Cyber Security Quiz: Attack Lifecycle
10 questions · exam conditions
0:00
Attack LifecycleQuestion 1 of 10

At 09:00, monitoring detects a transfer of sensitive records to an external server. At 11:00, analysts discover that an unauthorized startup entry was created three days earlier. At 13:00, archived proxy logs reveal that the attacker scanned the public application a week before the startup entry was created.

Which statement most accurately reconciles the alert times with the attack lifecycle?

The lifecycle began with exfiltration because that was the first phase detected by the monitoring system.
Persistence preceded reconnaissance because the startup entry was discovered before analysts reviewed the archived proxy logs.
The phases cannot be ordered because evidence discovered after exfiltration is invalid for reconstructing earlier attacker activity.
Detection order differs from activity order; the evidence supports reconnaissance, later persistence, and eventual exfiltration.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Attack Lifecycle

Practice Attack Lifecycle in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Attack Lifecycle, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

At 09:00, monitoring detects a transfer of sensitive records to an external server. At 11:00, analysts discover that an unauthorized startup entry was created three days earlier. At 13:00, archived proxy logs reveal that the attacker scanned the public application a week before the startup entry was created.

Which statement most accurately reconciles the alert times with the attack lifecycle?

  1. The lifecycle began with exfiltration because that was the first phase detected by the monitoring system.
  2. Persistence preceded reconnaissance because the startup entry was discovered before analysts reviewed the archived proxy logs.
  3. The phases cannot be ordered because evidence discovered after exfiltration is invalid for reconstructing earlier attacker activity.
  4. Detection order differs from activity order; the evidence supports reconnaissance, later persistence, and eventual exfiltration. (correct answer)
Explanation: When analyzing an attack timeline, you must distinguish between when activity occurred and when it was detected. These are almost never the same, and confusing them is one of the most common mistakes in incident response reasoning. The passage gives you three discovery events in sequence: exfiltration detected at 09:00, a malicious startup entry discovered at 11:00, and proxy logs revealing a prior scan discovered at 13:00. But discovery time ≠ execution time. The proxy logs show the attacker scanned the application one week before the startup entry was created, and the startup entry was created three days before exfiltration occurred. Mapping these to the attack lifecycle gives you: reconnaissance → persistence → exfiltration — a perfectly logical progression that matches frameworks like the MITRE ATT&CK or the Cyber Kill Chain. Answer D correctly captures this: detection order differed from activity order, but the evidence still supports a coherent chronological reconstruction. Answer A commits the core error this question is testing — it assumes the first detected phase must be the first executed phase. Exfiltration was caught first simply because real-time monitoring flagged it; that says nothing about when the attack began. Answer B makes the same logical inversion in reverse, concluding persistence came before reconnaissance because analysts found the startup entry before reviewing the proxy logs. Discovery sequence is not activity sequence. Answer C introduces a fabricated rule — there is no principle in forensic analysis that makes evidence discovered after exfiltration invalid for reconstructing earlier events. Archived logs are routinely used precisely for this purpose. When you see a question mixing timestamps with attack phases, always ask yourself: "Is this when it happened, or when it was found?" That single question will cut through most of the distractor traps.

Question 2

An endpoint is compromised through an unpatched service. Responders reimage the endpoint, removing an unauthorized startup service, but they leave the vulnerable network service exposed. Two days later, the attacker exploits the same vulnerability again from the internet.

Which assessment best distinguishes remediation of persistence from remediation of exploitation?

