Threat Actors Flashcards
1.2 - Summarize fundamental security concepts 2.1 - Compare and contrast common threat actors and motivations 2.2 - Explain common threat vectors and attack surfaces
What is the primary difference between Threat Actors’ Intent and Threat Actors’ Motivation?
A. Intent refers to the tools used, while motivation refers to the method of attack.
B. Intent refers to the attacker’s goal, while motivation refers to the driving force behind the attack.
C. Intent refers to the victim’s response, while motivation refers to the attack duration.
D. Intent and motivation are interchangeable terms in cybersecurity.
Answer:
B. Intent refers to the attacker’s goal, while motivation refers to the driving force behind the attack.
Explanation:
Correct Answer: Intent is the specific objective of the attack, while motivation is the underlying reason or force that drives the threat actor.
Incorrect Options:
A: Tools and methods are not central to the distinction between intent and motivation.
C: Victim’s response and attack duration are unrelated to these terms.
D: Intent and motivation are distinct concepts and not interchangeable.
Which of the following is an example of Data Exfiltration?
A. An attacker encrypts files and demands payment for decryption keys.
B. A threat actor spies on an organization to gather sensitive information.
C. Sensitive data is transferred from a computer without authorization.
D. Malware is deployed to disrupt an organization’s services.
Answer:
C. Sensitive data is transferred from a computer without authorization.
Explanation:
Correct Answer: Data Exfiltration involves the unauthorized transfer of data from a computer.
Incorrect Options:
A: This describes ransomware, which relates to financial gain.
B: This relates to espionage, not data exfiltration.
D: This describes service disruption, not data exfiltration.
What is the primary motivation behind Blackmail in a cyberattack?
A. Financial gain through stealing banking credentials.
B. Threatening to release sensitive information unless demands are met.
C. Disrupting services for political or philosophical reasons.
D. Spreading malware to cause chaos.
Answer:
B. Threatening to release sensitive information unless demands are met.
Explanation:
Correct Answer: Blackmail involves obtaining sensitive information and threatening to release it unless demands are met.
Incorrect Options:
A: Financial gain relates to stealing banking credentials or ransomware attacks.
C: Political or philosophical reasons relate to hacktivism.
D: Spreading malware relates to disruption or chaos.
Which motivation is typically associated with Hacktivism?
A. Financial gain through ransomware attacks.
B. Making a political or philosophical statement.
C. Revenge against a perceived wrongdoing.
D. Improving an organization’s security.
Answer:
B. Making a political or philosophical statement.
Explanation:
Correct Answer: Hacktivism involves conducting attacks driven by political or philosophical beliefs.
Incorrect Options:
A: Financial gain is unrelated to hacktivism.
C: Revenge is a different motivation unrelated to hacktivists.
D: Improving security is the motivation of ethical hackers, not hacktivists.
Which type of threat actor is motivated by Ethical Reasons?
A. Hacktivists
B. Cybercriminals
C. Authorized hackers
D. Espionage agents
Answer:
C. Authorized hackers
Explanation:
Correct Answer: Authorized hackers, also known as ethical hackers, are motivated by a desire to improve security.
Incorrect Options:
A: Hacktivists are motivated by political or philosophical beliefs.
B: Cybercriminals are typically driven by financial gain.
D: Espionage agents aim to gather sensitive information, not improve security.
What is the motivation behind Cyber Warfare?
A. Gaining unauthorized access to bank accounts.
B. Disrupting a country’s infrastructure and causing economic damage.
C. Blackmailing an organization for ransom.
D. Spreading malware to create chaos.
Answer:
B. Disrupting a country’s infrastructure and causing economic damage.
Explanation:
Correct Answer: Cyber warfare aims to disrupt national infrastructure, compromise security, and inflict economic damage.
Incorrect Options:
A: Gaining access to bank accounts relates to financial gain.
C: Blackmail is unrelated to cyber warfare.
D: Spreading malware relates to general disruption, not specifically cyber warfare.
Which motivation involves an attacker targeting an entity they believe has wronged them?
A. Espionage
B. Revenge
C. Financial gain
D. Hacktivism
Answer:
B. Revenge
Explanation:
Correct Answer: Revenge is a motivation where the threat actor targets an entity they feel has wronged them.
Incorrect Options:
A: Espionage involves spying to gather sensitive information.
C: Financial gain focuses on monetary objectives, not personal grievances.
D: Hacktivism is driven by philosophical or political beliefs.
What is the focus of a threat actor motivated by Disruption or Chaos?
