Cyber Crimes MCQ 60 Tests With Answers (2026)
PerfectNotes TeamUpdated: March 2026~15 min practice 60 Questions · 3 Levels 60 Questions · 3 Levels
Cyber Crimes MCQ practice questions are essential for preparing for competitive exams, certifications, and technical interviews. This comprehensive MCQ platform provides 60 carefully curated practice questions covering cybercrime classification, attack techniques, dark web operations, ransomware ecosystems, identity theft methods, and the international legal frameworks — including the CFAA, Budapest Convention, and GDPR — designed to combat them.
These questions are organized into three progressive difficulty levels of 20 questions each: Basics (covering cybercrime definitions, threat actor types, identity theft, dark web, and cyberstalking), Concepts (covering chain of custody, Budapest Convention, CFAA, forensic imaging, cryptocurrency laundering, and Crime-as-a-Service), and Advanced (covering steganalysis, Tor attribution, timestomping, false flag operations, and supply-chain attacks). Each question includes a verified, in-depth explanation to reinforce learning.
Practice in Study Mode to reveal answers and detailed explanations instantly, or use Exam Mode for timed testing and real-time scoring to simulate CHFI, CEH, GCFE, and CISSP certification exam conditions.
Contents
- 1.Basics (20 Questions)Definitions · crime types · malware · social engineering
- 2.Concepts (20 Questions)Attack techniques · botnets · phishing · ransomware
- 3.Advanced (20 Questions)enterprise incidents · identity theft · dark web · investigation
- 4.Conclusionsummary · next steps · study tips
- 5.Key Takeawaysquick-fire bullet recap of essential facts
- 6.Quick Review Summaryconcept · definition · key fact table
- 7.FAQcommon questions answered
Cyber Crimes — Basics
1What constitutes the legal definition of "Cybercrime"?
CorrectC: Any criminal activity that involves a computer, networked device, or a network as either the target of the crime or the primary tool used to commit it
Cybercrime is broadly defined as any criminal activity in which a computer, network, or networked device is either the target of the crime or the instrument used to commit it. This definition encompasses attacks on computer systems themselves (e.g., hacking, malware), as well as traditional crimes facilitated by technology (e.g., online fraud, cyber stalking).
IncorrectC: Any criminal activity that involves a computer, networked device, or a network as either the target of the crime or the primary tool used to commit it
Cybercrime is broadly defined as any criminal activity in which a computer, network, or networked device is either the target of the crime or the instrument used to commit it. This definition encompasses attacks on computer systems themselves (e.g., hacking, malware), as well as traditional crimes facilitated by technology (e.g., online fraud, cyber stalking).
2Which term describes an individual who executes cyberattacks using pre-written hacking tools and scripts without actually understanding the underlying mechanics?
CorrectA: Script Kiddie
A "Script Kiddie" (or skiddie) is a low-skill threat actor who uses publicly available hacking tools, exploits, and scripts created by others without understanding how they work. They lack the technical expertise to develop their own attacks. Despite their unsophisticated methods, they can still cause significant harm.
IncorrectA: Script Kiddie
A "Script Kiddie" (or skiddie) is a low-skill threat actor who uses publicly available hacking tools, exploits, and scripts created by others without understanding how they work. They lack the technical expertise to develop their own attacks. Despite their unsophisticated methods, they can still cause significant harm.
3What is the primary motivation typically associated with an "Advanced Persistent Threat" (APT)?
CorrectD: Long-term, covert espionage and data exfiltration, often state-sponsored
An APT is a sophisticated, long-duration cyberattack — often state-sponsored — where the attacker gains unauthorized access and remains undetected for an extended period to stealthily exfiltrate data. APTs prioritize stealth over speed, targeting high-value assets like government agencies, defense contractors, and critical infrastructure. Examples include APT28 (Fancy Bear) and APT41.
IncorrectD: Long-term, covert espionage and data exfiltration, often state-sponsored
An APT is a sophisticated, long-duration cyberattack — often state-sponsored — where the attacker gains unauthorized access and remains undetected for an extended period to stealthily exfiltrate data. APTs prioritize stealth over speed, targeting high-value assets like government agencies, defense contractors, and critical infrastructure. Examples include APT28 (Fancy Bear) and APT41.
4Which of the following best defines "Cyber Extortion"?
CorrectB: A crime where an attacker demands money or assets under the threat of launching a cyberattack, such as ransomware or a DDoS attack
Cyber extortion is a crime in which a perpetrator threatens to carry out a damaging cyberattack — such as deploying ransomware to lock systems, launching a DDoS attack, or releasing sensitive stolen data — unless a ransom or other demands are met. It differs from plain ransomware (a tool) in that it is the broader criminal act of coercion using digital threats.
IncorrectB: A crime where an attacker demands money or assets under the threat of launching a cyberattack, such as ransomware or a DDoS attack
Cyber extortion is a crime in which a perpetrator threatens to carry out a damaging cyberattack — such as deploying ransomware to lock systems, launching a DDoS attack, or releasing sensitive stolen data — unless a ransom or other demands are met. It differs from plain ransomware (a tool) in that it is the broader criminal act of coercion using digital threats.
5What does the term "Hacktivism" refer to?
CorrectC: The use of hacking techniques to promote a political agenda, human rights cause, or social change
Hacktivism is the use of hacking as a form of civil disobedience or protest to promote a political, social, or ideological agenda. Hacktivist groups like Anonymous have used DDoS attacks, website defacements, and data leaks to protest government corruption, censorship, or corporate misconduct. While motivated by ideology rather than profit, their actions are still often illegal.
IncorrectC: The use of hacking techniques to promote a political agenda, human rights cause, or social change
Hacktivism is the use of hacking as a form of civil disobedience or protest to promote a political, social, or ideological agenda. Hacktivist groups like Anonymous have used DDoS attacks, website defacements, and data leaks to protest government corruption, censorship, or corporate misconduct. While motivated by ideology rather than profit, their actions are still often illegal.
6Which cybercrime involves illegally intercepting network traffic to read sensitive data in transit?
CorrectA: Network Sniffing / Eavesdropping
Network sniffing (eavesdropping) involves intercepting and capturing data packets as they travel across a network. Attackers use packet analyzer tools (e.g., Wireshark, tcpdump) on unsecured or compromised networks to read unencrypted data like passwords, session tokens, and personal information. Encryption (TLS/HTTPS) is the primary defense.
IncorrectA: Network Sniffing / Eavesdropping
Network sniffing (eavesdropping) involves intercepting and capturing data packets as they travel across a network. Attackers use packet analyzer tools (e.g., Wireshark, tcpdump) on unsecured or compromised networks to read unencrypted data like passwords, session tokens, and personal information. Encryption (TLS/HTTPS) is the primary defense.
7What is the primary goal of a "Cyber Terrorist"?
CorrectD: To cause widespread panic, disrupt critical national infrastructure, and inflict physical or severe economic damage
Cyber terrorism aims to achieve ideological or political objectives by attacking critical infrastructure (power grids, water systems, financial networks, transport systems) through digital means. The intent is to cause mass disruption, fear, physical harm, or economic collapse — distinguishing it from cybercrime motivated by financial gain or espionage.
IncorrectD: To cause widespread panic, disrupt critical national infrastructure, and inflict physical or severe economic damage
Cyber terrorism aims to achieve ideological or political objectives by attacking critical infrastructure (power grids, water systems, financial networks, transport systems) through digital means. The intent is to cause mass disruption, fear, physical harm, or economic collapse — distinguishing it from cybercrime motivated by financial gain or espionage.
8In the context of cybercrime, what is "Identity Theft"?
