Which of the following types of threat attribution deals with the identification of the specific person, society, or a country sponsoring a well-planned and executed intrusion or attack over its…

Question

Options

• ANation-state attribution
• BTrue attribution
• CCampaign attribution
• DIntrusion-set attribution

• B
  90% (26)
• C
  7% (2)
• D
  3% (1)

Explanation

True attribution is the most comprehensive form of threat attribution - it goes beyond identifying malware families or attack patterns to pinpoint the actual human actor, organization, or nation-state sponsoring the intrusion. The question specifically asks about identifying "the specific person, society, or country," which maps directly to true attribution's goal of definitively naming the responsible party.

Why the distractors are wrong:

• A (Nation-state attribution) is too narrow - it only covers government-backed actors, whereas true attribution encompasses individuals and non-state groups as well.
• C (Campaign attribution) links multiple attacks together based on shared tactics, infrastructure, or targets - it identifies patterns, not the sponsor.
• D (Intrusion-set attribution) groups related intrusions by technical indicators (tools, TTPs) to cluster activity, but stops short of identifying who is behind them.

Memory tip: Think of "true" as "truth" - true attribution is the final truth of who did it, not just how or what pattern they used. If an attribution type sounds like it's categorizing attacks rather than naming people or entities, it's not true attribution.

No community discussion yet for this question.