  1. Reimaging removed the persistence artifact, but leaving the vulnerability exposed allowed the attacker to repeat exploitation. (correct answer)
  2. Reimaging removed the exploitation path, but leaving the startup service exposed allowed persistence to recreate the vulnerability.
  3. Reimaging prevented exfiltration, but leaving reconnaissance data exposed allowed the startup service to return automatically.
  4. Reimaging ended reconnaissance, but leaving outbound access exposed allowed the attacker to restore persistence without exploitation.
Explanation: When analyzing incident response scenarios, you need to clearly separate two distinct concepts: exploitation (how the attacker gains initial access) and persistence (how the attacker ensures continued access after rebooting or remediation). These are independent problems requiring independent fixes. In this scenario, the attacker exploited an unpatched network service to compromise the endpoint, then installed an unauthorized startup service to maintain persistence. Responders reimaged the machine — which wiped the startup service — but never patched the vulnerable network service. Two days later, the attacker simply exploited that same unpatched service again from the internet. This tells you exactly what was fixed and what wasn't: persistence was remediated (startup service removed), but the exploitation vector was not (vulnerability left open). Answer A captures this precisely. Reimaging addressed the persistence artifact (startup service), but the unpatched vulnerability remained as a live exploitation path — allowing the attacker to repeat the attack cycle entirely. Answer B reverses the logic incorrectly. Reimaging doesn't remove an "exploitation path" — it removes persistence artifacts. The startup service can't "recreate the vulnerability"; vulnerabilities exist in software, not startup entries. Answer C introduces exfiltration and reconnaissance, neither of which appear in the scenario. This is a distractor that pulls in plausible-sounding IR terminology without grounding it in the described events. Answer D similarly invents concepts — "ended reconnaissance" and "outbound access" — that have no basis in the passage. Persistence doesn't restore itself through outbound connections in this context. The key study tip: always map each IR action to its specific purpose. Reimaging = removes malicious artifacts (persistence). Patching = closes the door (exploitation). If only one is done, the attack repeats.

Question 3

A security team receives an alert that a large encrypted archive was created on a compromised file server. The archive remains on the server. Network logs show no corresponding outbound connection, removable-media activity, or transfer to another system.

Which conclusion is best supported by the available evidence?

  1. Exfiltration is confirmed because compressing and encrypting data moves it outside the organization's security boundary.
  2. Persistence is confirmed because the archive remains available to the attacker after the original compromise ends.
  3. Preparation for exfiltration is indicated, but actual exfiltration is not confirmed without evidence of data leaving the system. (correct answer)
  4. Reconnaissance is confirmed because creating the archive identifies which files are valuable enough for later collection.
Explanation: When analyzing attacker behavior, cybersecurity professionals often use the kill chain or attack lifecycle framework, which breaks intrusions into sequential phases: reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and exfiltration. The critical skill this question tests is distinguishing between preparation for a phase and completion of that phase — a distinction that matters enormously in incident response. The evidence here tells a specific story: a large encrypted archive was created, but network logs show no outbound transfer, no removable media activity, and no lateral movement. This pattern is classic staging — the attacker has collected and packaged data, which is a preparatory step before exfiltration, not exfiltration itself. Exfiltration, by definition, requires data to leave the organization's control. Without evidence of that transfer, you can only say exfiltration is likely intended, not confirmed. Answer C captures this precisely. Answer A is wrong because compression and encryption alone do not move data outside a security boundary — they are staging actions. Conflating preparation with exfiltration is a common trap. Answer B is wrong because "persistence" refers to an attacker maintaining access to a system (e.g., backdoors, scheduled tasks), not retaining a data archive. The archive's presence doesn't indicate persistence mechanisms. Answer D is wrong because reconnaissance involves gathering information about a target environment (network scanning, enumeration), not packaging already-identified files. Your study tip: on questions involving attacker actions, always ask yourself "Has this phase actually completed, or is this evidence only of preparation?" Exfiltration requires confirmed data movement — staging alone is never enough.

Question 4

During an investigation, analysts identify the following events: a public employee directory was queried repeatedly; a crafted document triggered code execution on a workstation; a scheduled task was created to launch code at logon; and selected files were uploaded to an unfamiliar cloud account.

Which event most directly marks the transition from exploitation to persistence?

  1. Repeated queries against the employee directory identified a suitable user and workstation for targeting.
  2. The crafted document caused attacker-controlled code to execute in the context of the targeted user.
  3. The scheduled task arranged for attacker-controlled code to run again when the user logged on. (correct answer)
  4. The cloud upload moved selected organizational files to infrastructure controlled by the attacker.
Explanation: When you see a question like this, think in terms of the ATT&CK kill chain phases — specifically the boundary between Exploitation and Persistence. Exploitation is the moment attacker-controlled code first runs on a victim system. Persistence is the mechanism that ensures the attacker retains access across interruptions like reboots or logoffs. The key question is: which event guarantees the attacker can return, not just that they arrived? The scheduled task in C is the correct answer because it is specifically designed to re-execute attacker code at a future trigger (user logon). Creating a scheduled task doesn't exploit anything new — it leverages existing access to anchor that access going forward. That "anchor" is the textbook definition of persistence, making C the precise transition point you're looking for. A describes reconnaissance — querying an employee directory is pre-exploitation targeting, identifying victims rather than compromising them. It belongs to an earlier phase entirely. B is tempting but wrong: the crafted document triggering code execution is exploitation itself, not the transition away from it. This is the moment the attacker first gains a foothold, not the moment they secure it. D describes exfiltration — moving files to external infrastructure is a later-stage objective (collection/exfiltration), well past the exploitation-to-persistence boundary. A useful mental anchor: exploitation = first code runs; persistence = code will run again. On questions asking about phase transitions, always identify what each event accomplishes for the attacker, and match that function to the kill chain phase — the transition answer will be the one that shifts from "gaining access" to "keeping access."

