The question follows the Cyber Kill Chain model.

1. Reconnaissance: The attacker identifies targets and plans the operation (matches "plan the cyber-attack").
2. Weaponization: The attacker selects the exploit and malware (backdoor) to create a payload, effectively determining the method of compromise.
3. Delivery: The weaponized bundle is transmitted to the target (e.g., via email or web).
4. Exploitation: The malware code is executed or "triggered" on the target system to exploit a vulnerability.
5. Installation: To maintain access (persistence), the attacker typically installs a backdoor. In the context of this specific exam mapping, this stage corresponds with escalating privileges to ensure the installation is successful and permanent.
6. Command and Control (C2): The compromised host establishes an outbound channel to the attacker's server for instructions.

Lockheed Martin. (n.d.). The Cyber Kill Chain. Retrieved from Lockheed Martin Cyber Kill Chain. (Defines the 7 steps: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, Actions on Objectives).

Palo Alto Networks. (2021). Cybersecurity Survival Guide, "Section 1.2.1: The Cyber-Attack Lifecycle". (Describes the modern application of the lifecycle, mapping Reconnaissance to planning and Weaponization to creating the payload).

Malone, T., et al. (2016). "Modeling the Cyber Kill Chain." Proceedings of the 11th International Conference on Cyber Warfare and Security (ICCWS). (Academic analysis of the stages, confirming Exploitation involves triggering code and Installation involves establishing persistence).