CorrectB: Unlawfully acquiring and using another person's personally identifiable information (PII) to commit financial fraud or other crimes
Identity theft involves the unauthorized collection and use of a person's PII — such as name, Social Security Number, date of birth, or financial account details — to impersonate them for fraudulent purposes. Common methods include phishing, data breaches, and credential stuffing. It can result in financial loss, damaged credit, and legal complications for the victim.
IncorrectB: Unlawfully acquiring and using another person's personally identifiable information (PII) to commit financial fraud or other crimes
Identity theft involves the unauthorized collection and use of a person's PII — such as name, Social Security Number, date of birth, or financial account details — to impersonate them for fraudulent purposes. Common methods include phishing, data breaches, and credential stuffing. It can result in financial loss, damaged credit, and legal complications for the victim.
9What is the primary focus of digital forensics in cybercrime investigations?
CorrectB: The scientific identification, preservation, extraction, and documentation of digital evidence to be used in a court of law
Digital forensics is the scientific discipline of collecting, preserving, examining, and presenting digital evidence in a manner that maintains its integrity for legal proceedings. It covers devices (computers, smartphones), network logs, cloud environments, and memory. Rigorous chain-of-custody procedures ensure evidence is admissible in court.
IncorrectB: The scientific identification, preservation, extraction, and documentation of digital evidence to be used in a court of law
Digital forensics is the scientific discipline of collecting, preserving, examining, and presenting digital evidence in a manner that maintains its integrity for legal proceedings. It covers devices (computers, smartphones), network logs, cloud environments, and memory. Rigorous chain-of-custody procedures ensure evidence is admissible in court.
10Which type of cybercrime specifically involves predators using the internet to establish emotional connections with minors for the purpose of exploitation?
CorrectC: Cyber Grooming
Cyber grooming is a predatory crime where an adult uses online platforms (social media, gaming, messaging apps) to build a relationship of trust and emotional connection with a minor, with the ultimate goal of sexual exploitation or abuse. Grooming behavior includes flattery, gift-giving, normalization of inappropriate conversation, and isolation from family.
IncorrectC: Cyber Grooming
Cyber grooming is a predatory crime where an adult uses online platforms (social media, gaming, messaging apps) to build a relationship of trust and emotional connection with a minor, with the ultimate goal of sexual exploitation or abuse. Grooming behavior includes flattery, gift-giving, normalization of inappropriate conversation, and isolation from family.
11What does "Cyber Espionage" typically entail?
CorrectA: The unauthorized, covert extraction of classified, sensitive, or proprietary information from rival governments or corporations
Cyber espionage is the covert use of digital techniques to gain unauthorized access to sensitive, classified, or proprietary information from foreign governments, military organizations, or corporations for strategic, political, or competitive advantage. Distinguished from cybercrime by its state-sponsored nature and intelligence-gathering motive rather than financial gain.
IncorrectA: The unauthorized, covert extraction of classified, sensitive, or proprietary information from rival governments or corporations
Cyber espionage is the covert use of digital techniques to gain unauthorized access to sensitive, classified, or proprietary information from foreign governments, military organizations, or corporations for strategic, political, or competitive advantage. Distinguished from cybercrime by its state-sponsored nature and intelligence-gathering motive rather than financial gain.
12What is a "Money Mule" in the context of cybercrime?
CorrectD: A person who transfers illegally acquired money on behalf of criminals, often keeping a small commission
A money mule is a person who receives stolen or fraudulent funds into their bank account and transfers them (often internationally) on behalf of cybercriminals, keeping a commission. They are often recruited via fake job advertisements promising easy money. Money mules are a critical component of cybercrime money laundering operations and are themselves committing a crime, even if unwittingly.
IncorrectD: A person who transfers illegally acquired money on behalf of criminals, often keeping a small commission
A money mule is a person who receives stolen or fraudulent funds into their bank account and transfers them (often internationally) on behalf of cybercriminals, keeping a commission. They are often recruited via fake job advertisements promising easy money. Money mules are a critical component of cybercrime money laundering operations and are themselves committing a crime, even if unwittingly.
13What is the defining characteristic of "Cyberstalking"?
CorrectB: The persistent, repeated use of electronic communications to harass, intimidate, or frighten a specific individual
Cyberstalking is a serious criminal offense involving a persistent pattern of unwanted online contact, surveillance, harassment, or threats directed at a specific individual using electronic communications (email, social media, messaging apps). It causes the victim significant fear or distress. It differs from cyberbullying in its sustained, targeted, and often threatening nature.
IncorrectB: The persistent, repeated use of electronic communications to harass, intimidate, or frighten a specific individual
Cyberstalking is a serious criminal offense involving a persistent pattern of unwanted online contact, surveillance, harassment, or threats directed at a specific individual using electronic communications (email, social media, messaging apps). It causes the victim significant fear or distress. It differs from cyberbullying in its sustained, targeted, and often threatening nature.
14Which activity is considered a crime under standard "Unauthorized Access" laws, even if no data is stolen?
CorrectC: Successfully bypassing authentication to log into a restricted system without permission
Under laws like the US Computer Fraud and Abuse Act (CFAA) and the UK Computer Misuse Act, merely accessing a computer system without authorization — even without stealing data — constitutes a crime. The act of bypassing authentication controls itself is illegal. The absence of data theft does not negate the unauthorized access offense.
IncorrectC: Successfully bypassing authentication to log into a restricted system without permission
Under laws like the US Computer Fraud and Abuse Act (CFAA) and the UK Computer Misuse Act, merely accessing a computer system without authorization — even without stealing data — constitutes a crime. The act of bypassing authentication controls itself is illegal. The absence of data theft does not negate the unauthorized access offense.
15What is the "Dark Web" primarily used for by cybercriminals?
CorrectA: As a secure, encrypted marketplace to anonymously buy, sell, and trade illicit goods, services, and stolen data
The dark web — accessible only via anonymizing networks like Tor — hosts hidden marketplaces where cybercriminals trade stolen data (credentials, card numbers), malware, ransomware kits, drugs, weapons, and hacking services. While the dark web also has legitimate privacy uses, its anonymity makes it a key component of criminal infrastructure.
IncorrectA: As a secure, encrypted marketplace to anonymously buy, sell, and trade illicit goods, services, and stolen data
The dark web — accessible only via anonymizing networks like Tor — hosts hidden marketplaces where cybercriminals trade stolen data (credentials, card numbers), malware, ransomware kits, drugs, weapons, and hacking services. While the dark web also has legitimate privacy uses, its anonymity makes it a key component of criminal infrastructure.
16What does "Software Piracy" involve?
CorrectD: The unauthorized copying, reproduction, use, or distribution of copyrighted software
Software piracy is the unauthorized copying, distribution, or use of commercial software without a valid license. Common forms include cracked software, illegal peer-to-peer sharing, counterfeiting physical media, and deployment beyond licensed seat counts. It violates copyright law (e.g., DMCA in the US) and causes significant financial losses to software vendors.
IncorrectD: The unauthorized copying, reproduction, use, or distribution of copyrighted software
Software piracy is the unauthorized copying, distribution, or use of commercial software without a valid license. Common forms include cracked software, illegal peer-to-peer sharing, counterfeiting physical media, and deployment beyond licensed seat counts. It violates copyright law (e.g., DMCA in the US) and causes significant financial losses to software vendors.
17In cyber law and cryptography, what does "Non-Repudiation" ensure?
CorrectA: A party cannot successfully deny the authenticity of their digital signature on a document or the sending of a message
Non-repudiation is a security property that prevents a party from falsely denying having performed an action. In digital contexts, it is achieved via digital signatures: since only the holder of a private key can produce a valid signature, the signer cannot later claim the signed document or message is inauthentic. It is critical for e-contracts, financial transactions, and legal communications.
