WannaCry ransomware attack - Quiz
  • 1. Linguistic analysis of the ransom notes suggested the authors were likely fluent in which language?
A) German
B) Chinese
C) Spanish
D) Russian
  • 2. Which tag in the Rich Text Format indicated the presence of Hangul language fonts?
A) \fcharset001
B) \fcharset130
C) \fcharset129
D) \fcharset128
  • 3. Metadata in the ransomware language files indicated the computers were set to which time zone?
A) UTC+00:00
B) UTC+07:00
C) UTC+09:00
D) UTC+08:00
  • 4. Which cybersecurity company stated that the WannaCry code shares similarities with Lazarus Group malware?
A) Symantec
B) McAfee
C) CrowdStrike
D) FireEye
  • 5. The Lazarus Group has been linked to the 2014 cyberattack on which entity?
A) The World Bank
B) The Pentagon
C) The United Nations
D) Sony Pictures
  • 6. Which Microsoft official stated that they believed North Korea was behind the WannaCry attack?
A) Steve Ballmer
B) Brad Smith
C) Satya Nadella
D) Bill Gates
  • 7. On what date did the United States Government formally announce North Korea as the main culprit?
A) 18 December 2016
B) 18 December 2017
C) 20 January 2017
D) 6 September 2018
  • 8. Who wrote an op-ed in The Wall Street Journal regarding the evidence against North Korea?
A) Tom Bossert
B) Donald Trump
C) Brad Smith
D) Park Jin-hyok
  • 9. Which of these countries did NOT agree with the US assessment linking the attack to North Korea?
A) Japan
B) New Zealand
C) Canada
D) North Korea
  • 10. On 6 September 2018, the U.S. Department of Justice announced charges against whom?
A) Kim Jong-un
B) Jon Chang Hyok
C) Park Jin-hyok
D) Kim Il
  • 11. The North Korean hackers were alleged to be affiliated with which organization?
A) Cyber Warfare Command
B) Ministry of Defense
C) State Security Department
D) Reconnaissance General Bureau
  • 12. The Department of Justice unsealed charges against three hackers in which year?
A) 2020
B) 2021
C) 2018
D) 2019
  • 13. What is one reason mentioned for why code similarities might not prove attribution?
A) Encryption errors
B) Open source libraries
C) Software glitches
D) Cyber false flag operation
  • 14. Which organization allegedly linked the creation of the worm to North Korea via an internal memo?
A) NSA
B) FBI
C) DHS
D) CIA
  • 15. Who did Tom Bossert state gave the order to launch the WannaCry attack?
A) Park Jin-hyok
B) Kim Il
C) Jon Chang Hyok
D) Kim Jong-un
  • 16. What did experts advise users to do regarding the ransom payments?
A) Pay only half the requested amount
B) Pay the ransom immediately
C) Refuse to pay the ransom
D) Pay using a credit card only
  • 17. What was the primary reason experts advised against paying the ransom?
A) The payment system was offline
B) The ransom price was considered too low
C) The government prohibited payments
D) No reports of users regaining their data
  • 18. How many total payments were made by June 14, 2017?
A) 327
B) 100
C) 1,000
D) 512
  • 19. Which Windows versions received out-of-band security updates from Microsoft after the attack?
A) Windows 95, Windows 98, and Windows ME
B) Windows 7, Windows 10, and Windows Server 2016
C) Windows XP, Windows Server 2003, and Windows 8
D) Windows 10, Windows 11, and Windows Vista
  • 20. Who was the head of Microsoft's Cyber Defense Operations Center at the time of the attack?
A) Marcus Hutchins
B) Adrienne Hall
C) Matt Suiche
D) Bill Gates
  • 21. Who discovered the initial kill switch domain hardcoded in the WannaCry malware?
A) Matt Suiche
B) Marcus Hutchins
C) Check Point analysts
D) Adrienne Hall
  • 22. How did the DNS sinkhole effectively stop the spread of the ransomware?
A) It deleted the malware from all infected systems
B) It automatically decrypted all stolen data
C) It allowed the malware to connect, preventing file encryption
D) It blocked all internet traffic for infected computers
  • 23. Who registered the second kill-switch variant on 14 May?
A) Microsoft engineers
B) Matt Suiche
C) Adrienne Hall
D) Marcus Hutchins
  • 24. What did hackers attempt to use against the kill-switch domain on 19 May?
A) A brute-force password cracking tool
B) A sophisticated SQL injection attack
C) A Mirai botnet variant for a DDoS attack
D) A phishing campaign targeting the researchers
  • 25. What was the purpose of the PayBreak system developed by researchers?
A) Detecting the location of the hackers
B) Recovering encryption keys to defeat ransomware
C) Installing security patches automatically
D) Blocking all incoming network packets
  • 26. What does the tool 'WannaKey' specifically automate?
