Cyber Security Quiz: Threat Actor Types
10 questions · exam conditions
0:00
Threat Actor TypesQuestion 1 of 10

A database administrator uses approved privileged access to disable monitoring temporarily and install cryptocurrency-mining software on company servers. The administrator keeps the proceeds and restores monitoring before the next shift.

Under a threat actor taxonomy based primarily on the actor's relationship to the victim, which classification is most appropriate?

Criminal, because personal financial gain is the administrator's primary motivation
Nation-state, because disabling monitoring indicates advanced operational security
Insider, because trusted access is deliberately abused for an unauthorized purpose
Hacktivist, because company computing resources are used without organizational consent
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Threat Actor Types

Practice Threat Actor Types in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Threat Actor Types, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A database administrator uses approved privileged access to disable monitoring temporarily and install cryptocurrency-mining software on company servers. The administrator keeps the proceeds and restores monitoring before the next shift.

Under a threat actor taxonomy based primarily on the actor's relationship to the victim, which classification is most appropriate?

  1. Criminal, because personal financial gain is the administrator's primary motivation
  2. Nation-state, because disabling monitoring indicates advanced operational security
  3. Insider, because trusted access is deliberately abused for an unauthorized purpose (correct answer)
  4. Hacktivist, because company computing resources are used without organizational consent
Explanation: When threat actor taxonomies are built around the actor's relationship to the victim — rather than motivation or capability — the defining question is: does this person have legitimate, trusted access to the target environment? Keep that lens in mind whenever a question specifies "relationship-based" classification. Here, the database administrator holds approved credentials, works inside the organization's infrastructure, and exploits that position of trust to install unauthorized software. That profile is the textbook definition of an insider threat — someone whose legitimate access is weaponized for unauthorized purposes. The classification is earned by who they are to the organization, not what they want. Answer C is correct. Answer A is the most tempting distractor. Financial gain is indeed the administrator's motive, and "criminal" is a valid descriptor in motivation-based taxonomies. But the question explicitly anchors the taxonomy to relationship, not intent. Motive and relationship are separate axes — mixing them is exactly the trap this question is setting. Answer B is straightforwardly wrong. Disabling monitoring is operational security hygiene, not evidence of nation-state affiliation. Nation-state actors are defined by government sponsorship, not by any particular technical technique. Answer D misapplies "hacktivist." Hacktivists are motivated by ideology, political protest, or social causes — using company servers for personal profit is the opposite of that profile. Lack of organizational consent is a feature of many threat actor types, not a distinguishing marker of hacktivism. Study tip: On taxonomy questions, always identify which axis the question is testing — motivation, relationship, capability, or resources. The right answer can shift dramatically depending on which dimension is specified.

Question 2

One group compromises an energy company's remote-access gateway and advertises the access on a private marketplace. A second group purchases the access and uses it to steal engineering plans that match a foreign government's documented strategic priorities. The first group sells access to many unrelated buyers.

What is the most accurate way to classify the actors in this incident?

  1. The first is criminal, while the second is likely nation-state based on its collection objective (correct answer)
  2. Both groups are criminal actors because payment occurred between the two groups
  3. Both groups are nation-state actors because the final target has strategic importance
  4. The first is insider, while the second is hacktivist based on its policy-related target
Explanation: Threat actor attribution in cybersecurity relies on motivation and behavior, not just the mechanics of how groups interact. When classifying actors, you should ask: What is each group trying to achieve, and does that objective align with criminal profit or state-level strategic interests? The first group behaves like a classic Initial Access Broker (IAB) — a criminal actor that compromises systems and sells that access indiscriminately to multiple buyers for financial gain. There's no selective targeting, no strategic objective — just monetization. The second group, however, purchases access specifically to steal engineering plans tied to a foreign government's documented priorities. That collection objective — aligning stolen intelligence with state strategy — is the defining hallmark of a nation-state or state-sponsored actor. Answer A correctly recognizes that these two groups operate under fundamentally different motivations and should be classified independently. Answer B is a common trap: it assumes that because money changed hands, both groups must be criminal. Payment is a mechanism, not a motive. Nation-state actors routinely use criminal proxies and purchase illicit services without losing their state-sponsored classification. Answer C overcorrects in the other direction — assuming strategic importance of the target makes both groups nation-state actors. The first group didn't know or care about the target's significance; they sold access broadly. Answer D is simply unsupported — nothing in the passage suggests an insider threat or a hacktivist agenda (hacktivists are ideologically motivated and typically don't pay for access to pursue policy goals quietly). Your study tip: always classify actors by their own objectives and behaviors, not by who they interact with or what the final target happens to be.

