Understanding Attack Scenarios and Motivations CT-SEC Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security consultant is assessing the threat landscape for a pharmaceutical company that develops a new COVID-19 vaccine. The company has received threats from hacktivist groups and also suspects industrial espionage. Which attacker motivation is most likely to result in a targeted attack on the vaccine research data?

   • AEspionage, driven by competitive advantage in the pharmaceutical market
   • BFinancial gain through ransomware
   • CRevenge from a disgruntled employee
   • DHacktivism, driven by opposition to pharmaceutical companies
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During a security test, an assessor leaves a USB drive labeled 'Confidential - Employee Bonuses' in the company parking lot. An employee picks it up and plugs it into their workstation, inadvertently installing malware. Which human psychological trait is being exploited?

   • ACuriosity
   • BObedience to authority
   • CFear of missing out (FOMO)
   • DDesire to help others
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company has a high rate of successful phishing attacks despite regular security awareness training. The security team is considering implementing a technical control to reduce the impact of human error. Which control would be most effective in mitigating the consequences of a successful phishing attack?

   • AIncreasing the frequency of security awareness training
   • BImplementing a web filter to block known malicious websites
   • CImplementing endpoint detection and response (EDR) to detect and contain malware
   • DEnforcing a policy that requires employees to change passwords every 30 days
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An attacker sends an email to an employee that appears to be from the IT department, stating that the employee's mailbox is full and they must click a link to increase their storage quota. The employee clicks the link and enters their credentials. Which human factor is primarily exploited?

   • AObedience to authority
   • BCuriosity about the link's content
   • CDesire for financial reward
   • DFear of losing access to email
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst notices a pattern of failed login attempts on a company's VPN, followed by a successful login from an unusual location. The attacker then accessed sensitive HR files. The analyst discovers the attacker used credentials obtained from a previous data breach. What is the most likely primary motivation of the attacker?

   • AFinancial gain through data theft and potential resale
   • BRevenge from a disgruntled former employee
   • CHacktivism to expose corporate wrongdoing
   • DEspionage to gain competitive advantage
   Reveal Solution Discussion Select an answer first