Threat Intent, Motive, and Goal SCE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC team is analyzing a series of attacks against a utility company. In the first attack, a DDoS campaign disrupted the company's customer portal for several hours. In the second attack, a phishing email led to the theft of employee credentials, but no data was exfiltrated. The SOC suspects the same threat actor is responsible. Which combination of intent, motive, and goal best explains the attacker's overall strategy?

   • AIntent to gain persistent access; motive of espionage; goal of establishing a foothold for future attacks
   • BIntent to extort the company; motive of financial gain; goal of demanding a ransom after the DDoS
   • CIntent to steal customer data; motive of financial gain; goal of selling the data on the dark web
   • DIntent to disrupt operations; motive of hacktivism; goal of causing chaos
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A SOC analyst is reviewing an alert about a watering hole attack. The attackers compromised a website that is frequently visited by employees of a specific industry. The website now contains malicious code that exploits a browser vulnerability to install malware on visitors' systems. What is the most likely threat goal?

   • ATo deface the website with a political message
   • BTo steal the website's source code
   • CTo gain access to the systems of industry employees
   • DTo disrupt the website's availability
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A SOC team is analyzing a ransomware incident at a law firm. The attackers encrypted files and left a ransom note demanding payment in cryptocurrency. They also threatened to publish sensitive client documents if the ransom was not paid. Which motive and goal combination best describes this attack?

   • AHacktivism, with the goal of exposing the firm's unethical practices
   • BEspionage, with the goal of stealing client documents for a competitor
   • CFinancial gain, with the goal of extorting money from the firm
   • DDisruption, with the goal of shutting down the firm's operations
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A SOC analyst is reviewing two alerts. Alert 1: A user downloaded a file from a suspicious website, and the file was quarantined by endpoint protection. Alert 2: A user received a phishing email that was blocked by the email gateway. Both alerts involve the same user. The analyst must determine which alert indicates a higher risk of a successful attack. Which analysis is most accurate?

   • ABoth alerts indicate the same level of risk because they both involve the same user and malicious content.
   • BAlert 2 indicates a higher risk because phishing emails are more common and often lead to credential theft.
   • CAlert 1 indicates a higher risk because the user actively downloaded a file, which suggests a higher likelihood of executing malware, even though it was quarantined.
   • DNeither alert indicates a risk because both were blocked or quarantined by security controls.
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   How do threat intent, motive, and goal interrelate in shaping an attack?

   • AMotive drives intent, which leads to a specific goal and shapes the attack strategy
   • BMotive is only relevant after the attack is completed
   • CIntent and goal are independent and do not influence the attack strategy
   • DGoal drives motive, which leads to intent and determines the tools used
   Reveal Solution Discussion Select an answer first