The weaponization phase is described as what?

• A. It is observable by victims but not easily detected by defenders
• B. It is the phase where defenders monitor network traffic for anomalies
• C. It is the phase where the attacker prepares the payload for delivery
• D. The phase the victim doesn't see happen but can be detected, involving placing the payload into a delivery vehicle

Answer: (D)

Weaponization is the attacker turning an exploit into a usable attack tool by combining a payload with a delivery method. This happens behind the scenes, so the victim typically doesn’t see the preparation. Defenders may detect activity at this stage through signs like suspicious file packaging or tool creation, even though the victim remains unaware. The essential action described here is placing the payload into a delivery vehicle—bundling the malicious payload with a method that will carry it to the target (such as a crafted document, executable, or kit). This captures why the phase is not visible to the victim but can be detected by defenders and involves preparing the payload for delivery.