Question 3

A procurement employee regularly exports supplier records as part of an assigned job. In exchange for payment, the employee begins inserting a hidden account into each export and sends the files to an external fraud ring. The ring uses the information to create false invoices.

Which classification best represents the threat actors involved?

  1. A criminal actor only, because financial fraud is the ultimate purpose of the scheme
  2. An insider only, because the data leaves through an employee's approved workflow
  3. A nation-state and an insider, because supplier information can affect critical operations
  4. A malicious insider collaborating with external criminal actors for financial gain (correct answer)
Explanation: When classifying threat actors in cybersecurity, you need to identify every party involved in a threat scenario and their roles — not just the most visible actor or the ultimate goal. Threat actor taxonomy distinguishes between insiders (those with legitimate access) and external actors (those outside the organization), and real-world attacks frequently involve both working in concert. Here, two distinct threat actors are operating simultaneously: the procurement employee, who abuses legitimate access to export and manipulate supplier records, and the external fraud ring, which receives stolen data and monetizes it through false invoices. That combination makes D the correct answer — a malicious insider collaborating with external criminal actors for financial gain. This precisely captures both parties, their relationship, and their motive. A is wrong because labeling only a "criminal actor" erases the insider from the picture entirely. The fraud ring couldn't operate without the employee's insider access — you can't ignore that half of the threat. B makes the opposite error: calling it an insider threat only overlooks the external fraud ring, which is an independent criminal organization receiving and exploiting the data. The threat doesn't end at the export. C introduces nation-state actors, which have no basis in the scenario. Nation-state threats are characterized by government sponsorship and geopolitical motives — nothing in this passage suggests either. Supplier records being operationally sensitive doesn't automatically elevate a fraud scheme to nation-state activity. Your study tip: when a scenario describes multiple parties working together, your answer must account for all of them. Distractors that name only one actor are almost always traps designed to test whether you read the full scenario carefully.

Question 4

A payroll specialist's valid account is used at 3:00 a.m. to change employee direct-deposit information. Logs show that the account was accessed from an unfamiliar device shortly after the specialist entered credentials into a counterfeit sign-in page. The specialist did not approve or benefit from the changes.

How should the actor responsible for the fraudulent changes be classified?

  1. Insider, because the changes were performed through a valid employee account
  2. Criminal, because an external actor stole credentials to redirect funds (correct answer)
  3. Nation-state, because the actor successfully bypassed normal authentication controls
  4. Hacktivist, because payroll changes can disrupt confidence in the organization
Explanation: When classifying a threat actor, focus on motivation, origin, and method — not just which account was used to carry out the attack. The scenario describes a classic credential theft via phishing (a counterfeit sign-in page), followed by unauthorized access from an external, unfamiliar device. That combination tells you everything you need to identify the actor type. The responsible party is best classified as a criminal (B). An outside actor socially engineered the specialist, harvested her credentials, and redirected funds for financial gain. The defining traits — external origin, phishing technique, and profit motive — align squarely with cybercriminal classification. Choice A is the most tempting trap. Yes, a valid account was used, but "insider threat" requires the malicious actor to be an insider — someone with legitimate organizational access. The payroll specialist was a victim, not the threat actor. Using a stolen credential doesn't make the attacker an insider any more than stealing a house key makes someone a resident. Choice C incorrectly applies nation-state classification. Nation-state actors are distinguished by their government sponsorship and geopolitical objectives — not simply by technical sophistication or bypassing authentication. Nothing in the scenario suggests state-level resources or strategic intent. Choice D misapplies "hacktivist." Hacktivists are motivated by ideology or political causes, and their attacks are typically meant to send a public message. Redirecting payroll deposits for personal financial gain is the opposite of ideological activism. As a study strategy: always ask who is the actor and what do they want? Threat actor classification depends on origin and motive — not the tools or accounts they happen to exploit.

