WannaCry ransomware attack - Quiz
  • 1. Linguistic analysis of the ransom notes suggested the authors were likely fluent in which language?
A) German
B) Spanish
C) Chinese
D) Russian
  • 2. Which tag in the Rich Text Format indicated the presence of Hangul language fonts?
A) \fcharset001
B) \fcharset128
C) \fcharset129
D) \fcharset130
  • 3. Metadata in the ransomware language files indicated the computers were set to which time zone?
A) UTC+09:00
B) UTC+00:00
C) UTC+08:00
D) UTC+07:00
  • 4. Which cybersecurity company stated that the WannaCry code shares similarities with Lazarus Group malware?
A) McAfee
B) Symantec
C) CrowdStrike
D) FireEye
  • 5. The Lazarus Group has been linked to the 2014 cyberattack on which entity?
A) The World Bank
B) The Pentagon
C) The United Nations
D) Sony Pictures
  • 6. Which Microsoft official stated that they believed North Korea was behind the WannaCry attack?
A) Bill Gates
B) Satya Nadella
C) Steve Ballmer
D) Brad Smith
  • 7. On what date did the United States Government formally announce North Korea as the main culprit?
A) 18 December 2016
B) 18 December 2017
C) 20 January 2017
D) 6 September 2018
  • 8. Who wrote an op-ed in The Wall Street Journal regarding the evidence against North Korea?
A) Tom Bossert
B) Donald Trump
C) Brad Smith
D) Park Jin-hyok
  • 9. Which of these countries did NOT agree with the US assessment linking the attack to North Korea?
A) Japan
B) North Korea
C) Canada
D) New Zealand
  • 10. On 6 September 2018, the U.S. Department of Justice announced charges against whom?
A) Kim Il
B) Jon Chang Hyok
C) Kim Jong-un
D) Park Jin-hyok
  • 11. The North Korean hackers were alleged to be affiliated with which organization?
A) Ministry of Defense
B) Reconnaissance General Bureau
C) State Security Department
D) Cyber Warfare Command
  • 12. The Department of Justice unsealed charges against three hackers in which year?
A) 2021
B) 2020
C) 2019
D) 2018
  • 13. What is one reason mentioned for why code similarities might not prove attribution?
A) Open source libraries
B) Software glitches
C) Cyber false flag operation
D) Encryption errors
  • 14. Which organization allegedly linked the creation of the worm to North Korea via an internal memo?
A) FBI
B) NSA
C) DHS
D) CIA
  • 15. Who did Tom Bossert state gave the order to launch the WannaCry attack?
A) Jon Chang Hyok
B) Park Jin-hyok
C) Kim Jong-un
D) Kim Il
  • 16. What did experts advise users to do regarding the ransom payments?
A) Pay using a credit card only
B) Refuse to pay the ransom
C) Pay the ransom immediately
D) Pay only half the requested amount
  • 17. What was the primary reason experts advised against paying the ransom?
A) The payment system was offline
B) No reports of users regaining their data
C) The government prohibited payments
D) The ransom price was considered too low
  • 18. How many total payments were made by June 14, 2017?
A) 100
B) 512
C) 1,000
D) 327
  • 19. Which Windows versions received out-of-band security updates from Microsoft after the attack?
A) Windows 95, Windows 98, and Windows ME
B) Windows 7, Windows 10, and Windows Server 2016
C) Windows XP, Windows Server 2003, and Windows 8
D) Windows 10, Windows 11, and Windows Vista
  • 20. Who was the head of Microsoft's Cyber Defense Operations Center at the time of the attack?
A) Marcus Hutchins
B) Adrienne Hall
C) Bill Gates
D) Matt Suiche
  • 21. Who discovered the initial kill switch domain hardcoded in the WannaCry malware?
A) Check Point analysts
B) Adrienne Hall
C) Matt Suiche
D) Marcus Hutchins
  • 22. How did the DNS sinkhole effectively stop the spread of the ransomware?
A) It deleted the malware from all infected systems
B) It automatically decrypted all stolen data
C) It allowed the malware to connect, preventing file encryption
D) It blocked all internet traffic for infected computers
  • 23. Who registered the second kill-switch variant on 14 May?
A) Marcus Hutchins
B) Microsoft engineers
C) Matt Suiche
D) Adrienne Hall
  • 24. What did hackers attempt to use against the kill-switch domain on 19 May?
A) A sophisticated SQL injection attack
B) A Mirai botnet variant for a DDoS attack
C) A brute-force password cracking tool
D) A phishing campaign targeting the researchers
  • 25. What was the purpose of the PayBreak system developed by researchers?
A) Recovering encryption keys to defeat ransomware
B) Installing security patches automatically
C) Detecting the location of the hackers
D) Blocking all incoming network packets
  • 26. What does the tool 'WannaKey' specifically automate?
