FREE ASSESSMENT / Research investigation

AA23-263A Snatch Safe-Mode Encryption and Dwell-Time Analysis

Investigate Snatch's RDP entry, bulletproof-hosted command-and-control, long dwell time, service manipulation, Safe Mode boot, shadow-copy removal, filename masquerading, and recovery note.

Log in to take this assessment Create a free account Review preparation
Questions
6
Suggested working time
45 min
Pass threshold
75%
Answer format
Single-choice answers

Allow time to read the instructions and consult any permitted sources. The suggested duration is not an enforced countdown on this page.

What this assessment checks

Cyber Threat Intelligence

Ransomware Execution Analysis

Who it’s for

Analysts comfortable consulting source reporting and technical documentation. Follow the source requirements in the assessment instructions.

Scope and limits

An independent Threat Intelligence Lab knowledge assessment. A result records your performance on these questions; it does not establish operational readiness, identity verification or an external professional qualification.

PREPARE WITH PURPOSE

Before you begin

Review the instructions and source requirements. Choose the best supported answer, including any uncertainty or limits described in the question.

These related courses can help you prepare. They are optional study routes, not a promise that every assessment question is covered.

Instructions and scoring

Use the FBI and CISA official AA23-263A advisory. Verify historical naming, access and C2 infrastructure, dwell time, service tooling, exact Safe Mode and recovery commands, filename behavior, note name, and victim communications.

  • Select one answer for each question. Required questions are marked.
  • Question points determine the score. The configured pass threshold is 75%.
  • Submitting records your result. Review your saved result in your profile.

A passing result can produce a Threat Intelligence Lab platform certificate. This is an independent learning record, not an accredited qualification or a third-party vendor certification. This assessment does not verify your identity or proctor your environment.

CONTINUE YOUR LEARNING

Research investigation

AA25-212A Critical-Infrastructure Hunt Gap Analysis

Use the CISA and U.S. Coast Guard hunt report to decide which observed configuration and logging gaps would prevent defensible incident analysis in an IT/OT environment.

6 questions · 35 min suggested

Professional assessment

The ShinyHunters Cybercrime Collective: Operations, Techniques, and Impact

This exam assesses knowledge of the ShinyHunters hacking group, a prolific cybercriminal collective known for large-scale data breaches, extortion, and data sales on underground forums. The exam covers their key victims (2020-2025), operational tactics, infrastructure, affiliations, and law enforcement countermeasures.

15 questions · 40 min suggested

Research investigation

AA23-108 APT28 Router Exploitation Analysis

Research how APT28 used weak SNMP configuration and a known Cisco vulnerability to enumerate routers, deploy Jaguar Tooth, collect network data, and maintain covert access.

6 questions · 40 min suggested

About this learning material

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.