ThatQuiz Test Library Take this test now
WannaCry ransomware attack - Quiz
Contributed by: Coe
  • 1. Linguistic analysis of the ransom notes suggested the authors were likely fluent in which language?
A) Russian
B) Chinese
C) German
D) Spanish
  • 2. Which tag in the Rich Text Format indicated the presence of Hangul language fonts?
A) \fcharset001
B) \fcharset130
C) \fcharset128
D) \fcharset129
  • 3. Metadata in the ransomware language files indicated the computers were set to which time zone?
A) UTC+09:00
B) UTC+07:00
C) UTC+00:00
D) UTC+08:00
  • 4. Which cybersecurity company stated that the WannaCry code shares similarities with Lazarus Group malware?
A) McAfee
B) Symantec
C) FireEye
D) CrowdStrike
  • 5. The Lazarus Group has been linked to the 2014 cyberattack on which entity?
A) The World Bank
B) The United Nations
C) Sony Pictures
D) The Pentagon
  • 6. Which Microsoft official stated that they believed North Korea was behind the WannaCry attack?
A) Satya Nadella
B) Steve Ballmer
C) Bill Gates
D) Brad Smith
  • 7. On what date did the United States Government formally announce North Korea as the main culprit?
A) 20 January 2017
B) 6 September 2018
C) 18 December 2017
D) 18 December 2016
  • 8. Who wrote an op-ed in The Wall Street Journal regarding the evidence against North Korea?
A) Park Jin-hyok
B) Tom Bossert
C) Donald Trump
D) Brad Smith
  • 9. Which of these countries did NOT agree with the US assessment linking the attack to North Korea?
A) New Zealand
B) North Korea
C) Japan
D) Canada
  • 10. On 6 September 2018, the U.S. Department of Justice announced charges against whom?
A) Jon Chang Hyok
B) Kim Jong-un
C) Kim Il
D) Park Jin-hyok
  • 11. The North Korean hackers were alleged to be affiliated with which organization?
A) Ministry of Defense
B) Cyber Warfare Command
C) State Security Department
D) Reconnaissance General Bureau
  • 12. The Department of Justice unsealed charges against three hackers in which year?
A) 2018
B) 2021
C) 2020
D) 2019
  • 13. What is one reason mentioned for why code similarities might not prove attribution?
A) Cyber false flag operation
B) Encryption errors
C) Open source libraries
D) Software glitches
  • 14. Which organization allegedly linked the creation of the worm to North Korea via an internal memo?
A) DHS
B) CIA
C) FBI
D) NSA
  • 15. Who did Tom Bossert state gave the order to launch the WannaCry attack?
A) Jon Chang Hyok
B) Park Jin-hyok
C) Kim Il
D) Kim Jong-un
  • 16. What did experts advise users to do regarding the ransom payments?
A) Pay only half the requested amount
B) Pay using a credit card only
C) Pay the ransom immediately
D) Refuse to pay the ransom
  • 17. What was the primary reason experts advised against paying the ransom?
A) The payment system was offline
B) The ransom price was considered too low
C) The government prohibited payments
D) No reports of users regaining their data
  • 18. How many total payments were made by June 14, 2017?
A) 1,000
B) 512
C) 100
D) 327
  • 19. Which Windows versions received out-of-band security updates from Microsoft after the attack?
A) Windows 7, Windows 10, and Windows Server 2016
B) Windows XP, Windows Server 2003, and Windows 8
C) Windows 95, Windows 98, and Windows ME
D) Windows 10, Windows 11, and Windows Vista
  • 20. Who was the head of Microsoft's Cyber Defense Operations Center at the time of the attack?
A) Bill Gates
B) Matt Suiche
C) Marcus Hutchins
D) Adrienne Hall
  • 21. Who discovered the initial kill switch domain hardcoded in the WannaCry malware?
A) Check Point analysts
B) Adrienne Hall
C) Matt Suiche
D) Marcus Hutchins
  • 22. How did the DNS sinkhole effectively stop the spread of the ransomware?
A) It allowed the malware to connect, preventing file encryption
B) It blocked all internet traffic for infected computers
C) It deleted the malware from all infected systems
D) It automatically decrypted all stolen data
  • 23. Who registered the second kill-switch variant on 14 May?
A) Matt Suiche
B) Microsoft engineers
C) Marcus Hutchins
D) Adrienne Hall
  • 24. What did hackers attempt to use against the kill-switch domain on 19 May?
A) A sophisticated SQL injection attack
B) A brute-force password cracking tool
C) A phishing campaign targeting the researchers
D) A Mirai botnet variant for a DDoS attack
  • 25. What was the purpose of the PayBreak system developed by researchers?
A) Blocking all incoming network packets
B) Recovering encryption keys to defeat ransomware
C) Detecting the location of the hackers
D) Installing security patches automatically
  • 26. What does the tool 'WannaKey' specifically automate?
