Examkin

Question

Difficulty: MediumThreat Actors, Attributes, and Attack Vectors

A security operations manager at an electric vehicle charging station network provider is categorizing recent security incidents and threat activity profiles. Match each observed incident scenario on the left with the threat actor attribute or vector on the right that primarily defines it.

  • A disciplined group uses undisclosed zero-day vulnerabilities in charging management firmware to maintain persistent access across power grid gateways over years without exfiltrating funds.Nation-state threat actor characterized by high sophistication, extensive funding, and long-term geopolitical stealth objectives.
  • A recently terminated database administrator uses active privileged administrative credentials to wipe system configuration databases.Insider threat characterized by pre-existing authorized access, grievance motivation, and low external entry requirements.
  • An activist group executes distributed denial-of-service (DDoS) attacks against public payment portals to protest energy pricing policies.Hacktivist group characterized by ideological motivation, public disruption goals, and variable technical capabilities.
  • An external party embeds malicious telemetry code into a widely used third-party open-source software library integrated into the mobile mobile charging app.Supply chain attack vector characterized by exploiting trusted third-party software components and dependencies.

Answer

Each security scenario correctly maps to its defining threat actor profile or vector based on motivation, sophistication, access method, and attack channel.
Threat actors and vectors are categorized by examining their motivation, level of sophistication, funding, intent, and entry mechanism. Persistent zero-day attacks without financial motives correspond to nation-state actors; post-termination credential abuse corresponds to insider threats; public policy protests via DDoS correspond to hacktivists; and open-source dependency tampering corresponds to supply chain attack vectors.

Step-by-Step Solution

1
Analyze the long-term zero-day firmware intrusion scenario.
Identify as a nation-state threat actor.
Nation-state actors possess significant resources required to develop zero-day exploits and maintain long-term covert persistence for geopolitical espionage.
2
Analyze the unauthorized data wiping by a terminated administrator.
Identify as an insider threat.
Insider threats involve individuals with authorized access or specialized knowledge of internal systems who misuse privileges due to personal grievance.
3
Analyze the payment portal denial-of-service attack associated with public policy protests.
Identify as a hacktivist group.
Hacktivists focus on disruption and publicity to bring attention to political, social, or environmental causes.
4
Analyze the malicious telemetry code embedded in an open-source library.
Identify as a supply chain attack vector.
Supply chain attack vectors target third-party components, libraries, or vendors to compromise downstream software applications implicitly trusting those sources.

Key Concept

Threat Actor Attributes, Motivations, and Attack Vectors
Rate this question

Topics

Threat Actors, Attributes, and Attack Vectors

More questions from this topic