IncorrectA: A party cannot successfully deny the authenticity of their digital signature on a document or the sending of a message
Non-repudiation is a security property that prevents a party from falsely denying having performed an action. In digital contexts, it is achieved via digital signatures: since only the holder of a private key can produce a valid signature, the signer cannot later claim the signed document or message is inauthentic. It is critical for e-contracts, financial transactions, and legal communications.
18Which of the following is considered a "Cyber-Dependent" crime?
CorrectC: The creation and distribution of a destructive computer worm
Cyber-dependent crimes are offenses that can ONLY be committed using computers or digital networks — the technology is not merely a facilitator, it is the essential instrument. Creating and distributing a computer worm is a prime example. Cyber-enabled crimes (contrast) are traditional offenses like fraud or harassment that are amplified by technology but could theoretically occur without it.
IncorrectC: The creation and distribution of a destructive computer worm
Cyber-dependent crimes are offenses that can ONLY be committed using computers or digital networks — the technology is not merely a facilitator, it is the essential instrument. Creating and distributing a computer worm is a prime example. Cyber-enabled crimes (contrast) are traditional offenses like fraud or harassment that are amplified by technology but could theoretically occur without it.
19What is the highly dangerous cybercrime known as "Swatting"?
CorrectD: Making a false, highly critical report to emergency services to dispatch heavily armed police to a target's physical address
Swatting is a dangerous criminal harassment tactic where an attacker makes a fraudulent emergency call (bomb threat, hostage situation, active shooter) to trick law enforcement into deploying a heavily-armed response team (SWAT) to a target's address. It puts innocent lives at immediate risk and has resulted in deaths. It is prosecuted as making false reports, wire fraud, and in fatal cases, manslaughter.
IncorrectD: Making a false, highly critical report to emergency services to dispatch heavily armed police to a target's physical address
Swatting is a dangerous criminal harassment tactic where an attacker makes a fraudulent emergency call (bomb threat, hostage situation, active shooter) to trick law enforcement into deploying a heavily-armed response team (SWAT) to a target's address. It puts innocent lives at immediate risk and has resulted in deaths. It is prosecuted as making false reports, wire fraud, and in fatal cases, manslaughter.
20Which entity is generally responsible for coordinating the prosecution and takedown of international cybercrime syndicates?
CorrectB: Collaborative task forces involving international law enforcement agencies like INTERPOL, Europol, and the FBI
International cybercrime investigations require cross-border cooperation because attackers routinely operate across jurisdictions. Agencies like INTERPOL (global), Europol (EU), the FBI (US), and CISA coordinate joint operations, share intelligence, and execute simultaneous takedowns of criminal networks. Operations like the Hive ransomware takedown and Emotet disruption exemplify this collaborative model.
IncorrectB: Collaborative task forces involving international law enforcement agencies like INTERPOL, Europol, and the FBI
International cybercrime investigations require cross-border cooperation because attackers routinely operate across jurisdictions. Agencies like INTERPOL (global), Europol (EU), the FBI (US), and CISA coordinate joint operations, share intelligence, and execute simultaneous takedowns of criminal networks. Operations like the Hive ransomware takedown and Emotet disruption exemplify this collaborative model.
Cyber Crimes — Concepts
1What is the purpose of the "Chain of Custody" in a cybercrime investigation?
CorrectA: To document the chronological history of evidence handling, ensuring it has not been altered or tampered with from collection to courtroom
The chain of custody is a legal and procedural record that documents every person who has handled a piece of evidence, along with the time, date, and purpose of each transfer. In digital forensics, it is critical to maintaining evidence integrity and admissibility in court. Any break in the chain can allow defense attorneys to challenge the evidence's authenticity.
IncorrectA: To document the chronological history of evidence handling, ensuring it has not been altered or tampered with from collection to courtroom
The chain of custody is a legal and procedural record that documents every person who has handled a piece of evidence, along with the time, date, and purpose of each transfer. In digital forensics, it is critical to maintaining evidence integrity and admissibility in court. Any break in the chain can allow defense attorneys to challenge the evidence's authenticity.
2Which international treaty serves as the first legally binding international instrument designed to harmonize national laws regarding cybercrime?
CorrectD: The Budapest Convention (Convention on Cybercrime)
The Budapest Convention on Cybercrime (2001), opened by the Council of Europe and now ratified by 70+ countries, is the first binding international treaty on cybercrime. It harmonizes national cybercrime laws, establishes procedural powers for investigations (preservation, production, search/seizure), and promotes international cooperation in evidence gathering and extradition.
IncorrectD: The Budapest Convention (Convention on Cybercrime)
The Budapest Convention on Cybercrime (2001), opened by the Council of Europe and now ratified by 70+ countries, is the first binding international treaty on cybercrime. It harmonizes national cybercrime laws, establishes procedural powers for investigations (preservation, production, search/seizure), and promotes international cooperation in evidence gathering and extradition.
3In the United States, which primary federal statute governs unauthorized access to computer systems and network intrusions?
CorrectC: The Computer Fraud and Abuse Act (CFAA)
The CFAA (1986, amended multiple times) is the primary US federal anti-hacking statute. It criminalizes unauthorized access or exceeding authorized access to protected computers, computer fraud, trafficking in passwords, and intentional damage to computers. The CFAA is broadly interpreted and has been controversial for potentially criminalizing legitimate security research.
IncorrectC: The Computer Fraud and Abuse Act (CFAA)
The CFAA (1986, amended multiple times) is the primary US federal anti-hacking statute. It criminalizes unauthorized access or exceeding authorized access to protected computers, computer fraud, trafficking in passwords, and intentional damage to computers. The CFAA is broadly interpreted and has been controversial for potentially criminalizing legitimate security research.
4What is the primary function of the "Order of Volatility" in digital forensics?
CorrectB: It dictates that investigators must prioritize collecting the most fragile and easily lost evidence first (like RAM), moving to the most persistent storage last
The order of volatility (RFC 3227) guides investigators to collect evidence from most-volatile to least-volatile sources to prevent data loss. The order is: CPU registers/cache → RAM → swap space/temp files → hard drive → remote logging/monitoring data → physical configuration and network topology. RAM is most critical as it disappears at power-off.
IncorrectB: It dictates that investigators must prioritize collecting the most fragile and easily lost evidence first (like RAM), moving to the most persistent storage last
The order of volatility (RFC 3227) guides investigators to collect evidence from most-volatile to least-volatile sources to prevent data loss. The order is: CPU registers/cache → RAM → swap space/temp files → hard drive → remote logging/monitoring data → physical configuration and network topology. RAM is most critical as it disappears at power-off.
5How does the "Electronic Communications Privacy Act" (ECPA) primarily protect individuals in the US?
CorrectA: It sets strict restrictions on government wiretaps of computer communications and protects stored electronic data from unwarranted access
The ECPA (1986) extended Fourth Amendment privacy protections to electronic communications. It comprises three parts: the Wiretap Act (intercepts), the Stored Communications Act (stored data at ISPs/providers), and the Pen Register Act (metadata). It governs the circumstances under which law enforcement can access electronic communications data.
IncorrectA: It sets strict restrictions on government wiretaps of computer communications and protects stored electronic data from unwarranted access
The ECPA (1986) extended Fourth Amendment privacy protections to electronic communications. It comprises three parts: the Wiretap Act (intercepts), the Stored Communications Act (stored data at ISPs/providers), and the Pen Register Act (metadata). It governs the circumstances under which law enforcement can access electronic communications data.
6What does the term "Jurisdiction" mean in the context of prosecuting cybercrime?
CorrectD: The legal authority of a court or law enforcement agency to hear, judge, and enforce laws over a case based on geographic or territorial boundaries
Jurisdiction determines which court or law enforcement body has the legal authority to investigate and prosecute a crime. Cybercrime complicates jurisdiction because attacks routinely cross national, state, and local boundaries. Determining jurisdiction often depends on where the crime was committed, where the victim is located, where the attacker is located, or where servers are hosted.