A. Launching attacks against critical infrastructure in a populated city.
B. Spying on organizations to gather sensitive information.
C. Limiting users’ access to sensitive data.
D. Threatening to release private information unless demands are met.
Answer:
A. Launching attacks against critical infrastructure in a populated city.
Explanation:
Correct Answer: Disruption or chaos involves spreading malware or launching cyberattacks to create widespread havoc.
Incorrect Options:
B: Spying relates to espionage.
C: Limiting access is a security measure, not a motivation for attacks.
D: Threatening to release private information relates to blackmail.
Which motivation involves the unauthorized transfer of sensitive data to a third party?
A. Data Exfiltration
B. Espionage
C. Revenge
D. Ethical Reasons
Answer:
A. Data Exfiltration
Explanation:
Correct Answer: Data Exfiltration is the unauthorized transfer of sensitive data from a system.
Incorrect Options:
B: Espionage focuses on spying rather than unauthorized transfers.
C: Revenge targets specific entities for grievances.
D: Ethical reasons involve improving security, not stealing data.
What distinguishes Internal Threat Actors from External Threat Actors?
A. Internal Threat Actors are more skilled than External Threat Actors.
B. Internal Threat Actors operate within the organization, while External Threat Actors are outside entities.
C. Internal Threat Actors are less of a threat than External Threat Actors.
D. Internal Threat Actors always act unintentionally, while External Threat Actors act maliciously.
Answer:
B. Internal Threat Actors operate within the organization, while External Threat Actors are outside entities.
Explanation:
Correct Answer: Internal Threat Actors are individuals or entities within the organization, whereas External Threat Actors are outsiders attempting to breach the organization’s defenses.
Incorrect Options:
A: Threat levels depend on resources and intent, not whether they are internal or external.
C: Internal and external actors can both pose significant threats depending on their capabilities and intent.
D: Internal actors can act intentionally or unintentionally, and external actors are not always malicious (e.g., ethical hackers).
What is a Script Kiddie?
A. A highly skilled hacker using sophisticated tools to breach systems.
B. An unskilled individual using pre-made tools or scripts to exploit systems.
C. A government-sponsored threat actor targeting critical infrastructure.
D. A professional hacker working for an organization to improve its security.
Answer:
B. An unskilled individual using pre-made tools or scripts to exploit systems.
Explanation:
Correct Answer: Script Kiddies have limited technical knowledge and rely on pre-made software or scripts to perform cyberattacks.
Incorrect Options:
A: Highly skilled hackers are typically advanced persistent threats or nation-state actors.
C: Government-sponsored actors are nation-state actors, not script kiddies.
D: Professional hackers working to improve security are ethical hackers.
Which attribute primarily distinguishes Advanced Persistent Threats (APTs) from Script Kiddies?
A. Motivation behind the attack.
B. Access to pre-made tools and software.
C. Level of sophistication and technical capability.
D. Whether they operate internally or externally.
Answer:
C. Level of sophistication and technical capability.
Explanation:
Correct Answer: APTs have advanced skills, sophisticated tools, and the ability to evade detection, unlike script kiddies who lack technical expertise.
Incorrect Options:
A: Both APTs and script kiddies may have various motivations, so this does not distinguish them.
B: Script kiddies rely on pre-made tools, while APTs develop their own sophisticated techniques.
D: Both can operate externally, so this is not a distinguishing factor.
What does the level of sophistication of a threat actor indicate?
A. Their motivation behind launching an attack.
B. Their ability to evade detection and use advanced tools.
C. The resources and funding available to them.
D. Whether they are internal or external to the organization.
Answer:
B. Their ability to evade detection and use advanced tools.
Explanation:
Correct Answer: The level of sophistication measures technical skills, complexity of tools and techniques, and the ability to bypass countermeasures.
Incorrect Options:
A: Motivation is separate from sophistication.
C: Resources and funding relate to capability but are not the same as sophistication.
D: Sophistication applies to both internal and external threat actors, not their location.
Which of the following is most likely to be classified as a Nation-State Actor?
A. A disgruntled employee leaking sensitive company data.
B. A group of highly skilled hackers conducting cyber espionage for their government.
C. A hacker using pre-made scripts to exploit networks for financial gain.
D. An ethical hacker identifying vulnerabilities for an organization.
Answer:
B. A group of highly skilled hackers conducting cyber espionage for their government.
Explanation:
Correct Answer: Nation-state actors are government-sponsored and possess advanced skills to carry out sophisticated attacks, often for political or espionage purposes.
