Campaigns and Attribution GCTI Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is an example of an operational pattern that can be used to profile a threat actor?

   • AThe actor's use of a specific domain registrar
   • BThe actor's consistent use of a particular time of day for their attacks
   • CThe actor's choice of encryption algorithm for their C2 traffic
   • DThe actor's use of a specific programming language in their malware
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   An analyst is investigating a campaign that appears to be the work of a known state-sponsored group. The malware used in the campaign contains code that is nearly identical to a tool previously attributed to that group, but the code has been modified to include comments in a different language. Additionally, the C2 infrastructure is registered in a country that is a known rival of the suspected group's sponsor. The analyst is considering whether this is a false flag operation. What is the most appropriate analytical approach?

   • AEvaluate the totality of evidence, including the code similarities, language changes, and infrastructure, while considering the possibility of deliberate deception
   • BConclude that the campaign is a false flag because the rival country's infrastructure is a strong indicator
   • CConclude that the campaign is not a false flag because the malware code is nearly identical to the known group's tool
   • DReport the campaign as a false flag with high confidence because the language changes are a clear sign of deception
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An intelligence team is attributing a campaign to a known APT group. The malware uses a rare obfuscation technique previously seen only in that group's tools, but the campaign also uses infrastructure hosted in a country that is a known rival of the group's suspected sponsor. The team must decide how to weigh this evidence. What is the most appropriate analytical approach?

   • ATreat the rare technique as strong technical evidence but consider the possibility of a false flag using the rival's infrastructure.
   • BAttribute the campaign to the rival country because the infrastructure is located there.
   • CConclude that the rare technique is a coincidence and attribute to an unrelated actor.
   • DDismiss the rare technique because the infrastructure location is more reliable for attribution.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which characteristic is most commonly used to profile a threat actor's motivation?

   • AThe specific malware families they use
   • BThe types of targets they choose to attack
   • CThe number of zero-day vulnerabilities they use
   • DThe time zone from which they operate
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a false flag operation in the context of cyber threat attribution?

   • AAn operation that is falsely attributed to a threat actor by the media
   • BAn operation where the threat actor deliberately uses techniques and indicators to make it appear that another actor is responsible
   • CAn operation that uses a fake flag on a command-and-control server
   • DAn operation that is conducted by a state actor but denies involvement
   Reveal Solution Discussion Select an answer first