IncorrectD: The legal authority of a court or law enforcement agency to hear, judge, and enforce laws over a case based on geographic or territorial boundaries
Jurisdiction determines which court or law enforcement body has the legal authority to investigate and prosecute a crime. Cybercrime complicates jurisdiction because attacks routinely cross national, state, and local boundaries. Determining jurisdiction often depends on where the crime was committed, where the victim is located, where the attacker is located, or where servers are hosted.
7Which specialized investigative technique involves setting up a fake, vulnerable system deliberately to monitor and study attacker behavior?
CorrectC: Deploying a Honeypot
A honeypot is a deliberately vulnerable decoy system designed to attract and trap attackers. By monitoring all interactions with the honeypot, security teams can study attacker TTPs (tools, techniques, and procedures), gather intelligence on new threats, and detect intrusions into the real network. Honeynets are networks of multiple honeypots.
IncorrectC: Deploying a Honeypot
A honeypot is a deliberately vulnerable decoy system designed to attract and trap attackers. By monitoring all interactions with the honeypot, security teams can study attacker TTPs (tools, techniques, and procedures), gather intelligence on new threats, and detect intrusions into the real network. Honeynets are networks of multiple honeypots.
8What is "Locard's Exchange Principle" as applied to digital forensics?
CorrectB: The foundational concept that anyone entering a digital crime scene leaves behind traces (e.g., IP addresses, logs, file artifacts) and takes something with them
Locard's Exchange Principle (originally from physical forensics) states that every contact leaves a trace. In digital forensics: every attacker interaction with a system leaves artifacts — log entries, registry modifications, file timestamps, memory traces, network logs. The challenge is finding, preserving, and interpreting those traces before they are overwritten or deleted.
IncorrectB: The foundational concept that anyone entering a digital crime scene leaves behind traces (e.g., IP addresses, logs, file artifacts) and takes something with them
Locard's Exchange Principle (originally from physical forensics) states that every contact leaves a trace. In digital forensics: every attacker interaction with a system leaves artifacts — log entries, registry modifications, file timestamps, memory traces, network logs. The challenge is finding, preserving, and interpreting those traces before they are overwritten or deleted.
9What is a "Bulletproof Hoster" in the cybercriminal ecosystem?
CorrectC: A web hosting service that explicitly allows cybercriminals to operate, routinely ignoring law enforcement takedown requests and abuse reports
Bulletproof hosters provide internet infrastructure (servers, IPs, domains) to cybercriminals with a deliberate policy of ignoring abuse complaints, law enforcement requests, and takedown notices. They typically operate in jurisdictions with weak cybercrime laws or corrupt officials. They host malware C2 servers, phishing kits, botnet infrastructure, and child exploitation material.
IncorrectC: A web hosting service that explicitly allows cybercriminals to operate, routinely ignoring law enforcement takedown requests and abuse reports
Bulletproof hosters provide internet infrastructure (servers, IPs, domains) to cybercriminals with a deliberate policy of ignoring abuse complaints, law enforcement requests, and takedown notices. They typically operate in jurisdictions with weak cybercrime laws or corrupt officials. They host malware C2 servers, phishing kits, botnet infrastructure, and child exploitation material.
10Under the GDPR, what is the standard "Data Breach Notification" requirement for organizations?
CorrectB: Organizations must report certain types of data breaches to the relevant supervisory authority within 72 hours of becoming aware of it
Under GDPR Article 33, organizations (data controllers) must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in risk to individuals' rights and freedoms. If high risk to individuals exists, affected data subjects must also be notified without undue delay (Article 34).
IncorrectB: Organizations must report certain types of data breaches to the relevant supervisory authority within 72 hours of becoming aware of it
Under GDPR Article 33, organizations (data controllers) must notify the relevant supervisory authority of a personal data breach within 72 hours of becoming aware of it, unless the breach is unlikely to result in risk to individuals' rights and freedoms. If high risk to individuals exists, affected data subjects must also be notified without undue delay (Article 34).
11What is the concept of "Dual Criminality" in international cybercrime extradition proceedings?
CorrectD: A legal requirement that the alleged action must be considered a crime in both the requesting country and the country being asked to extradite
Dual criminality (double criminality) is a foundational principle in extradition law: a country will only extradite a suspect if the alleged conduct constitutes a crime under both the laws of the requesting state AND the laws of the requested state. This creates extradition challenges in cybercrime because information security laws vary widely between nations.
IncorrectD: A legal requirement that the alleged action must be considered a crime in both the requesting country and the country being asked to extradite
Dual criminality (double criminality) is a foundational principle in extradition law: a country will only extradite a suspect if the alleged conduct constitutes a crime under both the laws of the requesting state AND the laws of the requested state. This creates extradition challenges in cybercrime because information security laws vary widely between nations.
12What role does "Cryptanalysis" play in a cybercrime investigation?
CorrectA: The science of attempting to defeat cryptographic security systems to access encrypted evidence without the original key
In cybercrime investigations, cryptanalysis is used to decrypt encrypted communications, files, or drives seized from suspects. Investigators may use known-plaintext attacks, brute-force key searches, exploiting implementation weaknesses, or compelling suspects to provide keys (where legally permitted). Tools like Hashcat and John the Ripper are used for password cracking.
IncorrectA: The science of attempting to defeat cryptographic security systems to access encrypted evidence without the original key
In cybercrime investigations, cryptanalysis is used to decrypt encrypted communications, files, or drives seized from suspects. Investigators may use known-plaintext attacks, brute-force key searches, exploiting implementation weaknesses, or compelling suspects to provide keys (where legally permitted). Tools like Hashcat and John the Ripper are used for password cracking.
13What is the legal concept of "Mens Rea" in cybercrime prosecution?
CorrectD: The "guilty mind" or criminal intent — the mental state of knowingly and willfully committing an illegal act — required to legally convict someone
Mens Rea (Latin: "guilty mind") is the criminal intent element required for conviction. In cybercrime cases, prosecutors must prove the defendant knowingly, willfully, or at minimum recklessly committed the offense. Accidental access to a system, for example, may lack mens rea. It contrasts with Actus Reus — the guilty act itself. Both elements are typically required for a criminal conviction.
IncorrectD: The "guilty mind" or criminal intent — the mental state of knowingly and willfully committing an illegal act — required to legally convict someone
Mens Rea (Latin: "guilty mind") is the criminal intent element required for conviction. In cybercrime cases, prosecutors must prove the defendant knowingly, willfully, or at minimum recklessly committed the offense. Accidental access to a system, for example, may lack mens rea. It contrasts with Actus Reus — the guilty act itself. Both elements are typically required for a criminal conviction.
14Which US law establishes national standards for protecting sensitive patient health information from unauthorized disclosure?
CorrectA: HIPAA (Health Insurance Portability and Accountability Act)
HIPAA (1996) establishes national standards to protect individuals' medical records and personal health information (PHI). The HIPAA Security Rule mandates administrative, physical, and technical safeguards for electronic PHI. Breaches of HIPAA can result in civil penalties of up to $1.9M per violation category per year. Healthcare data breaches are investigated by the HHS Office for Civil Rights.
IncorrectA: HIPAA (Health Insurance Portability and Accountability Act)
HIPAA (1996) establishes national standards to protect individuals' medical records and personal health information (PHI). The HIPAA Security Rule mandates administrative, physical, and technical safeguards for electronic PHI. Breaches of HIPAA can result in civil penalties of up to $1.9M per violation category per year. Healthcare data breaches are investigated by the HHS Office for Civil Rights.
15What is the purpose of "Forensic Imaging" (creating a bit-stream copy) in a cybercrime investigation?