Incorrect Options:
A: A disgruntled employee is an internal threat, not a nation-state actor.
C: Hackers using pre-made scripts are script kiddies, not nation-state actors.
D: Ethical hackers work to improve security, not to conduct cyber espionage.
How does resource availability affect a threat actor’s capabilities?
A. It determines whether they are internal or external actors.
B. It defines their technical skills and ability to use tools.
C. It influences the sophistication of tools, skills, and personnel they can use.
D. It has no significant impact on their effectiveness.
Answer:
C. It influences the sophistication of tools, skills, and personnel they can use.
Explanation:
Correct Answer: A threat actor’s access to resources, including funding, personnel, and tools, directly impacts the complexity and effectiveness of their attacks.
Incorrect Options:
A: Resource availability is unrelated to whether the actor is internal or external.
B: Technical skills are separate from resource availability, though resources may enhance skills.
D: Resources play a critical role in determining an actor’s capabilities.
Which of the following describes an External Threat Actor?
A. An individual within an organization accidentally sharing sensitive information.
B. A government-sponsored group targeting a foreign country’s infrastructure.
C. An employee deliberately leaking confidential data.
D. A professional ethical hacker improving an organization’s security posture.
Answer:
B. A government-sponsored group targeting a foreign country’s infrastructure.
Explanation:
Correct Answer: External threat actors operate outside the organization and attempt to breach its cybersecurity defenses, such as a nation-state actor targeting critical infrastructure.
Incorrect Options:
A: This describes an unintentional internal threat actor.
C: An employee leaking data is an internal threat actor.
D: Ethical hackers are authorized to improve security and are not considered external threats.
What is the primary toolset used by Script Kiddies?
A. Custom-built malware and sophisticated techniques.
B. Pre-made software or scripts they do not fully understand.
C. Highly advanced tools created by government-funded organizations.
D. Manual techniques to identify vulnerabilities in systems.
Answer:
B. Pre-made software or scripts they do not fully understand.
Explanation:
Correct Answer: Script Kiddies lack technical knowledge and rely on pre-made tools and scripts to perform attacks.
Incorrect Options:
A: Custom-built malware is typically used by advanced threat actors.
C: Government-funded tools are used by nation-state actors.
D: Manual techniques require technical expertise, which script kiddies lack.
Who is classified as an Unskilled Attacker (Script Kiddie)?
A. An attacker who creates advanced hacking tools for targeted attacks.
B. An individual who lacks the technical knowledge to develop their own hacking tools and relies on pre-made scripts.
C. A nation-state actor carrying out sophisticated cyber espionage.
D. A professional hacker who develops exploits for ethical purposes.
Answer:
B. An individual who lacks the technical knowledge to develop their own hacking tools and relies on pre-made scripts.
Explanation:
Correct Answer: Script Kiddies are unskilled attackers who depend on tools and scripts developed by others due to their lack of technical expertise.
Incorrect Options:
A: Developing advanced hacking tools requires technical expertise, which unskilled attackers lack.
C: Nation-state actors are highly skilled and do not fit the description of unskilled attackers.
D: Professional hackers often have technical expertise and are not classified as script kiddies.
What is a common method used by unskilled attackers to cause damage?
A. Launching sophisticated malware that evades detection.
B. Deploying a Distributed Denial of Service (DDoS) attack by using pre-made tools.
C. Exploiting zero-day vulnerabilities with custom scripts.
D. Hacking into critical systems using advanced programming techniques.
Answer:
B. Deploying a Distributed Denial of Service (DDoS) attack by using pre-made tools.
Explanation:
Correct Answer: Unskilled attackers often rely on simple tools that allow them to launch DDoS attacks by entering a target’s IP address and clicking a button.
Incorrect Options:
A: Launching sophisticated malware requires advanced skills that unskilled attackers lack.
C: Exploiting zero-day vulnerabilities involves technical expertise beyond the capacity of unskilled attackers.
D: Advanced programming techniques are used by skilled attackers, not script kiddies.
Why are unskilled attackers considered a threat despite their lack of technical expertise?
A. They can easily exploit complex vulnerabilities.
B. They use pre-made tools to execute damaging attacks like DDoS.
C. They are often government-sponsored actors with high funding.
D. They have insider access to sensitive organizational data.
Answer:
B. They use pre-made tools to execute damaging attacks like DDoS.
Explanation:
Correct Answer: Even without technical expertise, unskilled attackers can cause significant harm by using easy-to-operate tools, such as launching DDoS attacks.
