A SOC team is analyzing a series of attacks against a political party's website. The attackers first defaced the website with a political message, then launched a DDoS attack that made the site unavailable. Later, they attempted to phish the party's volunteers to steal their credentials. The SOC suspects the same group is behind all three attacks. Which combination of intent, motive, and goal best explains the attackers' overall strategy?

Intent to steal data; motive of espionage; goal of gathering intelligence on the party's strategy

Intent to disrupt the party's operations; motive of hacktivism; goal of silencing the party's voice

Intent to cause chaos; motive of thrill-seeking; goal of proving the attackers' skill

Intent to extort the party; motive of financial gain; goal of demanding a ransom to stop the attacks

A hospital's patient portal was defaced with a message criticizing its vaccine policies, and the attackers also posted a list of patient email addresses they had copied. The attackers did not request a ransom and left the rest of the database untouched. Which motive and goal combination best explains the attackers' behavior?

Financial gain, with the goal of selling the email addresses on a dark web marketplace

Disruption, with the goal of making the portal unavailable to patients

Espionage, with the goal of gathering intelligence on hospital staff for a future attack

Hacktivism, with the goal of embarrassing the hospital and drawing attention to its policies

A manufacturing company discovers that a competitor has been accessing its design files for a new product. The attacker used a zero-day vulnerability in the company's file-sharing software and maintained persistent access for three months. The design files were copied but not modified. Which threat goal is the attacker primarily pursuing?

Service disruption through ransomware

Financial fraud through credential theft

Reputational damage through data exposure

A company's website is flooded with traffic from a botnet, causing the site to become unresponsive. The attacker then sends an email demanding payment to stop the attack. No data was stolen, and no systems were compromised beyond the DDoS impact. Which threat goal is the attacker primarily pursuing?

Service disruption for extortion

System compromise for persistent access

Data theft through network infiltration

Reputational damage through data exposure

What is the primary goal of a ransomware attack?

To steal intellectual property for competitive advantage

To disrupt services by overwhelming the network

To deface a website to spread a political message

To encrypt the victim's data and demand payment for decryption

EC-CouncilSOC Essentials

Domain 2Objective 1

Threat Intent, Motive, and Goal SCE Practice Questions (Page 3)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 11–15

11expert · hard
A SOC team is analyzing a series of attacks against a political party's website. The attackers first defaced the website with a political message, then launched a DDoS attack that made the site unavailable. Later, they attempted to phish the party's volunteers to steal their credentials. The SOC suspects the same group is behind all three attacks. Which combination of intent, motive, and goal best explains the attackers' overall strategy?
Select an answer first
12application · medium
A hospital's patient portal was defaced with a message criticizing its vaccine policies, and the attackers also posted a list of patient email addresses they had copied. The attackers did not request a ransom and left the rest of the database untouched. Which motive and goal combination best explains the attackers' behavior?
Select an answer first
13application · medium
A manufacturing company discovers that a competitor has been accessing its design files for a new product. The attacker used a zero-day vulnerability in the company's file-sharing software and maintained persistent access for three months. The design files were copied but not modified. Which threat goal is the attacker primarily pursuing?
Select an answer first
14application · medium
A company's website is flooded with traffic from a botnet, causing the site to become unresponsive. The attacker then sends an email demanding payment to stop the attack. No data was stolen, and no systems were compromised beyond the DDoS impact. Which threat goal is the attacker primarily pursuing?
Select an answer first
15foundation · easy
What is the primary goal of a ransomware attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Threat Intent, Motive, and Goal SCE Practice Questions (Page 3)

Questions 11–15

What is the primary goal of a ransomware attack?

Keep studying — Fundamentals of Cyber Threats