What is a strategic kill chain in integrated defense, and what is the effect of disrupting its early steps?

• A. It describes attacker steps; disrupting early steps reduces probability of successful attack and reduces impact.
• B. It is a defensive blueprint for incident response with no effect on attack probability.
• C. It is a plan to coordinate logistics for defense procurement.
• D. It is a continuous improvement loop for threat intelligence with no relation to attacker steps.

Answer: (A)

A strategic kill chain maps the stages an attacker goes through, from initial reconnaissance and targeting to exploitation and reaching objectives. In integrated defense, the aim is to observe and disrupt those steps early, preventing the attacker from progressing.

Disrupting the early steps lowers the chances of a breach and also reduces potential impact because the attacker is stopped before reaching high-value assets or executing actions that cause significant damage. For instance, stopping phishing or credential theft at the outset prevents initial access and limits lateral movement, so the attack never fully unfolds.

Other descriptions miss the core idea by treating the concept as merely a defensive incident-response plan with no effect on attack probability, or as something unrelated like procurement logistics or a standalone threat-intelligence loop. The strategic kill chain, by contrast, centers on the attacker’s sequence and how interrupting it at the front end curtails both the likelihood and the severity of an intrusion.