CorrectB: To create an exact, sector-by-sector replica of a storage device for analysis without altering the original, pristine evidence
Forensic imaging (using tools like dd, FTK Imager, or Guymager) creates a perfect bit-for-bit copy of a storage device — including deleted files, unallocated space, and file slack. All analysis is performed on the forensic image, never on the original evidence, preserving its integrity. Hash values (MD5/SHA-256) are verified before and after imaging to prove the copy is identical.
IncorrectB: To create an exact, sector-by-sector replica of a storage device for analysis without altering the original, pristine evidence
Forensic imaging (using tools like dd, FTK Imager, or Guymager) creates a perfect bit-for-bit copy of a storage device — including deleted files, unallocated space, and file slack. All analysis is performed on the forensic image, never on the original evidence, preserving its integrity. Hash values (MD5/SHA-256) are verified before and after imaging to prove the copy is identical.
16In a digital forensics investigation, what is the critical purpose of a "Write Blocker"?
CorrectC: To guarantee that the forensic workstation cannot accidentally modify, alter, or write any data to the suspect's original storage device during the imaging process
A write blocker (hardware or software) is a device that intercepts and prevents all write commands from reaching a target drive, ensuring only read operations occur. This is essential because connecting a suspect's drive to a computer without a write blocker can cause the OS to automatically modify metadata (access times, mount records), potentially contaminating evidence and jeopardizing its admissibility.
IncorrectC: To guarantee that the forensic workstation cannot accidentally modify, alter, or write any data to the suspect's original storage device during the imaging process
A write blocker (hardware or software) is a device that intercepts and prevents all write commands from reaching a target drive, ensuring only read operations occur. This is essential because connecting a suspect's drive to a computer without a write blocker can cause the OS to automatically modify metadata (access times, mount records), potentially contaminating evidence and jeopardizing its admissibility.
17What is "Crime-as-a-Service" (CaaS) in the underground digital economy?
CorrectA: Experienced cybercriminals offering specialized tools, infrastructure, and expertise (like Ransomware-as-a-Service) for rent or sale to less technically skilled actors
CaaS is a criminal business model mirroring legitimate SaaS. It includes: RaaS (Ransomware-as-a-Service), Phishing-as-a-Service, DDoS-for-hire, Malware-as-a-Service, and Initial Access Brokers. These services lower the technical barrier for cybercrime, making sophisticated attacks accessible to unskilled criminals. They significantly increase the volume and diversity of cyber threats.
IncorrectA: Experienced cybercriminals offering specialized tools, infrastructure, and expertise (like Ransomware-as-a-Service) for rent or sale to less technically skilled actors
CaaS is a criminal business model mirroring legitimate SaaS. It includes: RaaS (Ransomware-as-a-Service), Phishing-as-a-Service, DDoS-for-hire, Malware-as-a-Service, and Initial Access Brokers. These services lower the technical barrier for cybercrime, making sophisticated attacks accessible to unskilled criminals. They significantly increase the volume and diversity of cyber threats.
18What is the primary focus of the "Digital Millennium Copyright Act" (DMCA) regarding cybersecurity?
CorrectD: It criminalizes the production and dissemination of technologies, devices, or services intended to circumvent digital rights management (DRM) access controls
The DMCA (1998) implemented two WIPO treaties and contains provisions criminalizing anti-circumvention (Section 1201) — making it illegal to bypass technological protection measures (TPMs) like DRM, even for non-infringing purposes. This has been controversial in security research, as disclosing vulnerabilities in DRM systems can technically violate the DMCA.
IncorrectD: It criminalizes the production and dissemination of technologies, devices, or services intended to circumvent digital rights management (DRM) access controls
The DMCA (1998) implemented two WIPO treaties and contains provisions criminalizing anti-circumvention (Section 1201) — making it illegal to bypass technological protection measures (TPMs) like DRM, even for non-infringing purposes. This has been controversial in security research, as disclosing vulnerabilities in DRM systems can technically violate the DMCA.
19How do cybercriminals commonly launder cryptocurrency to obscure the forensic trail of illicit funds?
CorrectC: By utilizing "Mixers" or "Tumblers" that blend their funds with large pools of other users' cryptocurrency before sending to the final destination
Cryptocurrency mixers/tumblers are services that pool and shuffle cryptocurrency transactions from multiple users, breaking the on-chain link between source and destination addresses. More sophisticated methods include chain-hopping (converting between cryptocurrencies), using privacy coins (Monero), DeFi protocol layering, and exploiting unhosted wallets in jurisdictions that lack KYC requirements.
IncorrectC: By utilizing "Mixers" or "Tumblers" that blend their funds with large pools of other users' cryptocurrency before sending to the final destination
Cryptocurrency mixers/tumblers are services that pool and shuffle cryptocurrency transactions from multiple users, breaking the on-chain link between source and destination addresses. More sophisticated methods include chain-hopping (converting between cryptocurrencies), using privacy coins (Monero), DeFi protocol layering, and exploiting unhosted wallets in jurisdictions that lack KYC requirements.
20What is the legal definition of "Wire Fraud" in the context of digital crime?
CorrectB: Any fraudulent scheme to intentionally deprive another of property or honest services utilizing interstate wire, radio, or television communications — including the internet
Wire fraud (18 U.S.C. § 1343) is one of the most broadly applicable federal criminal statutes, covering any scheme to defraud communicated via wire, radio, or TV. Since virtually all cybercrime uses internet communications, wire fraud charges frequently accompany hacking, BEC, phishing, and ransomware prosecutions. Maximum penalties can reach 20 years per count (30 years if involving financial institutions).
IncorrectB: Any fraudulent scheme to intentionally deprive another of property or honest services utilizing interstate wire, radio, or television communications — including the internet
Wire fraud (18 U.S.C. § 1343) is one of the most broadly applicable federal criminal statutes, covering any scheme to defraud communicated via wire, radio, or TV. Since virtually all cybercrime uses internet communications, wire fraud charges frequently accompany hacking, BEC, phishing, and ransomware prosecutions. Maximum penalties can reach 20 years per count (30 years if involving financial institutions).
Cyber Crimes — Advanced
1In advanced digital forensics, what does "Steganalysis" entail?
CorrectB: The scientific process of detecting, analyzing, and extracting data hidden within seemingly innocuous carrier files (like images or audio) using steganography
Steganalysis is the forensic counterpart to steganography — it detects, analyzes, and extracts hidden data concealed within carrier files (images, audio, video, documents). Statistical methods (chi-square analysis, RS analysis) identify anomalies in file data that indicate hidden content. Cybercriminals use steganography to covertly exfiltrate data or communicate while evading IDS/DLP systems.
IncorrectB: The scientific process of detecting, analyzing, and extracting data hidden within seemingly innocuous carrier files (like images or audio) using steganography
Steganalysis is the forensic counterpart to steganography — it detects, analyzes, and extracts hidden data concealed within carrier files (images, audio, video, documents). Statistical methods (chi-square analysis, RS analysis) identify anomalies in file data that indicate hidden content. Cybercriminals use steganography to covertly exfiltrate data or communicate while evading IDS/DLP systems.
2How does the "Tor" network specifically complicate cybercrime attribution for law enforcement?
CorrectA: By routing network traffic through multiple layers of encryption and decentralized volunteer relay nodes, successfully obfuscating the true IP address and geographic origin of the user
Tor (The Onion Router) routes encrypted traffic through at least three volunteer relays (guard, middle, exit nodes), with each hop only knowing the previous and next relay. This multi-layered encryption and routing makes it extremely difficult to trace traffic back to the originating IP address. Law enforcement uses traffic correlation analysis, compromising exit nodes, or exploiting Tor browser vulnerabilities to de-anonymize users.
