Which threat best describes malware that encrypts user files and demands cryptocurrency payment to restore access?

A self-replicating program is spreading across the network without user interaction.

An employee downloads a free “video-player” app that secretly installs a backdoor.

During an incident investigation, analysts find malware that replaced system drivers to hide its presence at the kernel level.

A disgruntled developer embeds code that erases databases if their user account is disabled.

Which of the following is usually unwanted but not directly malicious, often pre-installed trial software that slows devices?

A cyber-criminal floods a web server with traffic from thousands of compromised IoT devices, causing it to crash.

What distinguishes an Advanced Persistent Threat (APT) from other attacks?

A partner company’s software update is compromised before release and installs malware at customers’ sites.

An attacker tricks an employee into revealing VPN credentials via a fake HR-portal email.

A CFO receives a spoofed email tailored with their name and internal details, requesting an urgent wire transfer.

Which threat actor is MOST commonly linked to espionage against critical infrastructure and usually backed by government resources?

A group launches cyber-attacks to protest environmental policies.

An entry-level attacker downloads free exploit scripts without understanding the code.

A data-center technician accidentally leaves default admin passwords on exposed servers, leading to a breach.

A former employee, angry about being fired, steals proprietary code before departure.

Which threat actor's main objective is monetary profit through ransomware, fraud, or credential theft?

A rival manufacturer conducts cyber-espionage to steal product-design blueprints.

Which actor type is typically motivated by mass disruption, fear, or destruction, sometimes combining cyber and physical tactics?

A covert group compromises a defense contractor’s email for long-term intelligence gathering.

Which motivator BEST explains ransomware gangs demanding cryptocurrency from hospitals?

A rival nation hacks research labs to steal vaccine formulas.

A hacktivist group defaces a government website to protest a new law.

A disgruntled ex-employee deploys a logic-bomb to delete files on their last day.

Which motivator is commonly associated with chaos-driven threat actors whose goal is to destabilize or disrupt services without financial gain?

A contractor introduces malware into a corporate network by plugging in an infected external USB drive.

An attacker exploits an insecure API of a cloud-storage provider to access private backups.

A user is lured to a fake banking site by clicking a link on social media and enters credentials.

An adversary breaks into the server room and installs a rogue device on the internal switch.

Attackers exploit an outdated plugin on a corporate blog to deploy malicious JavaScript to site visitors.

Hackers compromise a third-party component used in a company’s online-ordering platform to inject malware during checkout.

A café’s unencrypted public Wi-Fi allows an attacker to intercept session cookies from customers logging into webmail.

Which open-framework provides a knowledge base of adversary tactics, techniques, and procedures (TTPs) mapped to attack phases?

A security engineer checks the CVE database to see if a known exploit exists for a newly disclosed software bug.

The National Vulnerability Database (NVD) builds upon CVE by adding which key element?

A web-app developer checks the OWASP Top 10 list during code reviews.

Which resource enables machine-to-machine sharing of structured threat indicators between trusted partners?

Security analysts from multiple hospitals collaborate to share indicators of ransomware campaigns targeting healthcare.

A company relies on public tweets, blogs, and research forums to monitor new phishing domains.

Victims of cyber-fraud submit complaints to a federal agency that aggregates incidents for investigation.

A persistent threat actor installs a covert program allowing remote control of a victim’s workstation.

Which acronym refers to the triad of fundamental security objectives: protecting data from unauthorized disclosure, unauthorized change, and service disruption?

An organization deploys an IDS to monitor inbound packets and generate alerts on suspicious patterns but does not block them.

Security teams upgrade to an IPS to automatically drop malicious traffic identified in real-time.

The enterprise SOC operates 24/7 to triage SIEM alerts and coordinate incident response.

A web server is compromised via a malicious SQL statement embedded in a login field.

A malicious script is injected into a legitimate website’s comment section and executes in visitors’ browsers.

A university’s network is breached by attackers who publicly leak stolen research to protest animal-testing labs.

An intruder disrupts emergency-dispatch phone services just to cause panic during a local festival—no ransom demanded.

A new hire connects an infected personal USB to transfer résumé files, which unleashes ransomware onto the HR subnet.

A rival start-up pays a contractor to steal design schematics of a new electric-car battery.

A bank’s call-center PC was secretly infected after a customer-service rep clicked a fake email attachment; malware stayed dormant for weeks until triggered to delete logs. What type of malware was used?

Security cameras at a water-treatment plant go offline after highly sophisticated malware—undetected for months—exfiltrates plant-schematic data. What type of actor and threat was involved?

During a high-profile sporting event, attackers spread malicious shortened links on Twitter that redirect users to a credential-harvesting site. What vector was used for the attack?

A fired IT admin posts VPN passwords to a public forum to “teach the company a lesson.” What type of actor and motivator is involved?

An e-commerce site’s payment form allows attackers to inject a rogue SQL statement that steals customer credit-card data. What type of attack is this?

Imagine Aria and David have set up a small office network. What is the primary function of a firewall they installed to protect their network?

What is the main purpose of a firewall in network security?

What type of attack involves overwhelming network resources with unwanted traffic?