200-201 Question 398
Select 3A security analyst is investigating an intrusion event where an attacker successfully sent a phishing email to a company employee, tricking them into providing their login credentials. These credentials were later used by the attacker to access the company's internal servers and exfiltrate sensitive data. Based on the Cyber Kill Chain model, which of the following stages are involved in this scenario?
- A
Reconnaissance
- B
Delivery
- C
Exploitation
- D
Command and Control
- E
Actions on Objectives
Show answer and explanation
Correct answers: B, C, E
Explanation
The Cyber Kill Chain model helps classify intrusion events into stages. In this scenario, the attacker delivered the phishing email (Delivery), exploited the employee's trust to gain credentials (Exploitation), and used those credentials to achieve their objective of accessing internal servers and stealing data (Actions on Objectives). Other stages such as Reconnaissance and Command and Control are not directly described in this specific case.
- A. Incorrect.
Reconnaissance involves the attacker gathering information to identify potential targets, such as scanning for vulnerabilities or researching the organization. While this is a common step, it is not explicitly described in the given scenario.
- B. Correct.
Delivery refers to the attacker sending the phishing email to the employee, which is clearly a part of the described intrusion event.
- C. Correct.
Exploitation occurs when the employee falls for the phishing email and provides their login credentials, enabling further compromise by the attacker.
- D. Incorrect.
Command and Control involves establishing a persistent connection between the attacker and the compromised system. This step is not explicitly mentioned in the scenario.
- E. Correct.
Actions on Objectives refers to the attacker using the stolen credentials to access internal servers and exfiltrate sensitive data, which is a direct part of the described intrusion event.