01
Choose one
1 point
An actor steals data and threatens to publish it unless the target pays. Which category best fits the actor’s apparent motivation?
Free Practice Quiz Question List
2 Threat Actors and Attribution Online Quiz Questions
Use this free practice quiz with 20 questions to review 2 Threat Actors and Attribution, test your knowledge, and prepare for your next test or exam.
20 questions
02
Choose one
1 point
An organization uses its substantial funding to recruit outside technical specialists rather than develop every skill internally. What does the funding represent in this example?
- A
The group’s capability, because funding describes what it can do
- B
The group’s motivation, because funding explains its goal
- C
The group’s resources, because funding is something it can draw on
- D
The group’s attribution, because funding identifies its sponsor
03
Choose one
1 point
A group disrupts a public service to draw attention to a social cause. Which actor category best matches the group’s apparent motivation?
- A
A cybercriminal pursuing financial gain
- B
A hacktivist promoting a political or social cause
- C
An insider misusing legitimate access
- D
A nation-state actor pursuing strategic advantage
04
Choose all
1 point
Which kinds of information can analysts combine when assessing who is responsible for cyber activity? Select all correct choices.
- A
Malware and infrastructure evidence
- B
Patterns of behavior
- C
Targeting choices
- D
Timing and other contextual information
- E
A single reused tool treated as conclusive proof of identity
- F
A group name assumed to be consistent across all public reports
05
Choose all
1 point
A small organization is concerned that a less sophisticated criminal actor may exploit accessible data for extortion. Which measures are identified as important basic defenses? Select all correct choices.
- A
Patching systems
- B
Using multifactor authentication
- C
Maintaining reliable backups
- D
Waiting for definitive attribution before taking defensive action
- E
Focusing only on protections for information of interest to a sophisticated espionage actor
06
Choose one
1 point
An incident is described as an advanced persistent threat (APT). What conclusion is justified by that label alone?
- A
It proves that a government carried out the activity.
- B
It describes a level or pattern of activity, not a confirmed identity.
- C
It proves that the activity was financially motivated.
- D
It means the actor has no access to substantial resources.
07
Written response
1 point
What term describes an operation in which an actor imitates another actor’s methods to mislead investigators?
08
Written response
1 point
What kind of attribution links cyber activity to a cluster of behavior rather than assigning responsibility to a state or organization?
09
Open ended
1 point
An organization has confirmed an intrusion but cannot confidently identify the actor. What should defenders prioritize, and how should they treat actor names and motive assessments as the investigation develops?
10
Choose one
1 point
A small organization may face an espionage actor interested in sensitive plans as well as a criminal actor seeking accessible data for extortion. Which response best reflects the different risks without relying on definitive attribution?
- A
Treat every threat as equally important and defer improvements until the actor is named.
- B
Assume the interest in sensitive plans proves the actor is a particular government.
- C
Strengthen protections for sensitive plans while maintaining basic defenses against other threats.
- D
Focus only on attribution because defensive measures depend on identifying the actor.
11
Choose one
1 point
Which activity is specifically identified as a way cybercriminals may seek financial gain?
- A
Selling access to a compromised system for profit
- B
Disrupting a service to promote a social cause
- C
Gathering intelligence for geopolitical advantage
- D
Misusing legitimate access to cause harm unintentionally
12
Choose one
1 point
An employee deliberately uses their authorized access to misuse information in their organization’s systems. Which broad threat actor category best describes the employee?
- A
A cybercriminal
- B
An insider
- C
A thrill-seeker
- D
A nation-state actor
13
Written response
1 point
In threat analysis, what term describes what an actor can draw on to carry out activity, such as funding, personnel, time, tools, or infrastructure?
14
Choose one
1 point
In threat analysis, what does the term “resources” refer to?
- A
The actions an actor is technically able to perform
- B
What an actor can draw on, such as funding, personnel, or tools
- C
The actor’s confirmed identity and government affiliation
- D
The actor’s motivation for targeting an organization
15
Written response
1 point
What term describes what a threat actor can do?
16
True or false
1 point
True or false: An analyst can prove who carried out a cyber incident from the suspected actor’s motivation alone.
- A
True
- B
False
17
True or false
1 point
A group targets government departments to obtain intelligence for geopolitical advantage. Is this activity consistent with the nation-state actor category?
- A
True
- B
False
18
True or false
1 point
Once an actor has been placed in a threat-actor category based on one operation, that category is a fixed identity that should not change.
- A
True
- B
False
19
Fill in the blank
1 point
A group seeks geopolitical strategic advantage by targeting government ministries and people of intelligence interest. The broad category most directly suggested is .
20
Fill in the blank
1 point
Thrill-seekers and actors may seek challenge, recognition, or amusement and often rely on widely available tools.