In which of the following incident handling and response stages, the root cause of the incident must be found from the forensic results?
Which of the following attack can be eradicated by disabling of "allow_url_fopen and allow_url_include" in the php.ini file?
Which of the following can help you eliminate the burden of investigating false positives?

Identify the attack in which the attacker exploits a target system through publicly known but still unpatched vulnerabilities.
In which phase of Lockheed Martin's - Cyber Kill Chain Methodology, adversary creates a deliverable malicious payload using an exploit and a backdoor?