Which Option Best Illustrates the Delivery Step of the Cyber Kill Chain?
Short answer
D Delivery is the intruder transmitting the weaponized email attachment to the target, not creating it or having it triggered and installed.
Question
Key Takeaways
The exam tests whether you can map a concrete attacker action onto the correct kill-chain phase; the trap is confusing the act of building the weapon (Weaponization) or the victim opening it (Exploitation/Installation) with the act of transmitting it.
The cyber kill chain's third phase, Delivery, is the transmission of a weaponized payload to the victim — here, emailing a malicious attachment. This page confirms why sending the attachment (D) is Delivery, while creating the malware belongs to Weaponization and execution/installation come later.
Common mistake: Many learners pick the option describing malware being triggered or installed on the target, because it sounds like the 'attack happening' — but triggering is Exploitation/Execution and installation is the Installation phase, both of which occur only after Delivery succeeds.
Expert Analysis
Why the Answer Is Correct
Lockheed Martin's kill chain defines Delivery as the phase in which the adversary transmits the weaponized bundle to the victim — via email, USB, web drive-by, or similar vector. Option D describes exactly that transmission: the intruder sends the malicious attachment by email to a target, moving the already-built payload from attacker to victim environment. Every other phase in the model is defined by a distinct action (reconnaissance, weaponization, exploitation, installation, command-and-control, actions on objectives), and only D names the transfer itself. As one learner put it, the keyword is "sends", because that is the moment of delivery. The whole chain only advances once the payload reaches the victim, which is precisely why Delivery is the pivot point the question is probing.
Why the Other Options Are Wrong
Option A describes coupling an exploit with a backdoor into a deliverable — that is Weaponization (phase two), the step that produces the artifact rather than sending it. Option B describes the payload activating when the victim opens the attachment, which is Exploitation (and arguably the start of Execution), the phase that follows Delivery. Option C describes the malware being written to the target host, which is Installation, the persistence step after successful exploitation. None of these three involve the attacker transmitting anything to the victim, so none fit the definition of the third step. Note that A and D are easily confused because both mention the malicious attachment — the differentiator is create versus send.
Community Comment Notes
Consensus among voters is unanimous for D, and the reasoning tracks the official definition: as insaniunt explains, the third step "involves delivering the malicious payload to the target system." Shaody frames it in the canonical language of the model — sending the weaponized bundle to the victim "using email, USB, etc." LordXander keeps it blunt: D is correct "because it is actually delivering," and another commenter points to the verb "sends" as the giveaway keyword. This is a case where vote agreement and doctrine align, so the option can be accepted with confidence.
Official Reference
https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html
This link opens the official vendor documentation in a new tab.
Exam Strategy
When a kill-chain question appears, label each option with its phase before comparing them — recon, weaponize, deliver, exploit, install, C2, actions on objectives. The verb in the option (create, send, trigger, install) is usually the discriminator, so read for the action rather than the noun.
Frequently Asked Questions
Why is creating the malicious attachment not the delivery step?
Why does a triggered attachment count as exploitation instead of delivery?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
insaniunt 👍 2 Answered DThe third step in the cyber kill chain is the Delivery phase. It involves delivering the malicious payload to the target system. Among the given options, the best example of the delivery step is: D. An intruder sends a malicious attachment via email to a target.
-
shaody 👍 1 Answered DDelivery phase - Send weaponized bundle to the victim using email, USB, etc.
-
LordXander 👍 1 Answered DD - because it is actually delivering
-
qtygbapjpesdayazko 👍 2keyword "sends" delivery.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.