IPA IP 2022 Question 69
A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問69, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate description of a cyber kill chain?
Explanation
A model that splits an attack on an information system into phases such as reconnaissance, attack and execution of the objective — the cyber kill chain.
The term borrows the military idea of the chain of steps needed to destroy a target. A targeted attack is described as a sequence: reconnaissance of the target, preparing a weapon such as malware, delivering it, exploiting a vulnerability, installing, taking remote control, and finally carrying out the objective, such as stealing data. Because each phase depends on the one before, a defender who breaks the chain at any phase stops the attack, and can plan countermeasures phase by phase.
Answer (a)
Why not others:
- •(b) — connecting hubs and switches one after another is a cascade (daisy-chain) connection
- •(c) — blocks of transactions linked by the hash of the previous block form a blockchain
- •(d) — e-mail that urges recipients to forward it, spreading to many people, is chain mail
Key rule: The cyber kill chain models an attack as consecutive phases so that defences can be placed to cut it at each phase.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.