A security consultant is profiling potential attackers for a threat model. The client is a non-profit organization that advocates for environmental protection. Which attacker motivation is most likely to target this organization?

Revenge from a disgruntled employee

Hacktivism, driven by ideological opposition to the organization's cause

Espionage to steal research data

Financial gain through ransomware

A company has implemented a policy requiring employees to use multi-factor authentication (MFA). However, a phishing attack successfully bypasses MFA by using a real-time proxy. What is the most effective human-factor mitigation to prevent this type of attack?

Disabling MFA to simplify the login process

Using a different MFA method, such as SMS codes

Implementing a stronger password policy

Training employees to recognize phishing attempts and report them

Which attacker motivation is most commonly associated with ransomware attacks that target human users?

Revenge against a specific organization

Financial gain through extortion

Political activism to promote a cause

Intellectual curiosity to test security skills

An attacker calls an employee, claiming to be from a partner company, and asks the employee to urgently transfer funds to a new account to complete a time-sensitive deal. The employee complies without verifying the request. Which human factor is being exploited?

Curiosity about the new account

Urgency and the desire to be helpful

Certified Tester Security Tester

Domain 6Objective 4

Understanding Attack Scenarios and Motivations CT-SEC Practice Questions (Page 1)

Part of the Human Factors in Security Testing domain, which makes up ~14% of our current practice bank. ISTQB does not publish an official question count, but from its 120-minute exam (~50–80 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

4concepts

Questions 1–5

1application · medium
A security consultant is profiling potential attackers for a threat model. The client is a non-profit organization that advocates for environmental protection. Which attacker motivation is most likely to target this organization?
Select an answer first
2application · medium
A company has implemented a policy requiring employees to use multi-factor authentication (MFA). However, a phishing attack successfully bypasses MFA by using a real-time proxy. What is the most effective human-factor mitigation to prevent this type of attack?
Select an answer first
3foundation · easy
Which attacker motivation is most commonly associated with ransomware attacks that target human users?
Select an answer first
4application · medium
An attacker calls an employee, claiming to be from a partner company, and asks the employee to urgently transfer funds to a new account to complete a time-sensitive deal. The employee complies without verifying the request. Which human factor is being exploited?
Select an answer first
5foundation · easy
An attacker defaces a government website to protest a new law. Which motivation best describes this attack?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CT-SEC

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISTQB. “CT-SEC” is a trademark of its owner, used for identification only.