Free Threat Actors and Motivations practice questions
10 free SY0-801 questions on Threat Actors and Motivations, each with a full explanation — no account needed. This section sits in the Threats, Vulnerabilities, and Attacks part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
A pharmaceutical company's homepage is replaced with a protest slogan about drug prices, and a group posts on social media claiming credit and naming the cause it supports. Which threat actor is MOST likely responsible?
A defacement tied to a cause, publicly claimed for attention, is the classic hacktivist attack. A terrorist aims to frighten the public or endanger safety, a competitor quietly seeks trade secrets, and organized crime wants money, none of which fits a signed protest message.
A defense contractor discovers an intruder who exploited a previously unknown vulnerability, stayed hidden for more than a year, and copied engineering data for a military program. No demand was ever made. Which threat actor is MOST likely responsible?
A zero-day, more than a year of stealth, a military target and no demand for payment all point to a state-sponsored actor serving national interests. Organized crime would cash in with a demand and a hacktivist would publicize the attack. A competitor wants trade secrets for commercial advantage, while military program data taken in a year-long zero-day operation matches a government's interests.
A database administrator who was just denied a promotion copies the full customer list to her personal cloud drive, then deletes the export from the server's history. Which threat actor type BEST fits?
She is misusing access the organization granted her, and covering her tracks shows intent, which makes her a malicious insider. An accidental actor has no intent to harm, no rival is involved to suggest a competitor, and an unskilled attacker is an outsider running borrowed tools.
Attackers alter the bank details on a supplier's invoices so a manufacturer's payments land in accounts they control, then launder the money through cryptocurrency. Which threat actor is MOST likely behind this?
Fraudulent changes to invoice bank details and laundering the proceeds are the work of profit-driven crime syndicates. Hacktivists want attention for a cause, competitors want trade secrets or bid data, and nation-states mostly pursue national interests such as secrets and infrastructure rather than invoice fraud.
Weeks after an outside hacker breaks into a toy maker's design server, a rival company launches a near-identical product. Investigators later trace payments from the rival to the hacker. Which threat actor type BEST explains the incident?
Designs stolen for a rival that then launches a near-identical product mark a competitor, and paying an outside hacker is one of a competitor's usual methods. The hacker may be a criminal for hire, but organized crime profits from ransom or fraud, not from a rival's product launch, and nothing points to a cause or a government.
A city's website is defaced with a political slogan. Investigators find the attacker used a downloaded exploit kit, left obvious traces in the logs, and spent the next day boasting on a forum about how easy it was, without ever mentioning a cause. Which threat actor type BEST fits?
When two actor types fit, choose the one that explains the most details: a borrowed tool, noisy traces and bragging about the result describe an unskilled attacker. Hacktivist is tempting because of the slogan, but a hacktivist stresses the cause, and this attacker never mentions one. A nation-state would be careful and quiet, and nothing here aims to frighten the public.
Over several months, an intruder quietly copies source code and polymer formulas from a materials company's research servers. There is no ransom note and no public claim. Which motivation BEST fits?
Quiet theft of source code and formulas is intellectual property theft, because the scenario stresses what the company created. Espionage looks the same in stealth and dwell time but centers on government, military, diplomatic or strategic information. With no demand or sale described, financial isn't the most specific fit, and notoriety needs a public claim.
A network of fake social media accounts spreads fabricated claims about a food company's product safety, while stolen internal emails are released in carefully chosen fragments to shape how consumers see the brand. Which motivation BEST fits?
Disinformation, fake accounts amplifying a story, and selective leaks timed to shape what an audience believes are the marks of an influence motive. Political motives target elections, officials or government policy, ideological attacks follow a belief system across many targets, and revenge requires a personal grievance, none of which the scenario describes.
Attackers install a program on a company's cloud servers that quietly uses their processors to mine cryptocurrency for the attackers. No demand is made and nothing is destroyed. Which motivation BEST fits?
Cryptojacking turns a victim's servers into money for the attacker, which is a financial motive. Extortion needs a threat backed by a demand, fear/chaos aims at destruction or alarm, and general curiosity is exploring with no plan to profit, while these attackers are profiting quietly.
Wiper malware erases data at several regional hospitals at once. The attackers make no demand, offer no way to recover, and post messages meant to frighten the public. Which motivation BEST fits?
Destruction with nothing asked in return, aimed at services the public depends on and meant to cause alarm, is a fear and chaos motive. If the attackers had demanded something to stop, it would be extortion, revenge needs a personal grievance against a specific target, and nothing here brings the attackers money.
Study this section
Every lesson that covers Threat Actors and Motivations on the SY0-801 exam.