Question 5

An attacker obtains a valid but short-lived cloud access token from an exposed development log. Within ten minutes, the attacker uses the token to list storage containers and download sensitive objects. The token then expires, and investigators find no new accounts, keys, startup mechanisms, or configuration changes.

Which interpretation best applies the common attack lifecycle model to this incident?

  1. Exfiltration is not established because the attacker did not first create a mechanism for persistent cloud access.
  2. The incident includes access and exfiltration, while persistence may have been skipped because the token enabled immediate action. (correct answer)
  3. The exposed token is itself persistence because any valid credential necessarily provides durable access to the environment.
  4. The storage-container listing is persistence because it allowed the attacker to maintain awareness of available cloud data.
Explanation: When analyzing a security incident through the lens of the attack lifecycle (also called the cyber kill chain or intrusion lifecycle), your job is to map what actually happened to the defined stages — not assume every stage must be present. Stages like persistence, lateral movement, and privilege escalation are common but not required for an incident to be real and damaging. In this scenario, the attacker obtained a token, used it to enumerate storage containers, and downloaded sensitive data — all within ten minutes before the token expired. That maps cleanly to initial access (using the stolen token) and exfiltration (downloading sensitive objects). Critically, investigators found no persistence mechanisms whatsoever. B is correct because it accurately reflects what happened: access and exfiltration occurred, and persistence was simply skipped — the short-lived token made immediate action possible without needing a foothold. Answer A is wrong because it inverts the logic — exfiltration doesn't require persistence to precede it. The attacker exfiltrated data; that fact stands regardless of whether they established persistence. Answer C misdefines persistence. A valid credential is an access mechanism, not persistence. Persistence specifically means creating a way to maintain access across sessions, reboots, or credential expiration — something like a backdoor, new account, or scheduled task. A token that expires in minutes is the opposite of durable. Answer D similarly misapplies the term: listing storage containers is reconnaissance or discovery, not persistence. Awareness of data doesn't mean the attacker can return later. Your key takeaway: in attack lifecycle questions, always ask "what did the attacker actually do?" — don't assume missing stages invalidate the stages that are present.

Question 6

After compromising a user workstation, an attacker queries internal naming services, identifies a previously unknown database server, exploits that server, creates a database login, and exports customer records.

What does this sequence demonstrate about applying a lifecycle model across multiple systems?

  1. Creating the database login is exfiltration because it enables later retrieval of customer records from the server.
  2. Any information gathering after initial exploitation must be classified as persistence rather than reconnaissance.
  3. The database exploit belongs to the original reconnaissance phase because it reveals whether the server is vulnerable.
  4. Reconnaissance can recur after an initial compromise as the attacker identifies and targets additional systems. (correct answer)
Explanation: When you see a question about attacker lifecycle models (like the Cyber Kill Chain or MITRE ATT&CK), ask yourself: does each phase apply only once, or can it repeat across different targets within the same campaign? This scenario is testing exactly that concept. The passage shows a two-target operation. The attacker compromises a workstation, then uses internal naming services — essentially performing new reconnaissance — to discover the database server. That discovery triggers a fresh cycle: exploit, establish access, and exfiltrate. This is why D is correct: reconnaissance isn't a one-time event locked to the campaign's opening move. As the attacker pivots to new systems, the lifecycle phases recur for each new target. A misidentifies the phase of creating a database login. That action is best classified as persistence (establishing a foothold for continued access), not exfiltration. Exfiltration is the actual transfer of data out of the environment — in this case, exporting the customer records. B is wrong because post-exploitation information gathering doesn't automatically become persistence. Querying naming services to discover the database server is classic internal reconnaissance, regardless of when in the campaign it occurs. The timing doesn't change the nature of the activity. C confuses the purpose of exploitation with reconnaissance. Exploiting the database server is the exploitation phase for that specific target. The fact that a successful exploit confirms vulnerability doesn't retroactively make it part of reconnaissance. Study tip: On exam questions involving lifecycle models, always check whether the scenario describes multiple targets — that's your signal that phases are likely repeating, not progressing linearly through a single cycle.

