Threat Intent, Motive, and Goal SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC analyst is reviewing an alert about a brute-force attack on the company's email server. The attacker is trying many passwords against a single account. The analyst notices that the account belongs to an executive who has access to merger and acquisition plans. What is the most likely threat intent?

   • ATo prove the attacker's technical skill
   • BTo disrupt the email server's availability
   • CTo deface the company's website
   • DTo gain access to sensitive corporate information
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is reviewing an incident where an insider with administrative privileges copied a large database of customer records to a personal USB drive. The employee then resigned and joined a competitor. No systems were damaged, and no ransom was demanded. Which combination of intent, motive, and goal best explains this insider threat?

   • AIntent to transfer proprietary data; motive of espionage; goal of data theft
   • BIntent to cause financial loss; motive of hacktivism; goal of system compromise
   • CIntent to disrupt operations; motive of financial gain; goal of service disruption
   • DIntent to demonstrate skill; motive of curiosity; goal of unauthorized access
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A SOC analyst is reviewing an alert about a distributed denial-of-service (DDoS) attack targeting a government website. The attack traffic originates from a botnet, and the website is intermittently unavailable. The attackers have not attempted to breach the network or steal data. What is the most likely threat goal?

   • ATo exfiltrate sensitive government data
   • BTo deface the website with a political message
   • CTo gain persistent access to the government network
   • DTo disrupt the availability of the website
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC analyst is investigating a breach at a media company. The attacker gained access through a phishing email, then spent weeks quietly downloading internal emails and unpublished articles. The attacker did not encrypt any files or demand a ransom. Later, the company discovers that a rival media outlet published several of the unpublished articles. Which combination of intent, motive, and goal best explains the attacker's actions?

   • AIntent to extort the company; motive of financial gain; goal of selling the articles back
   • BIntent to gain a competitive advantage; motive of espionage; goal of stealing unpublished articles
   • CIntent to disrupt operations; motive of hacktivism; goal of exposing the company's practices
   • DIntent to cause financial loss; motive of revenge; goal of leaking the articles to harm the company
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team is analyzing a series of attacks on a media company. Attack 1: A DDoS attack took the company's streaming service offline during a major live event. Attack 2: A phishing campaign targeted employees with emails containing links to a fake login page. Attack 3: An attacker defaced the company's blog with a political statement. Which attack indicates the most sophisticated threat actor?

   • AAttack 3 indicates the most sophisticated actor because defacement requires exploiting a vulnerability in the web server.
   • BAll attacks indicate the same level of sophistication because they all target the same company.
   • CAttack 2 indicates the most sophisticated actor because phishing campaigns targeting employees with fake login pages require social engineering and credential theft capabilities.
   • DAttack 1 indicates the most sophisticated actor because DDoS attacks require significant resources to execute.
   Reveal Solution Discussion Select an answer first