What are the stages of the cyber kill chain?

• A. Reconnaissance, weaponization, delivery, exploitation, installation, C2, and actions on objectives.
• B. Reconnaissance, delivery, exploitation, installation, C2, and actions on objectives.
• C. Delivery, reconnaissance, weaponization, installation, exploitation, C2, and actions on objectives.
• D. Exploitation, installation, delivery, reconnaissance, weaponization, C2, and actions on objectives.

Answer: (A)

The kill chain lays out the sequence of actions an attacker typically takes from gathering information to achieving their objective, giving defenders a framework to detect and disrupt the attack at different stages. The stages start with Reconnaissance, where the attacker learns about the target. Next comes Weaponization, where a malicious payload is paired with a delivery method. Delivery then brings that weapon to the target, such as via phishing emails or drives-by downloads. Exploitation occurs when a vulnerability is triggered to run code on the target. Installation follows, establishing a foothold by installing malware. Command and Control (C2) creates or uses a channel for remote instructions and data exfiltration. Finally, Actions on Objectives describes the attacker’s end goal, like data theft, encryption, or disruption.

This order is why the listed correct answer is best: it includes all seven stages in the proper sequence, and it places weaponization before delivery—something the other options omit or misorder. Understanding these steps helps defenders detect activity early, such as suspicious reconnaissance or weaponized payloads, and focus controls accordingly.