IncorrectA: By routing network traffic through multiple layers of encryption and decentralized volunteer relay nodes, successfully obfuscating the true IP address and geographic origin of the user
Tor (The Onion Router) routes encrypted traffic through at least three volunteer relays (guard, middle, exit nodes), with each hop only knowing the previous and next relay. This multi-layered encryption and routing makes it extremely difficult to trace traffic back to the originating IP address. Law enforcement uses traffic correlation analysis, compromising exit nodes, or exploiting Tor browser vulnerabilities to de-anonymize users.
3Which advanced anti-forensic technique involves an attacker deliberately modifying file timestamps (Modified, Accessed, Created) to confuse investigators?
CorrectD: Timestomping
Timestomping is an anti-forensic technique (MITRE ATT&CK T1070.006) where attackers modify MACE timestamps (Modified, Accessed, Created, Entry modified) on files and directories. By setting timestamps to dates that predate or postdate the actual attack, attackers can disrupt forensic timeline analysis. NTFS logs $MFT and $LogFile entries that can sometimes reveal the true timestamps.
IncorrectD: Timestomping
Timestomping is an anti-forensic technique (MITRE ATT&CK T1070.006) where attackers modify MACE timestamps (Modified, Accessed, Created, Entry modified) on files and directories. By setting timestamps to dates that predate or postdate the actual attack, attackers can disrupt forensic timeline analysis. NTFS logs $MFT and $LogFile entries that can sometimes reveal the true timestamps.
4In the context of cyber espionage attribution, what is a "False Flag" operation?
CorrectC: A sophisticated tactic where an attacker intentionally plants forensic artifacts (code strings, TTPs, language indicators) that point to a different threat actor or nation-state to misdirect investigators
False flag operations are deception tactics where attackers plant misleading evidence to frame another nation, group, or individual. Examples include using another group's known malware signatures, embedding foreign-language strings in code, or using infrastructure previously associated with another threat actor. The Olympic Destroyer malware targeting the 2018 Winter Olympics is a notable false-flag example.
IncorrectC: A sophisticated tactic where an attacker intentionally plants forensic artifacts (code strings, TTPs, language indicators) that point to a different threat actor or nation-state to misdirect investigators
False flag operations are deception tactics where attackers plant misleading evidence to frame another nation, group, or individual. Examples include using another group's known malware signatures, embedding foreign-language strings in code, or using infrastructure previously associated with another threat actor. The Olympic Destroyer malware targeting the 2018 Winter Olympics is a notable false-flag example.
5What is the primary purpose of analyzing "Prefetch" files (.pf) during a Windows forensic investigation?
CorrectB: To determine which applications were historically executed on the system, including execution times, run counts, and referenced file paths
Windows Prefetch files (stored in C:WindowsPrefetch) are created when an application runs for the first time, to speed up future launches. Each .pf file records the executable name, run count, last run time (up to the last 8 run times in Win8+), and a list of files and directories referenced. They are invaluable for proving program execution — even after the executable has been deleted.
IncorrectB: To determine which applications were historically executed on the system, including execution times, run counts, and referenced file paths
Windows Prefetch files (stored in C:WindowsPrefetch) are created when an application runs for the first time, to speed up future launches. Each .pf file records the executable name, run count, last run time (up to the last 8 run times in Win8+), and a list of files and directories referenced. They are invaluable for proving program execution — even after the executable has been deleted.
6What is "Fast Flux" networking, a technique commonly used by advanced cybercriminal syndicates?
CorrectD: Rapidly rotating DNS A records for a single domain across a large pool of compromised IP addresses to evade sinkholing, blocklists, and takedown attempts
Fast Flux is a DNS evasion technique where a domain's IP addresses change rapidly (sometimes every few minutes) through an army of compromised hosts (flux agents) acting as proxies. Single-flux rotates IP addresses; Double-flux also rotates the authoritative name servers. This makes it extremely difficult to take down phishing sites, botnet C2 infrastructure, and bulletproof hosting.
IncorrectD: Rapidly rotating DNS A records for a single domain across a large pool of compromised IP addresses to evade sinkholing, blocklists, and takedown attempts
Fast Flux is a DNS evasion technique where a domain's IP addresses change rapidly (sometimes every few minutes) through an army of compromised hosts (flux agents) acting as proxies. Single-flux rotates IP addresses; Double-flux also rotates the authoritative name servers. This makes it extremely difficult to take down phishing sites, botnet C2 infrastructure, and bulletproof hosting.
7In threat intelligence, what is the "Diamond Model of Intrusion Analysis" used for?
CorrectA: To map and analyze cyber incidents by connecting four core features: Adversary, Capability, Infrastructure, and Victim
The Diamond Model (Caltagirone, Pendergast, Betz, 2013) provides a structured framework for analyzing intrusions. Each intrusion event is represented as a diamond with four core features: Adversary (who), Capability (how — malware/tools), Infrastructure (where — IPs/domains), and Victim (target). Meta-features like timestamps and phase help analysts pivot across events, cluster related campaigns, and perform attribution.
IncorrectA: To map and analyze cyber incidents by connecting four core features: Adversary, Capability, Infrastructure, and Victim
The Diamond Model (Caltagirone, Pendergast, Betz, 2013) provides a structured framework for analyzing intrusions. Each intrusion event is represented as a diamond with four core features: Adversary (who), Capability (how — malware/tools), Infrastructure (where — IPs/domains), and Victim (target). Meta-features like timestamps and phase help analysts pivot across events, cluster related campaigns, and perform attribution.
8What is the legal significance of the "Third-Party Doctrine" in US constitutional law regarding cyber investigations?
CorrectC: It holds that information voluntarily shared with third parties (like ISPs or email providers) carries no reasonable expectation of privacy, allowing investigators to obtain it without a full warrant
The Third-Party Doctrine (established in Smith v. Maryland, 1979) holds that once you voluntarily share information with a third party (ISP, email provider, bank, cloud service), you forfeit Fourth Amendment privacy protections over that data. This allows investigators to subpoena ISP records, email metadata, and account information without a full search warrant. Carpenter v. United States (2018) created a significant exception for historical cell-site location data.
IncorrectC: It holds that information voluntarily shared with third parties (like ISPs or email providers) carries no reasonable expectation of privacy, allowing investigators to obtain it without a full warrant
The Third-Party Doctrine (established in Smith v. Maryland, 1979) holds that once you voluntarily share information with a third party (ISP, email provider, bank, cloud service), you forfeit Fourth Amendment privacy protections over that data. This allows investigators to subpoena ISP records, email metadata, and account information without a full search warrant. Carpenter v. United States (2018) created a significant exception for historical cell-site location data.
9How does "Fileless Malware" present a unique challenge to traditional digital forensics?
CorrectB: It operates entirely within volatile memory (RAM) and abuses native system tools (LOLBins), leaving little to no executable artifact on the hard drive to be recovered after a reboot
Fileless malware (e.g., PowerShell Empire, Cobalt Strike beacons) resides in RAM and executes through legitimate system processes — abusing tools like PowerShell, WMI, and mshta (Living-off-the-Land Binaries/LOLBins). It leaves no traditional malware files on disk. Detection requires memory forensics (Volatility), behavioral EDR monitoring, and PowerShell transcription logging. Evidence is lost on reboot unless a RAM dump is taken.
IncorrectB: It operates entirely within volatile memory (RAM) and abuses native system tools (LOLBins), leaving little to no executable artifact on the hard drive to be recovered after a reboot
Fileless malware (e.g., PowerShell Empire, Cobalt Strike beacons) resides in RAM and executes through legitimate system processes — abusing tools like PowerShell, WMI, and mshta (Living-off-the-Land Binaries/LOLBins). It leaves no traditional malware files on disk. Detection requires memory forensics (Volatility), behavioral EDR monitoring, and PowerShell transcription logging. Evidence is lost on reboot unless a RAM dump is taken.
10What is the primary purpose of the "MITRE ATT&CK" framework for cybercrime analysts?
