Question 7 - Palo Alto Networks PCNSA Real Exam Questions [Jan 2026 Update]

Q: 7

DRAG DROP Match the cyber-attack lifecycle stage to its correct description.

Drag & Drop

Enable JavaScript to use the Drag & Drop feature.

stage that reveals the attacker's motivation for attacking a network
stage where the attacker scans for network vulnerabilities and services that can be exploited
stage where the attacker will explore methods such as a root kit to establish persistence
stage where the attacker has access to a specific server so they can communicate and pass data to and from infected devices within a network

Correct Answer:

Answer Areas reconnaissance: B. stage where the attacker scans for network vulnerabilities and services that can be exploited installation: C. stage where the attacker will explore methods such as a root kit to establish persistence command and control: D. stage where the attacker has access to a specific server so they can communicate and pass data to and from infected devices within a network act on the objective: C. stage where the attacker will explore methods such as a root kit to establish persistence

Explanation

Act on the objective: This is the final phase where the adversary executes their ultimate goal (e.g., data exfiltration, encryption, or system destruction). The nature of this action reveals the attacker's underlying motivation (financial, political, sabotage, etc.).

Reconnaissance: In this initial phase, the attacker gathers intelligence. This includes scanning for open ports, vulnerabilities, and services to identify targets.

Installation: After exploitation, the attacker installs malware, backdoors, or rootkits to maintain persistence in the environment, ensuring they can return even if the initial vulnerability is patched.

Command and Control (C2): This phase establishes a communication channel (often via a specific C2 server) allowing the attacker to remotely issue commands to and receive data from compromised devices.

References

Lockheed Martin Corporation, "The Cyber Kill Chain®". Gaining the Advantage.

Concept Reference: Defines the seven steps including Reconnaissance (research/scanning), Installation (establish persistence), Command and Control (communication channel), and Actions on Objectives (original goals/motivation).

Link: Lockheed Martin - The Cyber Kill Chain

Cisco Systems, "Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide". Chapter: The Cyber Kill Chain.

Context: Cisco's curriculum officially adopts the Lockheed Martin Cyber Kill Chain model for the CyberOps certification, defining "Installation" as the step where backdoors/rootkits are placed for persistence.

NIST, "Guide to Cyber Threat Information Sharing", Special Publication 800-150.

Context: Discusses the phases of the intrusion lifecycle, corroborating the definitions of Reconnaissance and C2 channels.

Premium Access Includes

FLASH OFFER

avail 10% DISCOUNT on YOUR PURCHASE