What stage comes after recon?

Answer: D — Exploitation

Reconnaissance is about gathering information to understand the target and identify potential weaknesses. The next step is exploitation, where that gathered intel is used to abuse a vulnerability, misconfiguration, or weak credential to breach the system and gain access. In this sequence, exploitation is the act that turns knowledge into an actual intrusion—the point at which the attacker moves from observing to taking action that compromises the target. Delivery, persistence, and cover tracks are typically later stages: delivery is about getting a payload onto the target, persistence is about maintaining access, and cover tracks is about evading detection.