200-201 Security Concepts Practice Question
A security analyst is examining a suspicious executable found on a compromised host. Static analysis reveals that the file contains a packer and obfuscated strings. When run in a sandbox, it attempts to connect to an external IP address and modifies registry keys for persistence. Which stage of the cyber kill chain does the registry modification represent?
⚠ Common exam trap
The trap here is associating any external connection with Command and Control, but the registry modification specifically serves persistence, which is Installation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Installation
Registry modification for persistence is part of the Installation stage of the cyber kill chain, where the attacker ensures the malware survives reboots. The other stages such as Delivery, Exploitation, and Command and Control occur at different points. The sandbox observation of registry changes indicates the malware is establishing a foothold.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Installation
Why this is correct
Installation is the stage where the attacker establishes persistence on the victim system. Modifying registry keys to ensure the malware runs on startup is a classic installation technique. The sandbox behavior of modifying registry keys aligns with maintaining access after the initial compromise.
- ✗
Command and Control
Why it's wrong here
Command and Control (C2) is the stage where the compromised system communicates with an attacker-controlled server to receive instructions or exfiltrate data. While the malware attempts to connect to an external IP, the registry modification itself is for persistence, not C2 communication.
- ✗
Exploitation
Why it's wrong here
Exploitation is the stage where the attacker leverages a vulnerability to execute code on the target system. Registry modification for persistence happens after code execution, during installation. The scenario indicates the malware is already running, so exploitation has already occurred.
- ✗
Delivery
Why it's wrong here
Delivery is the stage where the attacker transmits the weaponized payload to the target, such as via email or USB. The registry modification occurs after the malware is already running on the host, so it is not part of delivery. Delivery precedes execution and installation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.