How can defenders use the attack life-cycle model without assuming that every attack follows a perfectly fixed sequence?
Answer
The model provides a way to anticipate possible attacker activities and identify detection opportunities at different stages. Defenders should use it to guide investigation and monitoring, while recognizing that attack activity may vary and may persist over time.
Explanation
### What a good answer covers
- The stages offer a structured way to interpret attacker behavior.
- Each stage suggests different possible evidence and detection opportunities.
- Attackers may remain active for a long time, so monitoring should span stages.
- The model supports analysis and should not be treated as proof that every attack follows an identical path.
### Remember
Use the life cycle as a defensive lens, not a rigid script.
Related Questions
- Which of the following is an example of an adversary attack activity, as opposed to a system vulnerability or a defensive measure? (Select all that apply.)(intermediate)
- Which information is most directly useful when coordinating technical response across teams?(basic)
- Attackers necessarily complete all life-cycle stages quickly, so extended monitoring is unnecessary.(basic)
- The foundational three-stage model of organizational change consisting of Unfreeze, Change, and Refreeze was introduced by social psychologist Kurt _____.(basic)
- Select ALL elements that belong in a documented cyber risk assessment.(intermediate)
Want to practice more questions like this?
Join myBenkio free and practice past questions for your Nigerian university courses with AI explanations for every answer.
Start Practicing Free