Threat Prioritization, Actor Profiling, and Attribution TIE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of evidence is most commonly used as a technical indicator for attributing a cyber incident to a specific threat actor?

   • AThe victim's industry
   • BThe time of day the attack occurred
   • CMalware hash values
   • DThe attacker's presumed language
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A threat intelligence team has been tracking a group that initially targeted government agencies. Over the past year, the group has shifted to targeting healthcare organizations and has started using ransomware instead of data exfiltration. The malware code still shares a common framework with the original group's tools. How should the team update their tracking?

   • AMerge the group with another ransomware group because they now use ransomware
   • BStop tracking the group because they are no longer a threat to the original sector
   • CKeep the same actor profile but update it with the new targeting and TTPs
   • DCreate a new actor profile because the targeting and motivation changed
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which characteristic is most commonly used to describe a threat actor's motivation?

   • AFinancial gain
   • BIP address
   • CEncryption algorithm
   • DMalware family
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst observes a series of intrusions targeting a defense contractor. The attacker uses custom malware, operates during business hours in the target's timezone, and exfiltrates engineering blueprints rather than encrypting files for ransom. Which actor profile best matches these observations?

   • AA financially motivated cybercriminal group seeking quick ransomware payouts
   • BA hacktivist collective aiming to expose corporate secrets
   • CAn insider threat with physical access to the facility
   • DA state-sponsored advanced persistent threat (APT) group focused on intellectual property theft
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A manufacturing company discovers a ransomware attack that encrypted files on its engineering workstations. The malware uses a rare wiper-like module and the ransom note demands payment in a cryptocurrency wallet that has never been seen before. The company's threat intelligence team must profile the likely actor to guide response. Which actor characteristic is most useful for prioritizing defensive actions?

   • AThe actor's choice of cryptocurrency exchange, because it determines the exact wallet owner.
   • BThe actor's likely motivation, because it indicates whether the primary goal is financial gain or disruption.
   • CThe actor's malware development language, because it reveals the specific programming skills of the group.
   • DThe actor's preferred time of day for attacks, because it reveals their geographic location.
   Reveal Solution Discussion Select an answer first