Question 5

A group was originally known for public website defacements supporting environmental causes. Two years later, investigators link the same operators to a campaign that quietly encrypts unrelated small businesses, negotiates payments privately, and provides discounts for rapid cryptocurrency payment. The new campaign contains no environmental messaging.

How should the new campaign be classified?

  1. Hacktivist, because an actor's established ideology determines all later campaign classifications
  2. Criminal, because the current campaign's behavior and objective are financial extortion (correct answer)
  3. Nation-state, because changing tactics and concealing motives indicate organized sponsorship
  4. Insider, because repeated access to small businesses implies abuse of trusted credentials
Explanation: When classifying a threat actor or campaign, cybersecurity frameworks focus on current behavior and objective — not historical identity. The same operators can shift from one threat category to another depending on what they are actually doing in a given campaign. In this scenario, the new campaign exhibits every hallmark of cybercrime: unauthorized encryption of victim systems (ransomware), private negotiation for payment, and cryptocurrency discounts for quick settlement. These are financial extortion behaviors, which firmly place this campaign in the criminal category. B is correct. A is wrong because actor classification is not permanently locked to an established ideology. Hacktivism is defined by campaigns driven by political or social messaging — once that element disappears and profit-seeking replaces it, the classification changes. Applying an old label to new behavior is a common exam trap. C is wrong because changing tactics and concealing motives alone do not indicate nation-state sponsorship. Nation-state actors are characterized by government affiliation, geopolitical objectives, and often significant resources — none of which are evidenced here. Sophistication or secrecy is insufficient to make that determination. D is wrong because "insider threat" requires abuse of legitimate, trusted access within an organization. Ransomware operators targeting small businesses externally are not insiders — they are external criminals. Repeated targeting across multiple victims does not imply internal credentials. Study tip: On threat actor classification questions, always ask: What is the current campaign actually doing, and who benefits? Behavior and motive in the present tense determine the label — historical affiliations are context, not classification criteria.

Question 6

An intrusion group encrypts systems at several regional hospitals, exfiltrates patient records, and provides each victim with a cryptocurrency payment portal. The malware avoids systems configured with certain regional language settings, and the victims are located in a country that is involved in a diplomatic dispute with that region.

Which threat actor classification is most defensible based on the available evidence?

  1. Nation-state, because the targeting and language exclusions establish a geopolitical objective
  2. Criminal, because the operation has repeatable extortion and payment mechanisms (correct answer)
  3. Hacktivist, because hospitals are visible targets during an international dispute
  4. Insider, because patient records generally require privileged access to obtain
Explanation: When classifying threat actors, focus on primary observable behaviors rather than circumstantial context. The strongest classification comes from what you can directly attribute to the operation, not what the surrounding environment might suggest. The operation here has three concrete, operationally consistent features: encrypted systems (ransomware deployment), exfiltrated patient records (data theft), and a dedicated cryptocurrency payment portal (monetization infrastructure). These aren't incidental — they form a repeatable, revenue-generating extortion model. Criminal groups build and reuse this infrastructure precisely because it scales. The answer is B, because the business logic of the attack is the most direct and falsifiable evidence available. A is the most tempting distractor. Language exclusions and geopolitical timing can indicate nation-state activity, but they're also a known criminal tactic — ransomware groups exclude certain regions to avoid prosecution in friendly jurisdictions. Geopolitical coincidence doesn't override direct operational evidence of a profit motive. You'd need additional indicators (zero-days, persistent access, no actual ransom demand) to make a nation-state case defensible. C fails because hacktivists typically seek visibility and disruption, not payment. Running a cryptocurrency portal contradicts the hacktivist profile — they want attention, not profit. D is a logical leap. Patient records requiring privileged access doesn't implicate an insider; ransomware operators routinely use credential harvesting and lateral movement to reach sensitive data from outside. Study tip: On threat actor classification questions, always ask "what does the attacker gain?" Financial infrastructure points to criminal; suppressed disruption with no ransom points to nation-state or hacktivist. Follow the incentive structure first.