A) Retrieving private keys from memory on Windows XP
B) Updating Windows systems automatically
C) Deleting the ransomware from the hard drive
D) Blocking the kill-switch domain
  • 27. Which operating systems were compatible with the Wanakiwi tool?
A) Windows XP and Windows 8
B) Windows 95 and Windows 98
C) Windows 10 and Windows 11
D) Windows 7 and Server 2008 R2
  • 28. Why did the ransomware fail to encrypt files if the kill-switch domain was connected?
A) The domain sent a command to kill the process
B) The domain contained a decryption script
C) The malware required internet permission to run
D) The malware was programmed only to encrypt if connection failed
  • 29. What happens to the prime numbers used for keys if the computer is rebooted?
A) They may be cleared from the memory
B) They are permanently saved to the disk
C) They become stronger and harder to retrieve
D) They are sent to the hackers' server
  • 30. How long did it take for new infections to slow to a trickle after the response began?
A) Within one month
B) Within 24 hours
C) Within one week
D) Within four days
  • 31. What form of payment did the WannaCry ransomware demand?
A) Bitcoin cryptocurrency
B) PayPal
C) Credit card
D) Bank transfer
  • 32. Which group leaked the EternalBlue exploit used by WannaCry?
A) RiskSense
B) The Shadow Brokers
C) Anonymous
D) LulzSec
  • 33. Who developed the EternalBlue exploit?
A) Microsoft
B) United States National Security Agency
C) Marcus Hutchins
D) The Shadow Brokers
  • 34. Approximately how many computers were affected by the WannaCry attack?
A) More than 300,000
B) Less than 10,000
C) Around 50,000
D) Exactly 150,000
  • 35. How many countries were affected by the WannaCry attack?
A) 150
B) 50
C) 200
D) 100
  • 36. What company was forced to temporarily shut down factories due to a new WannaCry variant in 2018?
A) Taiwan Semiconductor Manufacturing Company
B) McAfee
C) Microsoft
D) Cisco
  • 37. What does WannaCry use to gain access to vulnerable systems?
A) Shadow copies
B) DoublePulsar
C) EternalBlue
D) Bitcoin wallets
  • 38. What tool does WannaCry use to install and execute a copy of itself?
A) DoublePulsar
B) Visual C++ 6.0
C) EternalBlue
D) GitHub
  • 39. What is the initial ransom demand for WannaCry within three days?
A) US$100
B) US$600
C) US$300
D) US$1,000
  • 40. Which organization released code on GitHub allowing white hat testers to test the vulnerability?
A) RiskSense
B) Microsoft
C) Symantec
D) Cisco
  • 41. What language were WannaCry versions 0, 1, and 2 created with?
A) Java
B) Assembly
C) Python
D) Microsoft Visual C++ 6.0
  • 42. What did the WannaCry malware delete on local systems?
A) Binary files
B) Bitcoin addresses
C) Shadow copies
D) Configuration files
  • 43. Where did evidence point to the initial infection taking place?
A) North America
B) South America
C) Asia
D) Europe
  • 44. What was the primary suspected method of infection instead of email phishing?
A) A compromised website advertisement
B) A peer-to-peer file transfer
C) An exposed vulnerable SMB port
D) A malicious USB drive
  • 45. When was the last security patch released for Windows Server 2003?
A) July 2015
B) December 2016
C) April 2014
D) March 2017
  • 46. What percentage of the affected computers were running Windows 7?
A) 75 percent
B) 50 percent
C) 98 percent
D) 25 percent
  • 47. Under what condition did WannaCry operate on Windows XP?
A) When installed via email phishing
B) When executed manually
C) When initiated via SMB port
D) When connected to the internet
  • 48. According to Kaspersky Lab, which country was NOT listed as one of the four most affected?
A) Taiwan
B) England
C) India
D) Russia
  • 49. Which of these devices was mentioned as being affected in NHS hospitals?
A) Digital patient records
B) MRI scanners
C) Cardiac monitors
D) Ventilators
  • 50. How many NHS trusts in England were found to be affected by the National Audit Office?
A) 236
B) 42
C) At least 81
D) 200
  • 51. Which car manufacturer halted production in Tyne and Wear due to the attack?
A) Renault
B) Ford
C) Volkswagen
D) Nissan
  • 52. Who stated that the patching and updating systems are broken in both private and government sectors?
A) Arne Schönbohm
B) Vladimir Putin
C) Adam Segal
D) Brad Smith
  • 53. Which Russian leader blamed the U.S. intelligence services for the attack?
A) Vladimir Putin
B) Boris Yeltsin
C) Dmitry Medvedev
D) Mikhail Gorbachev
Created with That Quiz — a math test site for students of all grade levels.