CorrectA: To provide a globally accessible, standardized, knowledge base of adversary tactics and techniques based on real-world observations, enabling structured threat analysis and detection
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a curated knowledge base of attacker behaviors observed in real incidents. It organizes techniques across 14 tactic categories (Reconnaissance through Impact). Analysts use it to: understand attacker methods, map detections, assess coverage gaps, build threat hunt hypotheses, and communicate findings using a common language.
IncorrectA: To provide a globally accessible, standardized, knowledge base of adversary tactics and techniques based on real-world observations, enabling structured threat analysis and detection
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a curated knowledge base of attacker behaviors observed in real incidents. It organizes techniques across 14 tactic categories (Reconnaissance through Impact). Analysts use it to: understand attacker methods, map detections, assess coverage gaps, build threat hunt hypotheses, and communicate findings using a common language.
11In digital forensic analysis, what is "Slack Space"?
CorrectD: The residual, unused space between the logical end of a file and the physical end of the data cluster it occupies — which can preserve fragments of previously existing data
When a file is stored, it occupies one or more clusters. If the file doesn't fill the last cluster completely, the remaining space (slack space) retains data from the previous file that occupied that cluster. There are two types: RAM slack (padding from end of file to sector boundary) and File slack (from sector boundary to end of cluster). Slack space is a key area for forensic evidence recovery.
IncorrectD: The residual, unused space between the logical end of a file and the physical end of the data cluster it occupies — which can preserve fragments of previously existing data
When a file is stored, it occupies one or more clusters. If the file doesn't fill the last cluster completely, the remaining space (slack space) retains data from the previous file that occupied that cluster. There are two types: RAM slack (padding from end of file to sector boundary) and File slack (from sector boundary to end of cluster). Slack space is a key area for forensic evidence recovery.
12What is the "Wassenaar Arrangement" primarily concerned with in the realm of cybersecurity?
CorrectC: A multilateral export control regime for conventional arms and dual-use goods and technologies, expanded to include advanced intrusion software and surveillance tools
The Wassenaar Arrangement (1996) coordinates export controls among 42 participating states for conventional arms and dual-use technologies. Its 2013 addition of "intrusion software" and "IP network surveillance systems" brought offensive cyber tools under export controls. This has proven controversial in the security research community, as it potentially restricts the international sharing of vulnerability research and legitimate pen-test tools.
IncorrectC: A multilateral export control regime for conventional arms and dual-use goods and technologies, expanded to include advanced intrusion software and surveillance tools
The Wassenaar Arrangement (1996) coordinates export controls among 42 participating states for conventional arms and dual-use technologies. Its 2013 addition of "intrusion software" and "IP network surveillance systems" brought offensive cyber tools under export controls. This has proven controversial in the security research community, as it potentially restricts the international sharing of vulnerability research and legitimate pen-test tools.
13When analyzing a compromised Windows system, what does finding an unexpected entry in the "Shimcache" (AppCompatCache) definitively indicate?
CorrectA: That a specific executable file was present on the system at some point in the past — potentially proving execution or at minimum file existence — even if the file has since been deleted
The Shimcache (AppCompatCache, stored in the registry at HKLMSYSTEMCurrentControlSetControlSession ManagerAppCompatCache) records metadata about executables as they are accessed by the OS for compatibility checks. Finding an unexpected binary in Shimcache proves the file existed on the system. However, Shimcache records file presence, not necessarily execution — AmCache provides stronger execution evidence.
IncorrectA: That a specific executable file was present on the system at some point in the past — potentially proving execution or at minimum file existence — even if the file has since been deleted
The Shimcache (AppCompatCache, stored in the registry at HKLMSYSTEMCurrentControlSetControlSession ManagerAppCompatCache) records metadata about executables as they are accessed by the OS for compatibility checks. Finding an unexpected binary in Shimcache proves the file existed on the system. However, Shimcache records file presence, not necessarily execution — AmCache provides stronger execution evidence.
14What is the primary objective of "Attribution" in a major cybercrime or nation-state incident?
CorrectC: Identifying the specific individual, group, or state-sponsored actor responsible for the attack based on forensic evidence, TTPs, infrastructure overlaps, and threat intelligence
Attribution is the process of identifying who is responsible for a cyberattack. It involves analyzing TTPs, malware code similarities, infrastructure reuse, operational security mistakes, and intelligence community sources. Attribution informs prosecution (criminal cases), sanctions (government response), and deterrence strategies. Nation-state attribution is notoriously difficult and often uncertain due to false flags and shared tooling.
IncorrectC: Identifying the specific individual, group, or state-sponsored actor responsible for the attack based on forensic evidence, TTPs, infrastructure overlaps, and threat intelligence
Attribution is the process of identifying who is responsible for a cyberattack. It involves analyzing TTPs, malware code similarities, infrastructure reuse, operational security mistakes, and intelligence community sources. Attribution informs prosecution (criminal cases), sanctions (government response), and deterrence strategies. Nation-state attribution is notoriously difficult and often uncertain due to false flags and shared tooling.
15Which advanced memory forensics framework is widely used by investigators to extract artifacts like encryption keys, active network connections, running processes, and injected shellcode from a raw RAM dump?
CorrectB: Volatility
Volatility is the industry-standard open-source memory forensics framework. It analyzes raw RAM dumps to extract: running process lists (pslist, pstree), network connections, loaded DLLs, injected code (malfind), command history (cmdscan, consoles), encryption keys (bitlocker, truecrypt plugins), and registry hives. Essential for detecting fileless malware, rootkits, and live system compromise.
IncorrectB: Volatility
Volatility is the industry-standard open-source memory forensics framework. It analyzes raw RAM dumps to extract: running process lists (pslist, pstree), network connections, loaded DLLs, injected code (malfind), command history (cmdscan, consoles), encryption keys (bitlocker, truecrypt plugins), and registry hives. Essential for detecting fileless malware, rootkits, and live system compromise.
16How do advanced threat actors use "Domain Fronting" to evade network censorship and forensic surveillance?
CorrectD: By using a high-reputation CDN domain in the TLS SNI field to bypass egress filters, while routing the actual HTTP Host header to a covert attacker-controlled domain hidden within the same CDN
Domain fronting exploits CDN routing behavior: the outer TLS connection uses a legitimate, high-reputation domain (e.g., allowed.cdn.com) visible to firewalls and DPI, while the inner HTTP request specifies a different, attacker-controlled domain (malicious.cdn.com) that the CDN routes to the C2 server. This makes malicious traffic appear as legitimate CDN traffic. Major CDN providers have largely blocked this technique.
IncorrectD: By using a high-reputation CDN domain in the TLS SNI field to bypass egress filters, while routing the actual HTTP Host header to a covert attacker-controlled domain hidden within the same CDN
Domain fronting exploits CDN routing behavior: the outer TLS connection uses a legitimate, high-reputation domain (e.g., allowed.cdn.com) visible to firewalls and DPI, while the inner HTTP request specifies a different, attacker-controlled domain (malicious.cdn.com) that the CDN routes to the C2 server. This makes malicious traffic appear as legitimate CDN traffic. Major CDN providers have largely blocked this technique.
17In international cyber law, what does the concept of "Active Cyber Defense" (often called "Hack Back") refer to?
CorrectA: The highly controversial and often illegal practice of a victim organization launching offensive retaliatory cyberattacks against their attacker's infrastructure
"Hack back" refers to victim organizations conducting offensive cyber operations against their attackers. In most jurisdictions (including the US under the CFAA), this is illegal regardless of the provocation. Challenges include misattribution risk (harming innocent parties), escalation risk, and jurisdictional violations. The ACDC Act (Active Cyber Defense Certainty) is proposed US legislation that would create limited legal exceptions.
