Define the cyber kill chain and identify the typical phases used to disrupt adversary cyber operations.

• A. The cyber kill chain includes reconnaissance, phishing, malware distribution, encryption, persistence, lateral movement, data exfiltration
• B. The cyber kill chain includes initial access, exploitation, privilege escalation, defense evasion, credential harvesting, data destruction
• C. The cyber kill chain phases are recon, weaponization, delivery, exploitation, installation, command and control, actions on objectives
• D. The cyber kill chain involves planning, budgeting, deployment, operation

Answer: (C)

The cyber kill chain is a framework that breaks a cyber intrusion into a sequence of stages attackers typically follow, so defenders can detect and disrupt the operation at different points. The classic seven-phase model starts with recon, where the attacker gathers information about the target; weaponization, where a weapon is prepared by pairing a payload with an exploit; delivery, which brings the weaponized payload to the target; exploitation, where a vulnerability is triggered to run code; installation, where the attacker establishes a foothold on the system; command and control, which creates a channel back to the attacker for remote control; and actions on objectives, where the attacker carries out the intended goals, such as data access or destruction.

This option matches that established sequence, making it the best choice. The other options mix or omit familiar kill-chain stages or introduce terms that aren’t part of the standard seven-phase model, so they don’t align with the typical framework used to disrupt adversary cyber operations.