Incorrect Options:
A: Exploiting complex vulnerabilities requires advanced skills that unskilled attackers do not have.
C: Government-sponsored actors are typically skilled and well-resourced, unlike script kiddies.
D: Insider threats involve internal access, which is unrelated to unskilled attackers.
What is the role of pre-made tools in enabling unskilled attackers?
A. They allow attackers to develop their own sophisticated exploits.
B. They eliminate the need for technical knowledge to launch attacks.
C. They restrict attackers to ethical hacking activities only.
D. They are ineffective in causing any significant damage.
Answer:
B. They eliminate the need for technical knowledge to launch attacks.
Explanation:
Correct Answer: Pre-made tools are designed to be user-friendly, enabling unskilled attackers to carry out damaging attacks, such as DDoS, without requiring technical expertise.
Incorrect Options:
A: Pre-made tools are used to execute attacks, not to develop new exploits.
C: Pre-made tools can be used for malicious purposes, not just ethical hacking.
D: These tools can cause significant damage, particularly in large-scale attacks like DDoS.
How do unskilled attackers initiate a Distributed Denial of Service (DDoS) attack?
A. By creating custom scripts to target multiple systems simultaneously.
B. By exploiting vulnerabilities in a network’s infrastructure.
C. By entering the target’s IP address into a pre-made tool and clicking a button.
D. By using insider knowledge to disrupt the target’s network.
Answer:
C. By entering the target’s IP address into a pre-made tool and clicking a button.
Explanation:
Correct Answer: Unskilled attackers use pre-made DDoS tools that simplify the attack process, requiring minimal effort or expertise.
Incorrect Options:
A: Developing custom scripts is beyond the capability of unskilled attackers.
B: Exploiting vulnerabilities requires technical knowledge that unskilled attackers do not have.
D: Insider knowledge pertains to internal threats, not external unskilled attackers.
Who are Hacktivists?
A. Individuals who hack into systems for financial gain.
B. Individuals or groups who use their technical skills to promote a cause or drive social change.
C. Professionals hired to improve cybersecurity by ethical hacking.
D. Nation-state actors conducting cyber espionage.
Answer:
B. Individuals or groups who use their technical skills to promote a cause or drive social change.
Explanation:
Correct Answer: Hacktivists are ideologically driven and aim to advance political or social causes rather than seeking personal or financial gain.
Incorrect Options:
A: Hacktivists are not motivated by financial gain; this aligns more with cybercriminals.
C: Ethical hackers aim to improve security, not promote social or political causes.
D: Nation-state actors are typically motivated by geopolitical goals, not ideological activism.
What is Hacktivism?
A. The use of hacking techniques to improve an organization’s cybersecurity.
B. Activities involving hacking to promote or advance a political or social cause.
C. Coordinated cyberattacks by government agencies to disrupt rival nations.
D. Developing tools and software to detect malware.
Answer:
B. Activities involving hacking to promote or advance a political or social cause.
Explanation:
Correct Answer: Hacktivism involves using hacking techniques as a form of protest or activism to advance ideological beliefs.
Incorrect Options:
A: Hacktivism is not about improving cybersecurity.
C: This describes nation-state actions, not hacktivism.
D: Tool development is unrelated to hacktivism’s goal of promoting social or political change.
Which of the following is NOT a technique commonly used by hacktivists?
A. Website defacement.
B. Distributed Denial of Service (DDoS) attacks.
C. Phishing campaigns for financial theft.
D. Public release of sensitive data (doxing or leaks).
Answer:
C. Phishing campaigns for financial theft.
Explanation:
Correct Answer: Hacktivists are ideologically motivated and do not seek financial gain, making phishing for theft irrelevant to their activities.
Incorrect Options:
A: Website defacement is a common tactic used as a form of electronic graffiti.
B: DDoS attacks are often used by hacktivists to disrupt services.
D: Doxing and leaking sensitive data are classic methods hacktivists employ to expose wrongdoing.
What motivates hacktivists?
A. Financial gain through ransomware or data theft.
B. Ideological beliefs and the desire to promote social or political change.
C. Revenge against personal or professional adversaries.
D. Spying on governments for sensitive information.
Answer:
B. Ideological beliefs and the desire to promote social or political change.
Explanation:
Correct Answer: Hacktivists are primarily driven by their beliefs, aiming to address social, political, or ethical issues.
Incorrect Options:
A: Financial gain is not their objective.
C: Revenge is more aligned with insider threats, not hacktivism.
D: Espionage is typically associated with nation-state actors, not hacktivists.