Question 7

After a political organization publicly defaces a foreign ministry's website, investigators discover that the same intrusion infrastructure had maintained quiet access to the ministry for nine months. During that period, the operators searched for unpublished negotiation positions and copied diplomatic communications. The defacement displayed the political organization's slogan.

Which assessment best accounts for both the public claim and the observed behavior?

  1. The actor is most likely hacktivist because the defacement displayed an ideological slogan
  2. The actor is most likely criminal because stolen diplomatic material can be sold
  3. The actor is most likely nation-state because prolonged access supported strategic intelligence collection (correct answer)
  4. The actor is most likely insider because the intrusion remained undetected for nine months
Explanation: When attributing a cyberattack to a threat actor category, you should look beyond the surface behavior and examine the full operational pattern — motive, capability, and tradecraft together tell a more complete story than any single indicator. Here, the nine months of quiet, targeted intelligence collection against a foreign ministry is the most telling detail. Nation-state actors prioritize long-term, low-and-slow access specifically to harvest strategic intelligence — unpublished negotiation positions and diplomatic communications are exactly the kind of material that serves a government's geopolitical interests. The defacement at the end looks like a deliberate "burn" of the operation, possibly timed for political messaging after the valuable intelligence had already been extracted. That combination — patient espionage followed by a public political act — is a hallmark of sophisticated state-sponsored operations. Answer C correctly weighs the dominant behavior. Answer A is the classic trap here. Seeing an ideological slogan and jumping to "hacktivist" is exactly the surface-level reasoning this question is testing you to avoid. True hacktivists rarely maintain covert, disciplined access for nine months; their operations tend to be loud and short. Answer B is plausible in isolation — stolen diplomatic cables do have black-market value — but criminal actors focus on monetizable data like financial credentials or PII, not negotiation positions that are only useful to a rival government. Answer D confuses a capability indicator with an actor type. Staying undetected for nine months reflects operational sophistication, not insider access specifically; nation-state groups routinely achieve this from outside. On threat attribution questions, train yourself to weight sustained, targeted, strategically coherent behavior over isolated surface signals like slogans or dwell time alone.

Question 8

Attackers compromise a widely used software update service and deploy a remote-access tool to selected government research offices. Although the tool contains a ransom-note feature copied from public code, the attackers never enable encryption, request payment, or contact victims. They instead search for files related to advanced propulsion research.

Which feature most strongly supports classifying the operation as nation-state activity rather than criminal activity?

  1. The remote-access tool includes a ransom-note feature obtained from public code
  2. The attackers compromise software used by more than one government office
  3. The attackers selectively collect strategically valuable research without monetizing access (correct answer)
  4. The attackers use an update service rather than sending ordinary phishing messages
Explanation: When classifying a cyber operation as nation-state versus criminal, the single most important question to ask is: what does the attacker actually want? Criminal groups are motivated by financial gain — ransomware, data theft for resale, fraud. Nation-state actors are motivated by strategic advantage — intelligence collection, espionage, disruption of adversaries. The attacker's behavior with access reveals that motivation more clearly than any technical tool choice. That's why C is the strongest indicator. The attackers had everything needed to execute a ransomware attack — they even copied a ransom-note feature — but they never used it. Instead, they quietly searched for advanced propulsion research. That combination of ignoring money while targeting classified technical intelligence is a hallmark of state-sponsored espionage. No criminal organization walks away from a monetizable intrusion to collect aerospace data with zero financial payoff. A is a trap because using public or borrowed code is actually common among nation-state groups — it provides plausible deniability and reduces development costs. The presence of ransomware code tells you nothing about intent when it's never activated. B is also insufficient on its own; compromising multiple government offices shows operational scope but doesn't distinguish a sophisticated criminal gang from a state actor. D describes a supply-chain attack, which is a sophisticated technique favored by nation-states, but criminals also abuse update mechanisms. Technique sophistication alone doesn't confirm attribution. Study tip: On attribution questions, prioritize motive and target selection over technique or tools used. The "why" of an operation is almost always the strongest indicator of who is behind it.

