Which Option Best Illustrates the Delivery Step of the Cyber Kill Chain?
Which among the following is the best example of the third step (delivery) in the cyber kill chain?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The exam tests whether you can map a concrete attacker action onto the correct kill-chain phase; the trap is confusing the act of building the weapon (Weaponization) or the victim opening it (Exploitation/Installation) with the act of transmitting it.
The cyber kill chain's third phase, Delivery, is the transmission of a weaponized payload to the victim — here, emailing a malicious attachment. This page confirms why sending the attachment (D) is Delivery, while creating the malware belongs to Weaponization and execution/installation come later.
Many learners pick the option describing malware being triggered or installed on the target, because it sounds like the 'attack happening' — but triggering is Exploitation/Execution and installation is the Installation phase, both of which occur only after Delivery succeeds.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Lockheed Martin's kill chain defines Delivery as the phase in which the adversary transmits the weaponized bundle to the victim — via email, USB, web drive-by, or similar vector. Option D describes exactly that transmission: the intruder sends the malicious attachment by email to a target, moving the already-built payload from attacker to victim environment. Every other phase in the model is defined by a distinct action (reconnaissance, weaponization, exploitation, installation, command-and-control, actions on objectives), and only D names the transfer itself. As one learner put it, the keyword is "sends", because that is the moment of delivery. The whole chain only advances once the payload reaches the victim, which is precisely why Delivery is the pivot point the question is probing.Why the Other Options Are Wrong
Option A describes coupling an exploit with a backdoor into a deliverable — that is Weaponization (phase two), the step that produces the artifact rather than sending it. Option B describes the payload activating when the victim opens the attachment, which is Exploitation (and arguably the start of Execution), the phase that follows Delivery. Option C describes the malware being written to the target host, which is Installation, the persistence step after successful exploitation. None of these three involve the attacker transmitting anything to the victim, so none fit the definition of the third step. Note that A and D are easily confused because both mention the malicious attachment — the differentiator is create versus send.Community Comment Notes
Consensus among voters is unanimous for D, and the reasoning tracks the official definition: as insaniunt explains, the third step "involves delivering the malicious payload to the target system." Shaody frames it in the canonical language of the model — sending the weaponized bundle to the victim "using email, USB, etc." LordXander keeps it blunt: D is correct "because it is actually delivering," and another commenter points to the verb "sends" as the giveaway keyword. This is a case where vote agreement and doctrine align, so the option can be accepted with confidence.Official Reference
Exam Strategy
When a kill-chain question appears, label each option with its phase before comparing them — recon, weaponize, deliver, exploit, install, C2, actions on objectives. The verb in the option (create, send, trigger, install) is usually the discriminator, so read for the action rather than the noun.
Frequently Asked Questions
Why is creating the malicious attachment not the delivery step?
Building the exploit-plus-payload bundle is Weaponization (step two). Delivery only begins when that finished weapon is transmitted to the victim, as in option D.
Why does a triggered attachment count as exploitation instead of delivery?
Delivery ends once the payload reaches the target. The payload executing when the file is opened is Exploitation, with Installation following if the attacker gains persistence.