CompTIA CySA+ CS0-003 Practice Question

The correct answer is Command & Control (C2) followed by Exfiltration. In the cyber kill chain, the Command & Control stage is where the attacker maintains remote control over the compromised system to manipulate it based on their objectives. Immediately following this control is the Exfiltration stage, where the attacker begins to move the valuable data out of the victim's network to a location they control. 'Establish Foothold' occurs earlier in the kill chain when the attacker first gains access to the network. 'Weaponization' is part of the preparation phase before the attacker breaches the target.