350 questions with instant explanations, domain breakdown, and wrong-answer analysis. Built for the real exam.
This is exactly what you see during practice — question, options, and a full explanation after you answer.
During an investigation, you observe an attacker utilizing a custom-compiled Trojan that bypasses EDR detection. According to the Cyber Kill Chain, at which phase is this specific action of developing the custom tool occurring?
The Weaponization phase is where the adversary creates the malicious payload or tool, such as a custom Trojan, to exploit the target.
You are identifying Indicators of Compromise (IOCs) for an ongoing APT campaign. Which of the following is considered a Host-based IOC?
A host-based IOC is an artifact found on an endpoint or host system, such as a modified registry key, a suspicious file hash, a rogue process, or a persistence entry. Registry key modification is a classic host-based indicator because attackers use registry Run keys, services, or…Read full explanation
What is the primary purpose of the 'Actions on Objectives' phase in the Cyber Kill Chain?
This is the final phase where the adversary achieves their ultimate goal, such as data exfiltration or system destruction.
Questions are tagged by exam domain. Practice a specific domain or mix them all.
Answer at your own pace. Explanation and domain tag shown immediately after each answer.
Countdown timer starts immediately. Results and domain scores shown at the end — just like the real exam.
Full explanations on every question
Not just the right answer — you get exactly why each wrong option is wrong, so you learn the concept, not the answer.
Domain score breakdown
After each session see your score by exam domain so you know exactly where to focus study time.
100% free, forever
No subscription, no trial, no email wall. Start a session in under 10 seconds.
Exam-style questions
Scenario-based, precise wording, realistic distractors — written to match what you actually see on exam day.