectives, where the attacker completes the intended mission such as data theft or disruption.

This exact progression—Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives—is why the correct sequence is chosen. The other options mix up the early stages (for example, delivering before gathering intel or weaponizing before reconnaissance), which breaks the logical flow of how an intrusion typically unfolds.