PCCET · Question #116
Which stage of the cyberattack lifecycle can be identified by port scans from external sources?
The correct answer is A. Reconnaissance. Port scans from external sources are a hallmark of the Reconnaissance stage, where attackers gather information about a target's network to identify potential vulnerabilities.
Question
Which stage of the cyberattack lifecycle can be identified by port scans from external sources?
Options
- AReconnaissance
- BWeaponization and Delivery
- CExploitation
- DInstallation
How the community answered
(52 responses)- A87% (45)
- B2% (1)
- C4% (2)
- D8% (4)
Why each option
Port scans from external sources are a hallmark of the Reconnaissance stage, where attackers gather information about a target's network to identify potential vulnerabilities.
During the Reconnaissance phase of the cyberattack lifecycle, attackers actively or passively gather information about their target's environment. External port scans are an active reconnaissance technique used to discover open ports, services, and potential vulnerabilities on network-facing systems.
Weaponization involves pairing an exploit with a payload, and Delivery is transmitting the weaponized artifact; neither involves initial port scanning.
Exploitation occurs when an attacker successfully leverages a vulnerability to gain access, which happens after reconnaissance and often after delivery.
Installation is the stage where the attacker establishes persistence on the compromised system, occurring after successful exploitation.
Concept tested: Cyberattack lifecycle - Reconnaissance phase
Source: https://learn.microsoft.com/en-us/security/compass/incident-response-guides/prepare#cyber-kill-chain-and-mitre-attck
Topics
Community Discussion
No community discussion yet for this question.