A company's security team discovers that an attacker has been using a compromised account to access a research and development server. The attacker has been downloading source code for a new product. The downloads have been slow and sporadic to avoid detection. Which threat goal is the attacker primarily pursuing, and what does the behavior indicate about the attacker's intent?

Intellectual property theft; the slow and sporadic downloads indicate an intent to remain undetected while exfiltrating valuable data.

Service disruption; the slow downloads indicate an intent to degrade the server's performance over time.

Reputational damage; the attacker intends to publicly release the source code to embarrass the company.

Financial fraud; the attacker is likely planning to sell the source code for profit.

A SOC team is investigating two simultaneous incidents. Incident A: A ransomware group encrypted a hospital's patient database and demanded a $2 million ransom. Incident B: An activist group defaced the hospital's public website with a message criticizing the hospital's patient privacy practices. The team must prioritize its response. Which analysis of intent, motive, and goal is most accurate for prioritizing the incidents?

Incident A should be deprioritized because ransomware is a common attack, while Incident B is a targeted attack.

Incident A has a financial motive and a goal of service disruption, while Incident B has a hacktivist motive and a goal of public exposure; Incident A should be prioritized due to its impact on patient care.

Both incidents have the same motive of financial gain, so they should be handled with equal priority.

Incident B has a more severe motive because it involves public exposure, so it should be prioritized over the ransomware.

EC-CouncilSOC Essentials

Domain 2Objective 1

Threat Intent, Motive, and Goal SCE Practice Questions (Page 9)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 41–42

41expert · hard
A company's security team discovers that an attacker has been using a compromised account to access a research and development server. The attacker has been downloading source code for a new product. The downloads have been slow and sporadic to avoid detection. Which threat goal is the attacker primarily pursuing, and what does the behavior indicate about the attacker's intent?
Select an answer first
42expert · hard
A SOC team is investigating two simultaneous incidents. Incident A: A ransomware group encrypted a hospital's patient database and demanded a $2 million ransom. Incident B: An activist group defaced the hospital's public website with a message criticizing the hospital's patient privacy practices. The team must prioritize its response. Which analysis of intent, motive, and goal is most accurate for prioritizing the incidents?
Select an answer first

Finished these 2 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Threat Intent, Motive, and Goal SCE Practice Questions (Page 9)

Questions 41–42

Keep studying — Fundamentals of Cyber Threats