Question 7

A vulnerable web server records a malicious request that triggers command execution. Two seconds later, the server writes a password-protected web shell into a directory that remains available after the application process restarts. The attacker uses the shell the next day.

Why should the malicious request and the web shell be assigned to different lifecycle phases?

  1. The request performs reconnaissance by testing the server, whereas the shell performs exploitation by executing commands later.
  2. The request achieves exploitation through command execution, whereas the shell supplies a reusable persistence mechanism. (correct answer)
  3. The request establishes persistence through remote execution, whereas the shell performs exfiltration by receiving commands.
  4. The request performs exploitation through file creation, whereas the shell performs reconnaissance by revealing server contents.
Explanation: When analyzing multi-stage attacks, cybersecurity frameworks like the MITRE ATT&CK or the Cyber Kill Chain assign distinct phases based on what each action accomplishes, not simply when it happens. Your job here is to identify the purpose and outcome of each event independently. The malicious request triggers command execution on the server — that's the moment the attacker breaks in and forces the system to run unauthorized code. This is exploitation: leveraging a vulnerability to execute attacker-controlled commands. Two seconds later, the server writes a web shell into a persistent directory. That shell isn't breaking in — access is already achieved. Its purpose is to survive restarts and be reused the next day, which is the definition of persistence: maintaining long-term, reliable access to a compromised system. Option B captures this distinction precisely, making it the correct answer. Option A misclassifies the malicious request as reconnaissance. Reconnaissance involves gathering information before attacking; the request here actually executes commands, which is exploitation, not probing. Option C claims the request establishes persistence through remote execution — but persistence requires surviving disruption and enabling future access, which the shell provides, not the initial request. It also mislabels the shell as performing exfiltration, which involves stealing data — the shell receives commands, it doesn't leak data by definition. Option D reverses the logic entirely, claiming file creation is exploitation and the shell performs reconnaissance, neither of which reflects what these actions achieve. A useful study habit: for each event in a scenario, ask "what does this accomplish for the attacker?" — break-in, foothold, or data theft? That outcome, not the timing, determines the phase.

Question 8

Analysts observe a malicious process sending small outbound beacons every five minutes. The process was launched through a memory-only exploit and stops when the workstation is restarted. No startup entry, modified account, installed service, or other relaunch mechanism is found.

Which lifecycle conclusion is most defensible?

  1. The periodic beacons prove persistence because recurring network traffic is sufficient evidence of durable access.
  2. The memory-only exploit proves persistence because successful code execution always survives a workstation restart.
  3. The beacons indicate active attacker communication, but persistence is not established without a durable relaunch or reentry method. (correct answer)
  4. The absence of a startup entry proves exfiltration because the process must send all collected data before the restart.
Explanation: When analyzing a threat actor's foothold on a system, you need to distinguish between two separate concepts: active presence and persistence. Active presence means the attacker is currently running and communicating. Persistence means the attacker can survive a disruption — specifically, a reboot — through some durable relaunch mechanism like a registry key, scheduled task, service, or modified account. In this scenario, the process lives entirely in memory and vanishes on restart with no relaunch mechanism found. That tells you the attacker has active presence but has not established persistence. C is correct because it accurately separates these two ideas: the beacons confirm live attacker communication, but without a durable reentry method, you cannot conclude persistence exists. A is wrong because recurring network traffic is not evidence of persistence — it's evidence of activity. A process can beacon every five minutes and still disappear the moment you reboot. Confusing "recurring behavior" with "durable access" is a classic definitional trap. B is wrong because successful code execution does not automatically survive a restart. Memory-only exploits are explicitly designed to run in volatile memory, meaning a reboot destroys them — that's actually a defensive advantage of such exploits being detected early. D is a complete non-sequitur: the absence of a startup entry tells you nothing about exfiltration. It tells you about persistence (or its absence). Mixing those two conclusions is logically incoherent. For your exam, remember: persistence requires a relaunch mechanism. Activity without a relaunch mechanism means volatile presence only. Always ask, "Would this survive a reboot?" before concluding persistence.

