ThatQuiz Test Library Take this test now
WannaCry ransomware attack - Quiz
Contributed by: Coe
  • 1. Linguistic analysis of the ransom notes suggested the authors were likely fluent in which language?
A) German
B) Chinese
C) Spanish
D) Russian
  • 2. Which tag in the Rich Text Format indicated the presence of Hangul language fonts?
A) \fcharset130
B) \fcharset129
C) \fcharset001
D) \fcharset128
  • 3. Metadata in the ransomware language files indicated the computers were set to which time zone?
A) UTC+07:00
B) UTC+00:00
C) UTC+09:00
D) UTC+08:00
  • 4. Which cybersecurity company stated that the WannaCry code shares similarities with Lazarus Group malware?
A) McAfee
B) FireEye
C) CrowdStrike
D) Symantec
  • 5. The Lazarus Group has been linked to the 2014 cyberattack on which entity?
A) The World Bank
B) The United Nations
C) Sony Pictures
D) The Pentagon
  • 6. Which Microsoft official stated that they believed North Korea was behind the WannaCry attack?
A) Satya Nadella
B) Steve Ballmer
C) Bill Gates
D) Brad Smith
  • 7. On what date did the United States Government formally announce North Korea as the main culprit?
A) 18 December 2016
B) 6 September 2018
C) 20 January 2017
D) 18 December 2017
  • 8. Who wrote an op-ed in The Wall Street Journal regarding the evidence against North Korea?
A) Tom Bossert
B) Brad Smith
C) Park Jin-hyok
D) Donald Trump
  • 9. Which of these countries did NOT agree with the US assessment linking the attack to North Korea?
A) Japan
B) Canada
C) New Zealand
D) North Korea
  • 10. On 6 September 2018, the U.S. Department of Justice announced charges against whom?
A) Kim Jong-un
B) Kim Il
C) Park Jin-hyok
D) Jon Chang Hyok
  • 11. The North Korean hackers were alleged to be affiliated with which organization?
A) Reconnaissance General Bureau
B) Ministry of Defense
C) State Security Department
D) Cyber Warfare Command
  • 12. The Department of Justice unsealed charges against three hackers in which year?
A) 2019
B) 2020
C) 2021
D) 2018
  • 13. What is one reason mentioned for why code similarities might not prove attribution?
A) Encryption errors
B) Cyber false flag operation
C) Software glitches
D) Open source libraries
  • 14. Which organization allegedly linked the creation of the worm to North Korea via an internal memo?
A) NSA
B) FBI
C) CIA
D) DHS
  • 15. Who did Tom Bossert state gave the order to launch the WannaCry attack?
A) Kim Il
B) Kim Jong-un
C) Park Jin-hyok
D) Jon Chang Hyok
  • 16. What did experts advise users to do regarding the ransom payments?
A) Pay the ransom immediately
B) Pay only half the requested amount
C) Refuse to pay the ransom
D) Pay using a credit card only
  • 17. What was the primary reason experts advised against paying the ransom?
A) The government prohibited payments
B) The payment system was offline
C) No reports of users regaining their data
D) The ransom price was considered too low
  • 18. How many total payments were made by June 14, 2017?
A) 100
B) 512
C) 1,000
D) 327
  • 19. Which Windows versions received out-of-band security updates from Microsoft after the attack?
A) Windows 7, Windows 10, and Windows Server 2016
B) Windows XP, Windows Server 2003, and Windows 8
C) Windows 10, Windows 11, and Windows Vista
D) Windows 95, Windows 98, and Windows ME
  • 20. Who was the head of Microsoft's Cyber Defense Operations Center at the time of the attack?
A) Adrienne Hall
B) Marcus Hutchins
C) Matt Suiche
D) Bill Gates
  • 21. Who discovered the initial kill switch domain hardcoded in the WannaCry malware?
A) Matt Suiche
B) Marcus Hutchins
C) Check Point analysts
D) Adrienne Hall
  • 22. How did the DNS sinkhole effectively stop the spread of the ransomware?
A) It automatically decrypted all stolen data
B) It blocked all internet traffic for infected computers
C) It allowed the malware to connect, preventing file encryption
D) It deleted the malware from all infected systems
  • 23. Who registered the second kill-switch variant on 14 May?
A) Microsoft engineers
B) Marcus Hutchins
C) Matt Suiche
D) Adrienne Hall
  • 24. What did hackers attempt to use against the kill-switch domain on 19 May?
A) A sophisticated SQL injection attack
B) A brute-force password cracking tool
C) A Mirai botnet variant for a DDoS attack
D) A phishing campaign targeting the researchers
  • 25. What was the purpose of the PayBreak system developed by researchers?
A) Blocking all incoming network packets
B) Installing security patches automatically
C) Recovering encryption keys to defeat ransomware
D) Detecting the location of the hackers
  • 26. What does the tool 'WannaKey' specifically automate?
