Which Threat Actor Would a Foreign Government Hire?

SY0-701 By islever Editorial Last updated

Compare and contrast common threat actors and motivations.

Short answer

C Hire organized crime groups, the skilled financially motivated actors a foreign government would contract to attack critical systems in other countries.

Question

Which of the following threat actors is the most likely to be hired by a foreign government to attack critical systems located in other countries?
  1. Hacktivist
  2. Whistleblower
  3. Organized crime Correct Answer
  4. Unskilled attacker

Key Takeaways

The tested trap is confusing political motive with hireability: hacktivists look political but act independently, while only the financially motivated organized crime group is available for government contract work.

This SY0-701 threat-actor question tests who a foreign government would contract to attack critical systems abroad; the answer is C, organized crime, because it is skilled, funded, and financially motivated.

Common mistake: Choosing A, hacktivist, because attacks on critical infrastructure sound political; hacktivists are ideological volunteers who cannot be hired and directed by a foreign government.

Expert Analysis

Read the qualifier "hired". The question does not ask which actor is a nation-state, nor which actor has a political motive. It asks which actor would be contracted — employed for pay — by a foreign government to strike critical systems in another country. That single word eliminates the ideologically driven choices.

Why the other options fail. A hacktivist (A) is moved by a political or social ideology and volunteers time; a government cannot buy the loyalty of a group whose agenda may conflict with the sponsor's, so hacktivists are not "hired" in this sense. A whistleblower (B) is an insider who reports misconduct rather than one who launches attacks, so it is not even an attack profile. An unskilled attacker (D) lacks the capability to penetrate critical infrastructure in a foreign country, and a sponsoring government would not pay for incompetence. Only option C survives.

Why C is correct. Organized crime groups are structured, well-funded, technically sophisticated, and accustomed to operating across borders with operational security. Their core motivation is financial gain, which makes them available for hire — one of the defining traits in the CompTIA threat-actor matrix. Nation-state actors routinely subcontract espionage, sabotage, and denial-of-service work to criminal groups for plausible deniability plus proven capability, exactly matching "hired by a foreign government to attack critical systems located in other countries."

Exam takeaway. When a stem says hired, contracted, or paid, think financially motivated actors with proven skill — organized crime. Ideological actors (hacktivists) and unsophisticated actors (script kiddies) are distractors for this wording.

Official Reference

https://www.comptia.org/training/resources/exam-objectives

This link opens the official vendor documentation in a new tab.

Exam Strategy

Underline verbs like "hired," "contracted," or "paid" before reading the options — those words point to a financially motivated actor. Then check each remaining option against capability: an attack on another country's critical infrastructure requires skill, so immediately discard unskilled and insider-reporter choices. Finally, eliminate any option whose defining trait (ideology) conflicts with taking directions from a sponsor.

Frequently Asked Questions

Why isn't a hacktivist the answer when the attack targets critical systems?

Hacktivists are driven by their own political or social ideology and volunteer their efforts; they cannot be hired or directed by a foreign government, so the "hired" wording rules them out.

Is a nation-state actor one of the options for this question?

No. Nation-state or APT actors are the sponsor here, not the hired party. Among the listed choices, organized crime is the group a government contracts for such operations.

What motivates organized crime groups in cybersecurity attacks?

Financial gain and power, which makes them willing to take paid work from outside sponsors while supplying the funding, tools, and cross-border experience a critical-systems attack requires.

More SY0-701 FAQ →

Community Votes

C
58%
A
20%
B
22%

58% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 39 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 39