Question 9

A company can deploy only one immediate control during an active incident. Option 1 blocks known malicious destination addresses. Option 2 disables a compromised administrator account used by an unauthorized scheduled task. Option 3 patches the public service used for initial entry. Option 4 removes detailed employee information from the public website. Investigators confirm that the attacker already has an active session and is preparing a data transfer.

Which option most directly disrupts the impending exfiltration phase, while doing the least to address the other lifecycle phases?

  1. Block the known malicious destination addresses used for the planned outbound transfer. (correct answer)
  2. Disable the compromised administrator account used by the scheduled task to remove persistence.
  3. Patch the public service that the attacker used to obtain initial access to the environment.
  4. Remove detailed employee information from the public website that supported the attacker's target selection.
Explanation: When analyzing incident response questions, anchor yourself to the attack lifecycle phase being targeted. The scenario tells you the attacker already has an active session and is about to exfiltrate data — so the highest-priority disruption is stopping that outbound transfer, not addressing how the attacker got in or how they're persisting. Option A directly intercepts the exfiltration phase by blocking the destination addresses where stolen data would be sent. Since the attacker is actively preparing to transfer data, cutting off those outbound channels neutralizes the imminent threat. Critically, it does nothing to address initial access, persistence, or reconnaissance — making it the most narrowly targeted and therefore most precise answer to the question as worded. Option B, disabling the compromised administrator account, targets persistence (the scheduled task). This is a meaningful defensive action, but it doesn't stop an attacker who already has an active session from completing the transfer before losing that foothold. It addresses the wrong lifecycle phase for the immediate threat. Option C patches the vulnerability used for initial access. Valuable long-term, but the attacker is already inside — patching the door after someone has entered doesn't evict them or stop what they're doing right now. Option D removes reconnaissance data from the public website, targeting the pre-attack/target selection phase. This is the most temporally distant action from the current threat; the attacker has already used whatever information was available. When a question asks what "most directly" disrupts a specific phase, match your answer to that exact phase — and eliminate options that target earlier or later stages in the lifecycle.

Question 10

An attacker enumerates an organization's public subdomains, exploits a vulnerable internet-facing application, installs an auto-start service, and transfers a database archive to an external host. The organization can immediately prevent creation of the auto-start service, but it cannot yet patch the application or block outbound transfers.

Which outcome is most consistent with the attack lifecycle after the organization applies the available control?

  1. The attacker may still exploit the application and exfiltrate data during the active session, but reliable reentry becomes more difficult. (correct answer)
  2. The attacker may continue reconnaissance, but exploitation and exfiltration become impossible because persistence has been prevented.
  3. The attacker may retain long-term access through the application vulnerability because any successful exploit automatically provides persistence.
  4. The attacker may install the service and retain access, but outbound transfer becomes unlikely because persistence controls also block exfiltration.
Explanation: When analyzing layered security controls, think about what each control actually stops versus what it leaves open. The key framework here is the attack lifecycle: reconnaissance → exploitation → persistence → exfiltration. Removing one stage doesn't automatically collapse the others. Preventing the auto-start service eliminates persistence — the attacker's ability to reliably return after a session ends. However, the organization explicitly cannot patch the vulnerable application or block outbound transfers. This means the attacker can still exploit the application during an active session and still move data outbound during that same session. What becomes "more difficult" is reliable reentry: without a persistent foothold, the attacker must re-exploit from scratch each time, which adds friction but doesn't make future attacks impossible. Answer A captures this precisely — ongoing session activity remains feasible, but long-term reliable access is degraded. Answer B is wrong because it overstates the impact of the control. Blocking persistence doesn't make exploitation or exfiltration "impossible" — those depend on the unpatched application and open outbound channels, both of which remain unaddressed. Answer C incorrectly assumes exploitation automatically provides persistence. These are distinct phases; a successful exploit grants access in that session, but persistence requires a separate mechanism (like the auto-start service), which is exactly what's being blocked. Answer D confuses two unrelated controls — persistence mechanisms and exfiltration channels operate independently, so blocking one says nothing about the other. Your study tip: on questions involving partial mitigations, always map each control to the specific attack phase it targets. A control only disrupts what it directly addresses — never assume collateral damage to other phases unless explicitly stated.