Question 9

Analysts are evaluating whether a campaign is sponsored by a particular foreign government. Available observations include malware comments written in that country's language, activity during that country's normal business hours, infrastructure rented from a provider in that country, and repeated collection matching the government's nonpublic military planning needs.

Which observation should receive the greatest weight in the actor-type assessment?

  1. The malware comments, because developers ordinarily write notes in their native language and embedding a foreign script requires deliberate effort
  2. The activity schedule, because government-sponsored operators are generally expected to work during standard office hours in their home time zone
  3. The hosting location, because state actors typically prefer domestic infrastructure to retain operational control and reduce jurisdictional exposure
  4. The collection pattern, because repeated acquisition of material tied to nonpublic military planning needs indicates that the operation is fulfilling a specific strategic intelligence requirement (correct answer)
Explanation: When attributing a cyber operation to a nation-state actor, analysts use a framework called the Diamond Model or broader attribution methodology that weighs indicators by how difficult they are to fake and how directly they reveal intent. The key question isn't just "who did this?" but "why does this pattern of behavior point to a state sponsor with specific goals?" That distinction makes intent and purpose the most powerful evidence. D is correct because the collection pattern — repeatedly targeting material tied to nonpublic military planning needs — demonstrates that the operation is satisfying a specific, informed intelligence requirement. Only an actor with prior knowledge of what that government needs strategically would know what to collect. This transforms the evidence from circumstantial to purposive: it shows mission alignment, not just geographic proximity. A is tempting but weak. Malware comments in a target language are trivially planted as a false flag — any sophisticated actor can add foreign-language strings. This is a well-known deception technique, so analysts discount it heavily. B falls into a similar trap. Work-hour patterns are easy to fabricate by simply scheduling operations during specific windows. Sophisticated state actors routinely operate outside business hours or use automated tooling, making this unreliable. C is similarly dismissible. Infrastructure location is one of the easiest attributes to spoof — actors routinely rent servers across jurisdictions precisely to create misleading attribution trails. Study tip: On attribution questions, always ask which indicator reveals intent and knowledge versus which can be easily faked. Operational purpose — especially matching nonpublic requirements — is hardest to fabricate and carries the most analytical weight.

Question 10

A loose online collective announces a campaign against companies that enforce a controversial content policy. Volunteers are invited to participate, targeted websites are disrupted, internal emails are published to embarrass executives, and campaign messages repeatedly demand reversal of the policy. Investigators find no payment requests.

Which actor type best fits the collective's primary motivation and operating model?

  1. Hacktivist, because public cyber actions are used to advance an ideological demand (correct answer)
  2. Criminal, because publishing internal emails involves unauthorized acquisition of data
  3. Nation-state, because coordinated disruption can influence public policy decisions
  4. Insider, because internal messages could only have been obtained by an employee
Explanation: When classifying threat actors, focus on two things simultaneously: primary motivation and operating model. Motivation answers why they act; operating model answers how they're organized and what they want in return. The collective here checks every box for a hacktivist group. Their actions — disrupting websites, leaking embarrassing emails, and issuing public demands — are all in service of an ideological goal: reversing a content policy. There's no financial gain sought, no government direction, and no hidden agenda. The absence of payment requests is a critical signal that separates hacktivism from cybercrime. Answer A is correct because the group uses public, disruptive cyber actions as a form of protest to pressure a target into a policy change. Answer B is tempting because publishing internal emails does involve unauthorized data access — and that's technically illegal. But legality doesn't determine actor type; motivation does. Criminals pursue financial gain or personal profit. This group is pursuing ideological change, so labeling them criminal misidentifies their core driver. Answer C fails because nation-state actors operate with government backing, significant resources, and geopolitical objectives. A loose volunteer collective with no funding or state sponsorship simply doesn't fit that profile, even if their disruption happens to influence public debate. Answer D makes a logical error. Insider threats require the actor to have legitimate access to the targeted organization. The passage says emails were published — not that they were necessarily stolen by an employee. Hacktivists frequently obtain data through external intrusion. Study tip: On threat actor questions, always identify motivation first, then verify the operating model matches. Don't let the method of an attack override the why behind it.