A security analyst is examining an attack where the threat actor used a phishing email to gain access to a bank's internal network, then spent weeks mapping the network and identifying high-value accounts. The attacker eventually transferred funds from several accounts to offshore accounts. Which combination of intent, motive, and goal best describes this attack?

Intent to gather intelligence; motive of espionage; goal of data exfiltration

Intent to cause reputational damage; motive of competition; goal of data exposure

Intent to disrupt banking operations; motive of hacktivism; goal of service outage

Intent to steal funds; motive of financial gain; goal of unauthorized fund transfer

A hospital's IT team discovers that an attacker has been accessing patient records and selling the information on the dark web. The attacker used a phishing email to obtain a nurse's credentials and then queried the electronic health record system over several weeks. Which threat goal is the attacker primarily pursuing?

Service disruption through ransomware

Reputational damage through data exposure

System compromise for espionage

A SOC team is investigating a breach at a research university. The attacker gained access through a phishing email, then spent months quietly accessing research data on nuclear engineering. The attacker did not steal any data, but they did modify some research files to introduce errors. The modifications were subtle and designed to be difficult to detect. Which combination of intent, motive, and goal best explains this attack?

Intent to sabotage research; motive of disruption; goal of undermining the university's credibility

Intent to steal research data; motive of espionage; goal of exfiltrating nuclear engineering data

Intent to prove a point; motive of hacktivism; goal of exposing the university's research practices

Intent to extort the university; motive of financial gain; goal of demanding a ransom to restore the files

A SOC analyst is triaging an alert about a compromised web server. The attacker installed a cryptocurrency miner and modified the server's configuration to maximize CPU usage. No customer data was accessed, and no files were encrypted. What is the most likely threat intent, and which goal does this behavior reflect?

Intent to cause reputational damage; goal of data destruction

Intent to generate revenue; goal of resource abuse

Intent to conduct espionage; goal of credential theft

Intent to disrupt services; goal of system compromise

A state-sponsored group is suspected of compromising a defense contractor's network. The attackers used sophisticated spear-phishing emails and custom malware to gain access. They have been quietly collecting emails and documents related to military projects for several months. Which threat motive and goal combination best describes this activity?

Financial gain with the goal of data theft for resale

Disruption with the goal of system compromise

Espionage with the goal of intelligence gathering

Hacktivism with the goal of public exposure

EC-CouncilSOC Essentials

Domain 2Objective 1

Threat Intent, Motive, and Goal SCE Practice Questions (Page 2)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 6–10

6application · medium
A security analyst is examining an attack where the threat actor used a phishing email to gain access to a bank's internal network, then spent weeks mapping the network and identifying high-value accounts. The attacker eventually transferred funds from several accounts to offshore accounts. Which combination of intent, motive, and goal best describes this attack?
Select an answer first
7application · medium
A hospital's IT team discovers that an attacker has been accessing patient records and selling the information on the dark web. The attacker used a phishing email to obtain a nurse's credentials and then queried the electronic health record system over several weeks. Which threat goal is the attacker primarily pursuing?
Select an answer first
8expert · hard
A SOC team is investigating a breach at a research university. The attacker gained access through a phishing email, then spent months quietly accessing research data on nuclear engineering. The attacker did not steal any data, but they did modify some research files to introduce errors. The modifications were subtle and designed to be difficult to detect. Which combination of intent, motive, and goal best explains this attack?
Select an answer first
9application · medium
A SOC analyst is triaging an alert about a compromised web server. The attacker installed a cryptocurrency miner and modified the server's configuration to maximize CPU usage. No customer data was accessed, and no files were encrypted. What is the most likely threat intent, and which goal does this behavior reflect?
Select an answer first
10application · medium
A state-sponsored group is suspected of compromising a defense contractor's network. The attackers used sophisticated spear-phishing emails and custom malware to gain access. They have been quietly collecting emails and documents related to military projects for several months. Which threat motive and goal combination best describes this activity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Threat Intent, Motive, and Goal SCE Practice Questions (Page 2)

Questions 6–10

Keep studying — Fundamentals of Cyber Threats