iSACA Cybersecurity Fundamentals Certification Practice Exam

Which of the following is NOT a type of threat agent?

1. Corporations

2. Cybercriminals

3. End users

4. Cyber-terrorists

The correct answer is: End users

The role of threat agents is to describe those individuals or entities that can exploit vulnerabilities and pose a risk to information systems and data. In this context, corporations, cybercriminals, and cyber-terrorists fit the description of threat agents as they actively seek to undermine security for various motivations, including financial gain, political agendas, or ideology. Corporations may engage in unethical practices that compromise data security, and cybercriminals are typically involved in criminal activities that exploit information systems. Cyber-terrorists use cyberattacks to intimidate or coerce societies or governments, often for political purposes. End users, in contrast, are individuals who interact with information systems, typically within a legitimate framework. While they can inadvertently contribute to security risks (e.g., through lapses in security awareness or carelessness), they do not actively pursue malicious activities or threats. Therefore, end users, while integral to the relationship with cybersecurity, do not fall within the category of threat agents in the same manner as the other listed entities.