Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
CompTIA CySA+ Cybersecurity Analyst · CompTIA
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
The attacker already has access and is now taking steps to maintain and use that foothold, which is exactly what happens during the exploitation phase of the cyber kill chain. Exploitation begins once the attacker successfully tricks a user and starts executing actions on the compromised system to continue the attack.
This was on the exam
The question is not confusing. It clearly states he has access and doesn’t want to lose access which would be accomplished by a C2 server. The question asks what stage he’s currently in. Since a C2 server isn’t set up yet, it would be exploitation. He’s nowhere near action on objectives. Actions on objectives is about getting what the attacker wants not maintaining access which is why it’s the last stage of the kill chain. It’s a pretty straightforward question.