200-201 Network Intrusion Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Exploitation

  Why it's wrong here

  Exploitation is the phase where the delivered payload actually triggers a vulnerability to gain code execution, so it occurs after delivery. It is tempting because a malicious attachment is often what performs exploitation once opened, but the sending of that attachment itself is the Delivery phase.

• ✗

  Weaponization

  Why it's wrong here

  Weaponization pairs an exploit with a deliverable payload, such as crafting the malicious document, but the email transmission happens later. It is tempting because the attachment is created here, yet Delivery is the phase where that weaponised artefact actually reaches the target user.

• ✓

  Delivery

  Why this is correct

  Delivery is the phase where the adversary transmits the weaponised payload to the victim, such as a malicious attachment sent by email. Exploitation occurs only after the user opens it, so delivery is the correct phase.

• ✗

  Reconnaissance

  Why it's wrong here

  Reconnaissance covers researching and selecting targets before any payload is delivered. It is tempting because reconnaissance precedes delivery and involves gathering victim information, but sending the malicious attachment itself occurs during the Delivery phase of the Cyber Kill Chain.