A) Updating Windows systems automatically
B) Retrieving private keys from memory on Windows XP
C) Deleting the ransomware from the hard drive
D) Blocking the kill-switch domain
  • 27. Which operating systems were compatible with the Wanakiwi tool?
A) Windows 7 and Server 2008 R2
B) Windows 95 and Windows 98
C) Windows 10 and Windows 11
D) Windows XP and Windows 8
  • 28. Why did the ransomware fail to encrypt files if the kill-switch domain was connected?
A) The malware required internet permission to run
B) The domain contained a decryption script
C) The malware was programmed only to encrypt if connection failed
D) The domain sent a command to kill the process
  • 29. What happens to the prime numbers used for keys if the computer is rebooted?
A) They are sent to the hackers' server
B) They are permanently saved to the disk
C) They may be cleared from the memory
D) They become stronger and harder to retrieve
  • 30. How long did it take for new infections to slow to a trickle after the response began?
A) Within 24 hours
B) Within one month
C) Within four days
D) Within one week
  • 31. What form of payment did the WannaCry ransomware demand?
A) Bitcoin cryptocurrency
B) Credit card
C) PayPal
D) Bank transfer
  • 32. Which group leaked the EternalBlue exploit used by WannaCry?
A) LulzSec
B) RiskSense
C) The Shadow Brokers
D) Anonymous
  • 33. Who developed the EternalBlue exploit?
A) The Shadow Brokers
B) United States National Security Agency
C) Marcus Hutchins
D) Microsoft
  • 34. Approximately how many computers were affected by the WannaCry attack?
A) More than 300,000
B) Exactly 150,000
C) Less than 10,000
D) Around 50,000
  • 35. How many countries were affected by the WannaCry attack?
A) 200
B) 100
C) 150
D) 50
  • 36. What company was forced to temporarily shut down factories due to a new WannaCry variant in 2018?
A) Cisco
B) Taiwan Semiconductor Manufacturing Company
C) McAfee
D) Microsoft
  • 37. What does WannaCry use to gain access to vulnerable systems?
A) DoublePulsar
B) EternalBlue
C) Shadow copies
D) Bitcoin wallets
  • 38. What tool does WannaCry use to install and execute a copy of itself?
A) DoublePulsar
B) EternalBlue
C) Visual C++ 6.0
D) GitHub
  • 39. What is the initial ransom demand for WannaCry within three days?
A) US$300
B) US$600
C) US$100
D) US$1,000
  • 40. Which organization released code on GitHub allowing white hat testers to test the vulnerability?
A) RiskSense
B) Microsoft
C) Symantec
D) Cisco
  • 41. What language were WannaCry versions 0, 1, and 2 created with?
A) Java
B) Assembly
C) Microsoft Visual C++ 6.0
D) Python
  • 42. What did the WannaCry malware delete on local systems?
A) Configuration files
B) Binary files
C) Bitcoin addresses
D) Shadow copies
  • 43. Where did evidence point to the initial infection taking place?
A) Europe
B) South America
C) Asia
D) North America
  • 44. What was the primary suspected method of infection instead of email phishing?
A) A peer-to-peer file transfer
B) A malicious USB drive
C) A compromised website advertisement
D) An exposed vulnerable SMB port
  • 45. When was the last security patch released for Windows Server 2003?
A) April 2014
B) July 2015
C) March 2017
D) December 2016
  • 46. What percentage of the affected computers were running Windows 7?
A) 75 percent
B) 25 percent
C) 98 percent
D) 50 percent
  • 47. Under what condition did WannaCry operate on Windows XP?
A) When executed manually
B) When installed via email phishing
C) When connected to the internet
D) When initiated via SMB port
  • 48. According to Kaspersky Lab, which country was NOT listed as one of the four most affected?
A) Taiwan
B) England
C) India
D) Russia
  • 49. Which of these devices was mentioned as being affected in NHS hospitals?
A) Cardiac monitors
B) Digital patient records
C) Ventilators
D) MRI scanners
  • 50. How many NHS trusts in England were found to be affected by the National Audit Office?
A) At least 81
B) 200
C) 42
D) 236
  • 51. Which car manufacturer halted production in Tyne and Wear due to the attack?
A) Volkswagen
B) Renault
C) Nissan
D) Ford
  • 52. Who stated that the patching and updating systems are broken in both private and government sectors?
A) Adam Segal
B) Arne Schönbohm
C) Vladimir Putin
D) Brad Smith
  • 53. Which Russian leader blamed the U.S. intelligence services for the attack?
A) Vladimir Putin
B) Boris Yeltsin
C) Dmitry Medvedev
D) Mikhail Gorbachev
Created with That Quiz — a math test site for students of all grade levels.