200-201 Network Intrusion Analysis Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Installation

  Why it's wrong here

  Installation occurs after the exploit executes, establishing persistence on the compromised host, not transmitting the payload. It is tempting because it follows delivery chronologically, and it would be correct when describing malware writing itself to the system to survive reboots.

• ✗

  Exploitation

  Why it's wrong here

  Exploitation is the phase where the delivered payload actually triggers the vulnerability to execute code, not where the exploit reaches the target. It tempts because delivery and exploitation often occur seconds apart in a single email click, but delivery covers transmission via attachment or link, which is the stem's scenario.

• ✗

  Weaponization

  Why it's wrong here

  Weaponization pairs an exploit with a deliverable payload, such as a malicious document, but does not transmit it to the victim. It is tempting because it directly precedes delivery, and it would be correct when describing coupling malware to an exploit before any email or link is sent.

• ✓

  Delivery

  Why this is correct

  Delivery is the phase where the adversary transmits the weaponised payload to the victim, satisfying the stem's requirement for an exploit reaching the target via email attachment or malicious link. It follows Weaponisation and precedes Exploitation, making it the precise Cyber Kill Chain stage described.