What is the primary purpose of the Mandiant Cyber Attack Life Cycle?

### Why this is right The life cycle organizes attacker activity into stages so defenders can reason about possible attack progress and relevant signals. The material presents it as a guide to detection and response, not a guarantee about timing. ### The concept An attack life cycle describes attacker actions from preparation through mission completion. It helps defenders look beyond the initial entry point, since attackers may establish continuing access, seek greater privileges, learn about internal systems, and move through the environment. The stages can inform investigation, but the model does not mean that every attack is identical or fast. ### The other options - **B. To assign likelihood scores to every data asset.**: This describes part of risk assessment, not the purpose of the attack life cycle. - **C. To guarantee that all attacks follow a fixed timetable.**: The material says attacks may persist for an extended period, and the life cycle is not a timetable. - **D. To replace incident response planning with a technical checklist.**: The model supports defenders’ reasoning; it does not replace response planning. ### Terms - **Privilege**: The level of access or authority an account has. ### Remember Use the stages to guide detection, not to assume a fixed schedule.