Cyber Kill Chain: Delivery Stage Next Step

312-50v12 By islever Editorial Last updated

Introduction to Ethical Hacking

Short answer

B The attacker will exploit the malicious payload delivered to the target organization and establish a foothold.

Question

A cyber attacker has initiated a series of activities against a high-profile organization following the Cyber Kill Chain Methodology. The attacker is presently in the "Delivery" stage. As an Ethical Hacker, you are trying to anticipate the adversary's next move. What is the most probable subsequent action from the attacker based on the Cyber Kill Chain Methodology?
  1. The attacker will attempt to escalate privileges to gain complete control of the compromised system.
  2. The attacker will exploit the malicious payload delivered to the target organization and establish a foothold. Correct Answer
  3. The attacker will initiate an active connection to the target system to gather more data.
  4. The attacker will start reconnaissance to gather as much information as possible about the target.

Key Takeaways

The question tests knowledge of the Cyber Kill Chain sequence. The common trap is confusing 'Delivery' with 'Exploitation', assuming they are separate sequential steps rather than integrated actions where delivery immediately enables exploitation.

Identifies the next phase in the Cyber Kill Chain after Delivery, which is Weaponization and Exploitation to establish a foothold. This page clarifies the attacker's progression from delivery to initial access.

Common mistake: Candidates often select Option A (Privilege Escalation) or Option C (Active Connection/Command and Control), mistaking later stages for the immediate next step following delivery.

Expert Analysis

Why the Answer Is Correct

According to the Lockheed Martin Cyber Kill Chain, the "Delivery" phase involves transmitting the weaponized payload to the target (e.g., via email). The immediate subsequent action is "Exploitation," where the malicious code executes on the target system to establish an initial foothold. Option B accurately describes this transition from delivery to exploitation.

Why the Other Options Are Wrong

Option A (Privilege Escalation) occurs after the foothold is established. Option C (Active Connection) refers to Command and Control, which happens after persistence is gained. Option D (Reconnaissance) is the very first stage, preceding Delivery.

Community Comment Notes

Community consensus strongly supports Option B. As user 'insaniunt' noted, the answer is B because it correctly identifies the exploitation of the delivered payload. User 'qtygbapjpesdayazko' also confirmed the sequence as B then A, reinforcing the logical flow of the kill chain stages.

Exam Strategy

Memorize the specific order of the Cyber Kill Chain phases: Reconnaissance -> Weaponization -> Delivery -> Exploitation -> Installation -> Command & Control -> Actions on Objectives. When asked for the 'next move', always look for the immediate successor phase in this sequence.

Frequently Asked Questions

Is Weaponization part of the Delivery stage?

No, Weaponization precedes Delivery. Delivery is the transmission of the already-weaponized payload.

Why isn't Privilege Escalation the next step?

Privilege Escalation happens after the attacker has successfully exploited the system and gained an initial foothold.

More 312-50v12 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. insaniunt 👍 4 Answered B
    B. The attacker will exploit the malicious payload delivered to the target organization and establish a foothold.
  2. LordXander 👍 1 Answered B
    Because...long live cyber kill chain (I will not miss it from CTIA)
  3. qtygbapjpesdayazko 👍 1 Answered B
    Is B. B then A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Comprehensive Network Scanning Sequence

S-grade

NetBIOS Enumeration on IPv6 Networks

S-grade

Ethical Hacker Liability and Organizational Risk Acceptance

S-grade

Least Likely Social Engineering Method Based on Footprinting Data

S-grade

← Back to 312-50v12 Study Guide