CrowdStrike Certified Falcon Hunter (CCFH) — Question 42

Which of the following is an example of actor actions during the RECONNAISSANCE phase of the Cyber Kill Chain?

Answer options

• A. Installing a backdoor on the victim endpoint
• B. Discovering internet-facing servers
• C. Emailing the intended victim with a malware attachment
• D. Loading a malicious payload into a common DLL

Correct answer: B

Explanation

The correct answer is B because discovering internet-facing servers is a key task in the reconnaissance phase, where actors gather information about potential targets. The other options describe actions that occur in later phases, such as exploitation or installation, rather than reconnaissance.