Threat Actors / Agents CCOA Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   A hacktivist group launches a distributed denial-of-service (DDoS) attack against a corporation's website, making it unavailable to customers. What is the primary intention of this attack?

   • AEspionage
   • BData theft
   • CFinancial gain
   • DService disruption
   Reveal Solution Discussion Select an answer first
2. 12foundation · medium

   A disgruntled employee who deliberately deletes critical company data after being passed over for a promotion is primarily motivated by which factor?

   • AIdeology
   • BFinancial gain
   • CEspionage
   • DRevenge
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An organization detects a breach where the attacker used a known vulnerability in a web application, but the attack was highly targeted and the attacker exfiltrated a specific set of sensitive documents. The tools used were publicly available, but the attacker's operational security was excellent, using VPNs and encrypted communications. Which assessment of the threat actor's capability is most accurate?

   • AHigh capability because they used a zero-day exploit
   • BLow capability because they did not maintain persistence
   • CModerate to high capability because of the targeted nature and good OPSEC
   • DLow capability because they used publicly available tools
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's public-facing website is defaced with a message protesting its environmental policies. The attacker used a known vulnerability in the web server and left a signature typical of a known hacktivist group. The company's internal systems were not accessed. What is the primary intention of this threat actor?

   • AReputational damage
   • BFinancial gain
   • CService disruption
   • DData theft
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An incident responder is analyzing a breach where the attacker used a known vulnerability, but the attack was highly targeted and the attacker exfiltrated a specific set of sensitive documents. The tools used were publicly available, but the attacker's operational security was excellent, using VPNs and encrypted communications. Which assessment of the threat actor's capability is most accurate?

   • ALow capability because they did not maintain persistence
   • BHigh capability because they used a zero-day exploit
   • CModerate to high capability because of the targeted nature and good OPSEC
   • DLow capability because they used publicly available tools
   Reveal Solution Discussion Select an answer first