A) Updating Windows systems automatically
B) Deleting the ransomware from the hard drive
C) Retrieving private keys from memory on Windows XP
D) Blocking the kill-switch domain
  • 27. Which operating systems were compatible with the Wanakiwi tool?
A) Windows 10 and Windows 11
B) Windows 7 and Server 2008 R2
C) Windows 95 and Windows 98
D) Windows XP and Windows 8
  • 28. Why did the ransomware fail to encrypt files if the kill-switch domain was connected?
A) The malware required internet permission to run
B) The domain contained a decryption script
C) The domain sent a command to kill the process
D) The malware was programmed only to encrypt if connection failed
  • 29. What happens to the prime numbers used for keys if the computer is rebooted?
A) They become stronger and harder to retrieve
B) They may be cleared from the memory
C) They are permanently saved to the disk
D) They are sent to the hackers' server
  • 30. How long did it take for new infections to slow to a trickle after the response began?
A) Within four days
B) Within one month
C) Within 24 hours
D) Within one week
  • 31. What form of payment did the WannaCry ransomware demand?
A) PayPal
B) Bank transfer
C) Bitcoin cryptocurrency
D) Credit card
  • 32. Which group leaked the EternalBlue exploit used by WannaCry?
A) The Shadow Brokers
B) Anonymous
C) RiskSense
D) LulzSec
  • 33. Who developed the EternalBlue exploit?
A) Marcus Hutchins
B) Microsoft
C) United States National Security Agency
D) The Shadow Brokers
  • 34. Approximately how many computers were affected by the WannaCry attack?
A) More than 300,000
B) Less than 10,000
C) Around 50,000
D) Exactly 150,000
  • 35. How many countries were affected by the WannaCry attack?
A) 100
B) 200
C) 150
D) 50
  • 36. What company was forced to temporarily shut down factories due to a new WannaCry variant in 2018?
A) McAfee
B) Microsoft
C) Cisco
D) Taiwan Semiconductor Manufacturing Company
  • 37. What does WannaCry use to gain access to vulnerable systems?
A) EternalBlue
B) Shadow copies
C) Bitcoin wallets
D) DoublePulsar
  • 38. What tool does WannaCry use to install and execute a copy of itself?
A) GitHub
B) DoublePulsar
C) Visual C++ 6.0
D) EternalBlue
  • 39. What is the initial ransom demand for WannaCry within three days?
A) US$1,000
B) US$300
C) US$100
D) US$600
  • 40. Which organization released code on GitHub allowing white hat testers to test the vulnerability?
A) Symantec
B) Cisco
C) Microsoft
D) RiskSense
  • 41. What language were WannaCry versions 0, 1, and 2 created with?
A) Microsoft Visual C++ 6.0
B) Python
C) Assembly
D) Java
  • 42. What did the WannaCry malware delete on local systems?
A) Bitcoin addresses
B) Shadow copies
C) Binary files
D) Configuration files
  • 43. Where did evidence point to the initial infection taking place?
A) North America
B) South America
C) Asia
D) Europe
  • 44. What was the primary suspected method of infection instead of email phishing?
A) A compromised website advertisement
B) A malicious USB drive
C) An exposed vulnerable SMB port
D) A peer-to-peer file transfer
  • 45. When was the last security patch released for Windows Server 2003?
A) April 2014
B) March 2017
C) December 2016
D) July 2015
  • 46. What percentage of the affected computers were running Windows 7?
A) 25 percent
B) 50 percent
C) 75 percent
D) 98 percent
  • 47. Under what condition did WannaCry operate on Windows XP?
A) When installed via email phishing
B) When executed manually
C) When initiated via SMB port
D) When connected to the internet
  • 48. According to Kaspersky Lab, which country was NOT listed as one of the four most affected?
A) England
B) Taiwan
C) India
D) Russia
  • 49. Which of these devices was mentioned as being affected in NHS hospitals?
A) Cardiac monitors
B) Ventilators
C) Digital patient records
D) MRI scanners
  • 50. How many NHS trusts in England were found to be affected by the National Audit Office?
A) 200
B) At least 81
C) 42
D) 236
  • 51. Which car manufacturer halted production in Tyne and Wear due to the attack?
A) Volkswagen
B) Ford
C) Nissan
D) Renault
  • 52. Who stated that the patching and updating systems are broken in both private and government sectors?
A) Adam Segal
B) Arne Schönbohm
C) Brad Smith
D) Vladimir Putin
  • 53. Which Russian leader blamed the U.S. intelligence services for the attack?
A) Mikhail Gorbachev
B) Boris Yeltsin
C) Dmitry Medvedev
D) Vladimir Putin
Created with That Quiz — a math test site for students of all grade levels.