Question
An analyst finds that an IP address outside of the company network is being used to run network and vulnerability scans across external-facing assets. Which of the following steps of an attack framework is the analyst witnessing?
- A. Exploitation
- B. Reconnaissance Correct
- C. Command and control
- D. Actions on objectives
Explanation
Scanning external-facing assets for open ports, services and vulnerabilities is information gathering, which is the reconnaissance step of attack frameworks such as the Cyber Kill Chain. Exploitation would involve actually using a flaw to gain access, command and control requires a compromised host communicating with the attacker, and actions on objectives is the final goal, such as data theft, none of which is happening yet.
