300-220 practice question 19 of 35

In threat actor attribution, what does the term "False Flag" refer to?

Full set: 360 questions

Domain Threat Hunting Methodologies

Answer options

A: A tactic where threat actors plant misleading evidence Correct answer

B: A technique to disguise the origins of an attack Correct answer

C: A marker indicating the exact location of a threat actor

D: A campaign run by threat actors on social media

Correct Answer:

A. A tactic where threat actors plant misleading evidence; B. A technique to disguise the origins of an attack

Explanation

A "False Flag" operation in cybersecurity is a deception tactic where a threat actor intentionally plants misleading evidence to misdirect attribution efforts. The primary goal is to make an attack appear as if it were carried out by another entity, nation-state, or group. This involves embedding specific artifacts, such as language strings, code comments, or using tools and techniques (TTPs) known to be associated with the scapegoated group. Therefore, planting misleading evidence (A) is the specific action, and disguising the attack's origin (B) is the overarching purpose. Both options accurately describe core aspects of a false flag operation.

Why Incorrect

C. A marker indicating the exact location of a threat actor: This is incorrect. A false flag is designed to obscure and misdirect from the actor's true location and identity, not reveal it.
D. A campaign run by threat actors on social media: This describes an influence operation or disinformation campaign, which is a different concept, although a false flag could be a component of such a campaign.

References

1. Official Vendor Documentation:

Cisco CyberOps Associate CBROPS 200-201 Official Cert Guide, Chapter 23, "Digital Forensics and Incident Analysis and Response," Section "Attribution." The guide states, "Attackers may try to throw investigators off their trail by planting false evidence, which is known as a false flag." This directly supports option A as the mechanism of the operation.

2. Peer-Reviewed Academic Publications:

Rid, T., & Buchanan, B. (2015). Attributing Cyber Attacks. Journal of Strategic Studies, 38(1-2), 4-37. In the section "Deception and the Problem of Attribution," the authors state that attackers can "hang a 'false flag'—leaving behind evidence that points to another culprit." This supports the concept of planting misleading evidence (A) to disguise the origin (B). (DOI: https://doi.org/10.1080/01402390.2014.971046)

Köllner, T. (2017). Attribution of Cyber Attacks: A Framework-based Analysis. 2017 9th International Conference on Cyber Conflict (CyCon), pp. 251-267. The paper discusses attribution challenges, noting that attackers use "deception techniques such as false flags" and "deliberately leave behind misleading evidence" to implicate other actors, thereby disguising their true origin. (DOI: 10.23919/CYCON.2017.7985383)

Keep practicing

Take the free 300-220 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test