  1. PatientZero 👍 28 Answered A
    this website has become incredibly overpriced. Was able to buy contributor's access before now it's not even worth it. 3 months for 150?
  2. Anyio 👍 5
    The answer is C. Organized crime. Organized crime groups are often well-funded, highly skilled, and capable of carrying out sophisticated cyberattacks, including those targeting critical infrastructure. Governments might collaborate with or hire these groups for cyber espionage, sabotage, or other malicious activities aimed at destabilizing or compromising another nation's critical systems. Hacktivists typically act independently for political or social reasons and are less likely to be directly hired by governments. Whistleblowers expose internal wrongdoings and are not typically involved in attacking external systems. Unskilled attackers (often referred to as "script kiddies") lack the expertise necessary for carrying out complex attacks on critical systems. Thus, organized crime groups are the most likely threat actors in this scenario.
  3. ermahasra 👍 3 Answered C
    C. Organized crime In the context of CompTIA Security+, organized crime refers to structured groups that are engaged in illegal activities, typically for financial gain. These groups are often highly sophisticated, well-funded, and operate with a high degree of coordination. They may be involved in various forms of cybercrime, including: Fraud: Engaging in activities such as credit card fraud, identity theft, and financial scams. Ransomware Attacks: Encrypting data and demanding a ransom for the decryption key. Data Breaches: Stealing sensitive information from organizations to sell on the black market or use for further criminal activities. Money Laundering: Using various techniques to disguise the origins of illegally obtained money. Drug Trafficking: Using online platforms to facilitate the sale and distribution of illegal drugs.
  4. DarthFrank 👍 3 Answered C
    For what it's worth, just took the exam. Only about 20 to 30% of these were on the actual test. There was a lab on it that wasn't on here that had to do with SSH and chmod of a file and stuff like that. Luckily some studying helped and I barely pass. Do with that info what you will. These questions are NOT up to date
  5. Teejaytoju 👍 3
    C. Organized crime Organized crime groups often have the resources, expertise, and networks to carry out sophisticated cyber attacks on behalf of governments or other entities for financial gain or political motives.
Show 25 more comments
  1. JotaJoe 👍 3 Answered C
    The correct answer should be "nation-state actor", but the most accurate between the optiones si: C - Organized Crime
  2. Alive 👍 2 Answered C
    Organized Crime: This involves criminal groups that engage in illegal activities for profit. These groups can be hired by foreign governments to conduct cyberattacks or other illicit activities, as they often have the resources and expertise to carry out sophisticated operations.
  3. Cyberfox9001 👍 2 Answered C
    C. Organized Crime Organized crime consists of individuals who have gained experience and made careers out of organized crime. In this case, organizations who are recruiting hackers would feel more comfortable recruiting groups who are experienced in this area of technology.
  4. Robby_Ruby 👍 2 Answered C
    Organized crime. They are highly skilled and possess more sophisticated tools to carry out large scale attacks on another country. Their motive is largely for politcal interest. This sort of attack is mostly carried out by a nation-state actor.
  5. Darkgull 👍 2 Answered C
    I’d go with C. Organized crime, since the question seems to focus on a group motivated by financial gain or other illegal activities. I also used ExamsPilot for extra exam practice while preparing for Security+.
  6. Moreo 👍 2 Answered C
    Organized crime groups often have the resources, expertise, and networks to carry out sophisticated cyber attacks on behalf of governments or other entities for financial gain or political motives.
  7. Elyo 👍 2 Answered C
    Organized crime is a category of transnational, national, or local groups of centralized enterprises run to engage in illegal activity, most commonly for profit.
  8. CyberChief16 👍 2 Answered C
    Organized crime is the best choice, they typically are motivated by financial gain and have the resources to successfully attack on behalf of governments.
  9. AryzBeats 👍 2 Answered C
    Organized crime are usually treat actors that have high skill, capable of carrying out long and technical attacks
  10. way12 👍 2 Answered C
    the question points to a collection of attackers that is organized and they are targeting governments
  11. Abhi007bond 👍 2 Answered C
    C organized crime group are meant to perform this type of activity on behalf of govt
  12. Rashjr1 👍 2 Answered C
    because with an organised crime threat actor they are always there for monetary gain
  13. enongenek 👍 2 Answered C
    Organise crime as they have the resources and can work for foreign government
  14. otose 👍 2 Answered C
    organized crime because it purely organized high skilled persdonnel
  15. 150ced2 👍 2 Answered C
    Organized Crime because my first choice nation state is not here.
  16. TechWyvern 👍 2 Answered C
    Organized Crime is the most logical answer.
  17. SHAGZZ 👍 2 Answered C
    the most accurate would have been APT
  18. kware5 👍 1 Answered C
    Hacktivists are individuals or groups driven by the same ideologies and political or social motives. A whistleblower is someone who reports illegal, unethical, or dangerous behaviour related to information systems, data, or cybersecurity practices. An organized crime group is a structured group of people who work together over time to make money or gain power through illegal activities. An unskilled attacker is someone who lacks technical expertise and often resorts to off-the-shelf tools or purchases tools from the dark web.
  19. DeadGamer 👍 1 Answered A
    Hacktivists are primarily characterized by their political motivations, whereas organized crime is commonly driven by the persuit of financial gain. while unskilled attackers and insider threats can also exhibit political motivations, among the options provided, hacktivists are considered the most probable in terms of political motivation.
  20. Anonymous learner 👍 1 Answered C
    Organized crime is a group that is usually formed in one country and goes after other individuals or corporations in other countries
  21. dklzvndjc 👍 1 Answered C
    Goverments do private deals with organised crime as this gives them access to recources that law enforcement does not have.
  22. SilverShlurper 👍 1 Answered C
    Surely not hacktivist since the action is not aiming to protest but to access or gain sensitive information
  23. Hasss 👍 1 Answered C
    Organized crimes usually have a sophisticated team capable enough to pull of threats like these.
  24. JustAnAnon 👍 1 Answered C
    Cybercrime groups can be hired by government or financial companies and others to do a job.
  25. NateF 👍 1 Answered C
    Interesting answer usually in the threat actor list Nation-State actor would be the answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide