A security engineer must investigate a recent breach within the organization. An engineer noticed that a breached workstation is trying to connect to the domain "Ranso4676-mware41-603", which is known

The correct answer is A. action on objectives. The event where a breached workstation is trying to connect to a known malicious domain suggests that the attacker is moving towards their end goals, which typically involves actions on objectives. In the Cyber Kill Chain framework, "Action on objectives" refers to the steps take

Submitted by yuki_2020· Mar 6, 2026Security Monitoring

Question

A security engineer must investigate a recent breach within the organization. An engineer noticed that a breached workstation is trying to connect to the domain "Ranso4676-mware41-603", which is known as malicious. In which step of the Cyber Kill Chain is this event?

Options

Aaction on objectives
Breconnaissance
Cdelivery
Dweaponization

How the community answered

(28 responses)

A
75% (21)
B
4% (1)
C
14% (4)
D
7% (2)

Explanation

The event where a breached workstation is trying to connect to a known malicious domain suggests that the attacker is moving towards their end goals, which typically involves actions on objectives. In the Cyber Kill Chain framework, "Action on objectives" refers to the steps taken by an attacker to achieve their intended outcomes, such as data exfiltration, destruction, or ransom demands. This phase involves the attacker executing their final mission within the target environment, leveraging access gained in earlier stages of the attack.

Topics

#Cyber Kill Chain#incident response#malware activity

Community Discussion

No community discussion yet for this question.

Full 200-201 Practice