IncorrectA: The highly controversial and often illegal practice of a victim organization launching offensive retaliatory cyberattacks against their attacker's infrastructure
"Hack back" refers to victim organizations conducting offensive cyber operations against their attackers. In most jurisdictions (including the US under the CFAA), this is illegal regardless of the provocation. Challenges include misattribution risk (harming innocent parties), escalation risk, and jurisdictional violations. The ACDC Act (Active Cyber Defense Certainty) is proposed US legislation that would create limited legal exceptions.
18What is the threat actor group known as the "Shadow Brokers" historically infamous for?
CorrectB: Leaking classified cyber exploitation tools and zero-day vulnerabilities allegedly stolen from the NSA's Equation Group, including EternalBlue which was weaponized in WannaCry
The Shadow Brokers emerged in 2016, claiming to have stolen NSA Equation Group hacking tools and auctioning them. In April 2017, they publicly released a trove of exploits including EternalBlue (MS17-010 SMB exploit) and DoublePulsar. EternalBlue was subsequently weaponized in the WannaCry ransomware attack (May 2017) and NotPetya (June 2017), causing billions in global damages. The group's identity remains unknown.
IncorrectB: Leaking classified cyber exploitation tools and zero-day vulnerabilities allegedly stolen from the NSA's Equation Group, including EternalBlue which was weaponized in WannaCry
The Shadow Brokers emerged in 2016, claiming to have stolen NSA Equation Group hacking tools and auctioning them. In April 2017, they publicly released a trove of exploits including EternalBlue (MS17-010 SMB exploit) and DoublePulsar. EternalBlue was subsequently weaponized in the WannaCry ransomware attack (May 2017) and NotPetya (June 2017), causing billions in global damages. The group's identity remains unknown.
19What is the function of the "Volume Shadow Copy Service" (VSS) from a Windows forensic perspective?
CorrectD: It can contain historical block-level snapshots (shadow copies) of files and directories, allowing investigators to recover deleted files, previous versions, and evidence destroyed during an incident
VSS creates point-in-time snapshots (shadow copies) of volumes. Forensically, they can preserve evidence of: pre-attack file states, files deleted by attackers, previous versions of modified malware configuration files, and registry hives. This is why ransomware routinely deletes shadow copies (vssadmin delete shadows) to prevent recovery. Investigators examine VSS using tools like ShadowExplorer or direct NTFS parsing.
IncorrectD: It can contain historical block-level snapshots (shadow copies) of files and directories, allowing investigators to recover deleted files, previous versions, and evidence destroyed during an incident
VSS creates point-in-time snapshots (shadow copies) of volumes. Forensically, they can preserve evidence of: pre-attack file states, files deleted by attackers, previous versions of modified malware configuration files, and registry hives. This is why ransomware routinely deletes shadow copies (vssadmin delete shadows) to prevent recovery. Investigators examine VSS using tools like ShadowExplorer or direct NTFS parsing.
20In the context of cybercrime prosecution and digital evidence, what is "Spoliation of Evidence"?
CorrectC: The intentional, reckless, or negligent withholding, hiding, altering, or destruction of evidence relevant to a pending or reasonably anticipated legal proceeding
Spoliation is the destruction or material alteration of evidence or failure to preserve evidence for litigation. In civil cases it can result in sanctions (adverse inference instructions, dismissal). In criminal cases it can result in obstruction of justice charges. Organizations must implement litigation holds when a lawsuit is reasonably anticipated to prevent inadvertent spoliation of relevant digital evidence.
IncorrectC: The intentional, reckless, or negligent withholding, hiding, altering, or destruction of evidence relevant to a pending or reasonably anticipated legal proceeding
Spoliation is the destruction or material alteration of evidence or failure to preserve evidence for litigation. In civil cases it can result in sanctions (adverse inference instructions, dismissal). In criminal cases it can result in obstruction of justice charges. Organizations must implement litigation holds when a lawsuit is reasonably anticipated to prevent inadvertent spoliation of relevant digital evidence.
Conclusion: Mastering Cyber Crimes
Understanding cyber crime from both a technical and legal perspective is what separates a reactive defender from a proactive one. Knowing how the CFAA criminalises unauthorized access, how ransomware constitutes extortion under federal law, how the Budapest Convention enables cross-border prosecution, and what makes digital evidence admissible under the Daubert Standard transforms your ability to work with law enforcement and legal teams during incident response.
The questions in this test map directly to domains assessed in certifications like CHFI, CEH, GCFE, and CISSP. Understanding threat actor profiling — from script kiddies to APT nation-state groups — and attribution challenges on the dark web will elevate both your defensive strategy and your ability to advise on incident escalation decisions.
Revisit questions you missed and pair this practice test with the full Cyber Crimes Theory Guide and the Cyber Forensics MCQs for comprehensive exam and interview preparation.
Key Takeaways — Cyber Crimes
- CFAA § 1030 — Van Buren v. United States (2021) narrowed “exceeds authorized access” to accessing data one was not authorised to access, not merely misusing authorised access.
- Three Cybercrime Categories — computer as TARGET (hacking, DDoS), computer as TOOL (phishing, BEC fraud), computer as INCIDENTAL (drug trafficking via encrypted comms).
- Budapest Convention — harmonises offence definitions for extradition; its 24/7 rapid-response network enables urgent cross-border evidence preservation before data is lost.
- Dark Web Attribution — Tor conceals origin IP; Monero obfuscates transactions; attribution typically relies on OPSEC failures (forum posts, IP leaks, PGP key mismatches) rather than technical deanonymisation.
- Chain of Custody — every evidence handler must be documented; hash verification (MD5/SHA-256) proves integrity; a broken chain makes evidence inadmissible under Daubert.
- APT vs Script Kiddie — APT = nation-state/sponsored, months-long dwell time, custom malware, strategic targets; Script Kiddie = opportunistic, uses existing tools, notoriety-seeking.
- MITRE ATT&CK — the industry-standard TTP (Tactics, Techniques, Procedures) framework for mapping adversary behaviour; used for threat intelligence, detection engineering, and red/blue team exercises.
Quick Review & Summary
Use this summary table to consolidate key concepts before or after attempting the questions.
| Crime Category | Key Statute (US) | Description | Notable Example |
|---|---|---|---|
| Unauthorized Access / Hacking | CFAA § 1030(a)(2) | Accessing a protected computer without authorization to obtain data | Equifax breach (2017), 147M records |
| Identity Theft | 18 U.S.C. § 1028 | Unlawful possession/use of another person's identity documents or data | Synthetic identity fraud, SIM-swapping |
| Computer Fraud / Wire Fraud | CFAA § 1030(a)(4), 18 USC § 1343 | Using computer access to defraud or obtain money/property by deception | Phishing, BEC attacks, account takeover fraud |
| Ransomware / Extortion | CFAA § 1030(a)(7), 18 USC § 875 | Threatening to damage or disclose data unless ransom is paid | WannaCry, Colonial Pipeline attack |
| DDoS Attack | CFAA § 1030(a)(5) | Intentionally impairing availability of a protected computer via traffic flooding | Mirai botnet IoT DDoS attacks (2016) |
| IP Theft / Corporate Espionage | Economic Espionage Act, CFAA | Theft of trade secrets, source code, or proprietary data for competitive/national advantage | APT10 (MenuPass) cloud hopper campaign |
Frequently Asked Questions
Q. What is the CFAA and how does it apply to hacking offences?
Q. What are the primary categories of cybercrime?
Q. What is the Budapest Convention's role in cross-border cybercrime prosecution?
Q. What makes dark web attribution technically challenging?
Q. What is chain of custody and why is it critical in cybercrime cases?
Q. What distinguishes a Script Kiddie, Hacktivist, Insider Threat, and APT actor?
Struggling with some questions? Re-read the full Theory Guide: Cyber Crimes