Threat Intent, Motive, and Goal SCE Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company experiences a data breach where customer credit card numbers are stolen. The investigation reveals two possible attackers: a known cybercriminal group that typically sells stolen data, and a hacktivist group that has previously exposed corporate data to embarrass companies. The stolen data has not appeared on any public forum or dark web marketplace. Which attribution is more likely based on the threat intent and motive?

   • AThe cybercriminal group is more likely because the theft of credit card numbers aligns with a financial motive, and the absence of public exposure suggests the data is being prepared for sale.
   • BBoth groups are equally likely because both have the capability to steal credit card data.
   • CThe hacktivist group is more likely because they typically steal data to expose it publicly, and the absence of public exposure is a temporary state.
   • DNeither group is likely because credit card theft is typically done by insiders, not external groups.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A regional utility company discovers that an attacker has been slowly exfiltrating customer billing data over the past six months. The attacker used legitimate employee credentials obtained through a targeted phishing campaign against the finance department. The data has not been altered, and no ransomware or destructive activity has occurred. Based on the attacker's behavior, which threat motive and goal combination best characterizes this incident?

   • AFinancial gain through data theft for resale or fraud
   • BHacktivism through public data exposure
   • CEspionage through intellectual property theft
   • DDisruption through service degradation
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A SOC analyst is reviewing an alert about a phishing campaign targeting employees at a defense contractor. The emails contain a link to a fake login page that mimics the company's VPN portal. The attacker's goal appears to be capturing VPN credentials. Which threat motive is most likely?

   • AHacktivism
   • BDisruption
   • CEspionage
   • DFinancial gain
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A SOC analyst is investigating an incident where a disgruntled employee deleted critical files from a file server. The employee had legitimate access and did not use any hacking tools. The deletion occurred over a weekend, and the employee has since resigned. Which combination of intent, motive, and goal best explains this insider threat?

   • AIntent to steal data; motive of financial gain; goal of data exfiltration
   • BIntent to disrupt operations; motive of hacktivism; goal of service outage
   • CIntent to cause harm; motive of revenge; goal of data destruction
   • DIntent to demonstrate skill; motive of curiosity; goal of unauthorized access
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC analyst observes an attacker who has gained access to a financial institution's network. The attacker is slowly exfiltrating customer account records over several weeks, while carefully avoiding detection by staying under threshold alerts. The attacker has not modified any files or disrupted any services. Which threat intent best describes this attacker's behavior?

   • ATo quietly collect valuable data for financial or strategic benefit
   • BTo prove technical skill by bypassing security controls
   • CTo cause maximum damage to the organization's reputation
   • DTo disrupt the institution's online banking services
   Reveal Solution Discussion Select an answer first