Which of the following is NOT a typical phase in the cyber kill chain?

• A. Reconnaissance
• B. Delivery
• C. Installation
• D. Containment

Answer: (D)

The concept being tested is how the cyber kill chain traces the attacker’s progression from initial discovery to achieving their goal. This chain models the steps an attacker takes to infiltrate a system and deploy their objective, typically including reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. Containment, however, is a defensive action taken to stop or limit an incident once it’s detected. It belongs to incident response and defense practices, not to the attacker’s sequence of steps, so it isn’t considered a typical phase of the kill chain. The other options correspond to actual attacker activities: reconnaissance involves gathering information, delivery moves the payload toward the target, and installation establishes a foothold for further actions.