Which factor most significantly complicates the attribution of a cyber campaign to a specific threat actor?

The fact that all threat actors are equally skilled and use identical techniques

The ability of threat actors to operate through compromised infrastructure and to mimic the tactics of other actors

The use of publicly available penetration testing tools that are also used by legitimate security professionals

The lack of any technical indicators that could be used to link the campaign to an actor

A threat intelligence team is analyzing a campaign that uses a custom malware family. The malware contains Russian-language strings, and the C2 infrastructure is hosted in Russia. However, the malware also uses a code-signing certificate stolen from a Ukrainian software company, and the campaign's phishing emails are written in fluent Ukrainian. The team is considering attributing the campaign to a Russian-speaking actor. What is the most important consideration before making this attribution?

The Ukrainian phishing language and stolen certificate suggest the actor is Ukrainian, so the attribution should be to a Ukrainian actor

The conflicting indicators require careful evaluation of the strength and corroboration of each piece of evidence before assigning attribution confidence

The campaign should be attributed to the actor with the most resources, as sophisticated campaigns are usually state-sponsored

The Russian-language strings and Russian C2 infrastructure are strong indicators that the actor is based in Russia

Why is attributing a cyber threat campaign to a specific threat actor often challenging?

Because attribution is always based on definitive technical evidence that leaves no room for doubt

Because threat actors frequently reuse the same infrastructure and tools, making it easy to identify them

Because threat actors may deliberately use false flags, shared tools, and infrastructure that obscure their true identity

Because threat actors are typically state-sponsored and therefore always operate under their own national flag

GIAC Cyber Threat Intelligence

Domain 5Objective 2

Campaigns and Attribution GCTI Practice Questions (Page 2)

Part of the Advanced Analysis Techniques domain, which makes up ~20% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 180-minute exam (~70–120 total, ~14–24 in this domain), expect 7–12 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

8concepts

Questions 6–10

6foundation · easy
Which factor most significantly complicates the attribution of a cyber campaign to a specific threat actor?
Select an answer first
7expert · hard
A threat intelligence team is analyzing a campaign that uses a custom malware family. The malware contains Russian-language strings, and the C2 infrastructure is hosted in Russia. However, the malware also uses a code-signing certificate stolen from a Ukrainian software company, and the campaign's phishing emails are written in fluent Ukrainian. The team is considering attributing the campaign to a Russian-speaking actor. What is the most important consideration before making this attribution?
Select an answer first
8foundation · easy
Why is attributing a cyber threat campaign to a specific threat actor often challenging?
Select an answer first
9foundation · easy
Which type of attribution focuses on the unique tools, malware, and infrastructure used by a threat actor?
Select an answer first
10foundation · easy
During which stage of a campaign lifecycle would an adversary likely use a watering-hole attack to compromise a website that the target population frequently visits?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCTI

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCTI” is a trademark of its owner, used for identification only.

Campaigns and Attribution GCTI Practice Questions (Page 2)

Questions 6–10

Which factor most significantly complicates the attribution of a cyber campaign to a specific threat actor?

Why is attributing a cyber threat campaign to a specific threat actor often challenging?

Which type of attribution focuses on the unique tools, malware, and infrastructure used by a threat actor?

During which stage of a campaign lifecycle would an adversary likely use a watering-hole attack to compromise a website that the target population frequently visits?

Keep studying — Advanced Analysis Techniques