200-201 Network Intrusion Analysis Practice Question
In the Cyber Kill Chain, which phase involves sending a malicious attachment to a targeted user?
⚠ Common exam trap
200-201 often tests the boundary between Weaponization and Delivery — candidates pick Weaponization because the attachment is 'malicious', but the act of sending it is what defines Delivery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Delivery
In the Lockheed Martin Cyber Kill Chain, Delivery is the phase where the attacker transmits the weaponised payload to the victim — for example, via a phishing email with a malicious attachment, a malicious link, or a USB drop. Sending the malicious attachment to a targeted user is the textbook definition of Delivery. Weaponization (the prior phase) is where the attacker pairs the exploit with the payload, but the actual transmission to the target is Delivery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Exploitation
Why it's wrong here
Exploitation is the phase where the delivered payload triggers the vulnerability and executes code on the victim host; the sending itself is Delivery. Exploitation would be correct where the question describes the malicious code actually running or the vulnerability being triggered after delivery.
- ✓
Delivery
Why this is correct
Delivery is the phase where the adversary transmits the weaponised payload — such as a malicious attachment or link — to the target. Exploitation occurs only after the user opens it, so transmission itself sits in Delivery.
- ✗
Weaponization
Why it's wrong here
Weaponization couples an exploit with a deliverable payload, such as a malicious document, but the phase covering transmission to the target is Delivery. Weaponization would be correct where the question asks about preparing or pairing the exploit and payload before any sending occurs.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance gathers information about the target, such as addresses and employee details, before any payload exists; sending the attachment occurs in Delivery. Reconnaissance would be correct where the question concerns researching, harvesting or identifying targets prior to weaponisation and delivery.
About these practice questions
Courseiva writes every 200-201 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-201 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-201 exam.