A SOC analyst is examining a malware sample that was found on a workstation. The malware is designed to log keystrokes and capture screenshots, but it does not spread to other systems or cause any visible damage. The analyst determines that the malware is sending the captured data to an external server. What is the most likely threat intent?

To disrupt the workstation's normal operations

To encrypt the workstation's files for ransom

To prove the attacker's technical skill

To gain unauthorized access to sensitive information

A SOC analyst is investigating a breach at a healthcare provider. The attacker used a vulnerability in the web application to upload a web shell, then used it to access the database containing patient records. The attacker copied the records and then deleted the web shell to cover their tracks. What is the most likely threat goal?

To deface the healthcare provider's website

To gain recognition in the hacker community

To disrupt the healthcare provider's services

A financial institution detects two separate intrusions. Intrusion 1: An attacker used a phishing email to steal a trader's credentials and accessed the trading platform, but no trades were placed. Intrusion 2: An attacker exploited a vulnerability in the public-facing web server and defaced the login page with a political message. The SOC must determine which intrusion indicates a more serious threat. Which analysis is most accurate?

Intrusion 1 is more serious because the attacker's intent to access the trading platform suggests a financial motive and a potential goal of fraudulent trades, even though no trades were placed.

Intrusion 1 is less serious because no trades were placed, so no financial loss occurred.

Intrusion 2 is more serious because defacement is a clear sign of system compromise and public embarrassment.

Both intrusions are equally serious because they both involve unauthorized access to systems.

A security analyst observes a threat actor defacing a government website with political slogans and posting a manifesto. No data was stolen, and no systems were damaged beyond the website content. Which combination of intent, motive, and goal best describes this attack?

Intent to influence public opinion; motive of hacktivism; goal of website defacement

Intent to cause financial loss; motive of financial gain; goal of data theft

Intent to demonstrate technical skill; motive of curiosity; goal of unauthorized access

Intent to disrupt operations; motive of espionage; goal of system compromise

A security team notices that a competitor's website is repeatedly taken offline by distributed denial-of-service (DDoS) attacks during product launch events. The attacks are timed precisely to coincide with the competitor's marketing campaigns. Which threat motive is most likely driving this behavior?

Espionage to steal product information

Disruption to gain competitive advantage

Hacktivism to promote a political cause

Financial gain through ransom demands

EC-CouncilSOC Essentials

Domain 2Objective 1

Threat Intent, Motive, and Goal SCE Practice Questions (Page 7)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 31–35

31application · medium
A SOC analyst is examining a malware sample that was found on a workstation. The malware is designed to log keystrokes and capture screenshots, but it does not spread to other systems or cause any visible damage. The analyst determines that the malware is sending the captured data to an external server. What is the most likely threat intent?
Select an answer first
32application · medium
A SOC analyst is investigating a breach at a healthcare provider. The attacker used a vulnerability in the web application to upload a web shell, then used it to access the database containing patient records. The attacker copied the records and then deleted the web shell to cover their tracks. What is the most likely threat goal?
Select an answer first
33expert · hard
A financial institution detects two separate intrusions. Intrusion 1: An attacker used a phishing email to steal a trader's credentials and accessed the trading platform, but no trades were placed. Intrusion 2: An attacker exploited a vulnerability in the public-facing web server and defaced the login page with a political message. The SOC must determine which intrusion indicates a more serious threat. Which analysis is most accurate?
Select an answer first
34application · medium
A security analyst observes a threat actor defacing a government website with political slogans and posting a manifesto. No data was stolen, and no systems were damaged beyond the website content. Which combination of intent, motive, and goal best describes this attack?
Select an answer first
35application · medium
A security team notices that a competitor's website is repeatedly taken offline by distributed denial-of-service (DDoS) attacks during product launch events. The attacks are timed precisely to coincide with the competitor's marketing campaigns. Which threat motive is most likely driving this behavior?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Threat Intent, Motive, and Goal SCE Practice Questions (Page 7)

Questions 31–35

A security analyst observes a threat actor defacing a government website with political slogans and posting a manifesto. No data was stolen, and no systems were damaged beyond the website content. Which combination of intent, motive, and goal best describes this attack?

Keep studying — Fundamentals of Cyber Threats