The SOC team detected an ongoing port scan. After investigation, the team concluded that the scan was targeting the company servers. According to the Cyber Kill Chain model, which step must be…

Delivery involves the transmission of the weaponized payload to the target, which happens after reconnaissance and weaponization.

Exploitation occurs when the attacker triggers a vulnerability to gain access to the system, which happens after reconnaissance and delivery.

Reconnaissance is the initial phase of the Cyber Kill Chain where adversaries gather information about their target before launching an attack. A port scan directly falls into this category as it's used to discover active services, open ports, and potential vulnerabilities on the company's servers.

Actions on objectives refer to the final steps an attacker takes once they have access, such as data exfiltration, destruction, or achieving their mission goals, which is far beyond a port scan.