FREE ASSESSMENT / Research investigation

AA23-352A Play Ransomware Windows-to-ESXi Technical Hunt

Compare Play's Windows and ESXi operations, initial-access CVEs, custom discovery tooling, Group Policy distribution, intermittent encryption, and campaign-specific recompilation.

Log in to take this assessment Create a free account Review preparation
Questions
6
Suggested working time
45 min
Pass threshold
75%
Answer format
Single-choice answers

Allow time to read the instructions and consult any permitted sources. The suggested duration is not an enforced countdown on this page.

What this assessment checks

Cyber Threat Intelligence

Cross Platform Ransomware

Who it’s for

Analysts comfortable consulting source reporting and technical documentation. Follow the source requirements in the assessment instructions.

Scope and limits

An independent Threat Intelligence Lab knowledge assessment. A result records your performance on these questions; it does not establish operational readiness, identity verification or an external professional qualification.

PREPARE WITH PURPOSE

Before you begin

Review the instructions and source requirements. Choose the best supported answer, including any uncertainty or limits described in the question.

These related courses can help you prepare. They are optional study routes, not a promise that every assessment question is covered.

Instructions and scoring

Use CISA's official AA23-352A advisory and its June 2025 update. Verify current victim scale, access CVEs, discovery tooling, deployment method, encryption parameters, and ESXi-specific behavior.

  • Select one answer for each question. Required questions are marked.
  • Question points determine the score. The configured pass threshold is 75%.
  • Submitting records your result. Review your saved result in your profile.

A passing result can produce a Threat Intelligence Lab platform certificate. This is an independent learning record, not an accredited qualification or a third-party vendor certification. This assessment does not verify your identity or proctor your environment.

CONTINUE YOUR LEARNING

Research investigation

AA25-212A Critical-Infrastructure Hunt Gap Analysis

Use the CISA and U.S. Coast Guard hunt report to decide which observed configuration and logging gaps would prevent defensible incident analysis in an IT/OT environment.

6 questions · 35 min suggested

Professional assessment

The ShinyHunters Cybercrime Collective: Operations, Techniques, and Impact

This exam assesses knowledge of the ShinyHunters hacking group, a prolific cybercriminal collective known for large-scale data breaches, extortion, and data sales on underground forums. The exam covers their key victims (2020-2025), operational tactics, infrastructure, affiliations, and law enforcement countermeasures.

15 questions · 40 min suggested

Research investigation

AA23-108 APT28 Router Exploitation Analysis

Research how APT28 used weak SNMP configuration and a known Cisco vulnerability to enumerate routers, deploy Jaguar Tooth, collect network data, and maintain covert access.

6 questions · 40 min suggested

About this learning material

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.