Cyber Kill Chain: Delivery Stage Next Step

Introduction to Ethical Hacking

A cyber attacker has initiated a series of activities against a high-profile organization following the Cyber Kill Chain Methodology. The attacker is presently in the "Delivery" stage. As an Ethical Hacker, you are trying to anticipate the adversary's next move. What is the most probable subsequent action from the attacker based on the Cyber Kill Chain Methodology?

The attacker will attempt to escalate privileges to gain complete control of the compromised system.
The attacker will exploit the malicious payload delivered to the target organization and establish a foothold. Correct Answer
The attacker will initiate an active connection to the target system to gather more data.
The attacker will start reconnaissance to gather as much information as possible about the target.

Answer Correct answer: B — The attacker will exploit the malicious payload delivered to the target organization and establish a foothold.

Community Votes

100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests knowledge of the Cyber Kill Chain sequence. The common trap is confusing 'Delivery' with 'Exploitation', assuming they are separate sequential steps rather than integrated actions where delivery immediately enables exploitation.

Identifies the next phase in the Cyber Kill Chain after Delivery, which is Weaponization and Exploitation to establish a foothold. This page clarifies the attacker's progression from delivery to initial access.

Candidates often select Option A (Privilege Escalation) or Option C (Active Connection/Command and Control), mistaking later stages for the immediate next step following delivery.

Community Discussion (3 comments)

LordXander 👍 1 Selected: B

Because...long live cyber kill chain (I will not miss it from CTIA)

qtygbapjpesdayazko 👍 1 Selected: B

Is B. B then A

insaniunt 👍 4 Selected: B

B. The attacker will exploit the malicious payload delivered to the target organization and establish a foothold.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

According to the Lockheed Martin Cyber Kill Chain, the "Delivery" phase involves transmitting the weaponized payload to the target (e.g., via email). The immediate subsequent action is "Exploitation," where the malicious code executes on the target system to establish an initial foothold. Option B accurately describes this transition from delivery to exploitation.

Why the Other Options Are Wrong

Option A (Privilege Escalation) occurs after the foothold is established. Option C (Active Connection) refers to Command and Control, which happens after persistence is gained. Option D (Reconnaissance) is the very first stage, preceding Delivery.

Community Comment Notes

Community consensus strongly supports Option B. As user 'insaniunt' noted, the answer is B because it correctly identifies the exploitation of the delivered payload. User 'qtygbapjpesdayazko' also confirmed the sequence as B then A, reinforcing the logical flow of the kill chain stages.

Exam Strategy

Memorize the specific order of the Cyber Kill Chain phases: Reconnaissance -> Weaponization -> Delivery -> Exploitation -> Installation -> Command & Control -> Actions on Objectives. When asked for the 'next move', always look for the immediate successor phase in this sequence.

Frequently Asked Questions

Is Weaponization part of the Delivery stage?

No, Weaponization precedes Delivery. Delivery is the transmission of the already-weaponized payload.

Why isn't Privilege Escalation the next step?

Privilege Escalation happens after the attacker has successfully exploited the system and gained an initial foothold.

More 312-50v12 FAQ →

Related Analysis

← Back to 312-50v12 Study Guide