In the cyber kill chain model, which of the following is NOT a typical phase?

• A. Reconnaissance
• B. Delivery
• C. Installation
• D. Containment

Answer: (D)

The cyber kill chain traces the attacker’s progression from initial information gathering to achieving objectives. Typical stages include reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Containment is a defensive action taken to stop the attacker and limit damage after detection, not a step the attacker performs. Because the kill chain describes attacker actions, containment isn’t considered a normal phase of the chain. Reconnaissance, delivery, and installation all represent concrete attacker activities: recon and weaponization precede delivery, which is followed by exploitation and installation to establish foothold.