A) Retrieving private keys from memory on Windows XP
B) Blocking the kill-switch domain
C) Deleting the ransomware from the hard drive
D) Updating Windows systems automatically
  • 27. Which operating systems were compatible with the Wanakiwi tool?
A) Windows 7 and Server 2008 R2
B) Windows 95 and Windows 98
C) Windows 10 and Windows 11
D) Windows XP and Windows 8
  • 28. Why did the ransomware fail to encrypt files if the kill-switch domain was connected?
A) The malware required internet permission to run
B) The domain contained a decryption script
C) The malware was programmed only to encrypt if connection failed
D) The domain sent a command to kill the process
  • 29. What happens to the prime numbers used for keys if the computer is rebooted?
A) They are permanently saved to the disk
B) They are sent to the hackers' server
C) They may be cleared from the memory
D) They become stronger and harder to retrieve
  • 30. How long did it take for new infections to slow to a trickle after the response began?
A) Within one month
B) Within one week
C) Within four days
D) Within 24 hours
  • 31. What form of payment did the WannaCry ransomware demand?
A) Bank transfer
B) Bitcoin cryptocurrency
C) Credit card
D) PayPal
  • 32. Which group leaked the EternalBlue exploit used by WannaCry?
A) LulzSec
B) The Shadow Brokers
C) Anonymous
D) RiskSense
  • 33. Who developed the EternalBlue exploit?
A) Marcus Hutchins
B) United States National Security Agency
C) The Shadow Brokers
D) Microsoft
  • 34. Approximately how many computers were affected by the WannaCry attack?
A) Exactly 150,000
B) More than 300,000
C) Around 50,000
D) Less than 10,000
  • 35. How many countries were affected by the WannaCry attack?
A) 200
B) 150
C) 50
D) 100
  • 36. What company was forced to temporarily shut down factories due to a new WannaCry variant in 2018?
A) Cisco
B) Microsoft
C) McAfee
D) Taiwan Semiconductor Manufacturing Company
  • 37. What does WannaCry use to gain access to vulnerable systems?
A) Bitcoin wallets
B) DoublePulsar
C) Shadow copies
D) EternalBlue
  • 38. What tool does WannaCry use to install and execute a copy of itself?
A) EternalBlue
B) GitHub
C) DoublePulsar
D) Visual C++ 6.0
  • 39. What is the initial ransom demand for WannaCry within three days?
A) US$100
B) US$300
C) US$600
D) US$1,000
  • 40. Which organization released code on GitHub allowing white hat testers to test the vulnerability?
A) RiskSense
B) Cisco
C) Symantec
D) Microsoft
  • 41. What language were WannaCry versions 0, 1, and 2 created with?
A) Assembly
B) Microsoft Visual C++ 6.0
C) Python
D) Java
  • 42. What did the WannaCry malware delete on local systems?
A) Shadow copies
B) Binary files
C) Configuration files
D) Bitcoin addresses
  • 43. Where did evidence point to the initial infection taking place?
A) Asia
B) North America
C) Europe
D) South America
  • 44. What was the primary suspected method of infection instead of email phishing?
A) A malicious USB drive
B) A compromised website advertisement
C) A peer-to-peer file transfer
D) An exposed vulnerable SMB port
  • 45. When was the last security patch released for Windows Server 2003?
A) April 2014
B) December 2016
C) March 2017
D) July 2015
  • 46. What percentage of the affected computers were running Windows 7?
A) 25 percent
B) 75 percent
C) 98 percent
D) 50 percent
  • 47. Under what condition did WannaCry operate on Windows XP?
A) When connected to the internet
B) When installed via email phishing
C) When initiated via SMB port
D) When executed manually
  • 48. According to Kaspersky Lab, which country was NOT listed as one of the four most affected?
A) India
B) Taiwan
C) Russia
D) England
  • 49. Which of these devices was mentioned as being affected in NHS hospitals?
A) Ventilators
B) Cardiac monitors
C) MRI scanners
D) Digital patient records
  • 50. How many NHS trusts in England were found to be affected by the National Audit Office?
A) 236
B) 200
C) 42
D) At least 81
  • 51. Which car manufacturer halted production in Tyne and Wear due to the attack?
A) Nissan
B) Volkswagen
C) Renault
D) Ford
  • 52. Who stated that the patching and updating systems are broken in both private and government sectors?
A) Brad Smith
B) Adam Segal
C) Arne Schönbohm
D) Vladimir Putin
  • 53. Which Russian leader blamed the U.S. intelligence services for the attack?
A) Vladimir Putin
B) Mikhail Gorbachev
C) Boris Yeltsin
D) Dmitry Medvedev
Created with That Quiz — a math test site for students of all grade levels.