SY0-701 Question 58
Single answerA defense contractor discovers that an engineer who recently resigned copied proprietary aircraft design documents to a personal cloud storage account the night before departure. During the investigation, analysts also find several emails in which the former employee threatened to release embarrassing internal messages unless the company paid a large sum. Which motivation BEST explains the employee's actions?
- A
Espionage
- B
Ethical
- C
Revenge
- D
Blackmail
- E
Philosophical/political beliefs
Show answer and explanation
Correct answer: D
Explanation
The best answer is Blackmail because the scenario centers on extortion: the former employee threatens to release harmful information unless the company pays. Security+ expects candidates to distinguish among threat actor motivations based on observable behavior, not just technical actions. Data exfiltration describes what the employee did by copying proprietary files, but blackmail describes why the employee is using the stolen or sensitive information. Espionage would be more appropriate if the documents were being stolen for a competitor or foreign government. Revenge is plausible for a departing employee, but the demand for payment makes blackmail the strongest fit. This aligns with common incident-response and insider-threat guidance from organizations such as CISA and NIST, which emphasize evaluating motive, intent, and impact when classifying malicious activity.
- A. Incorrect.
Espionage involves stealing sensitive information to benefit another organization or nation-state, often for intelligence or competitive advantage. Although proprietary aircraft documents were copied, the scenario's strongest indicator is the demand for payment in exchange for not releasing damaging information, which points more directly to blackmail than espionage.
- B. Incorrect.
Ethical motivation typically applies to authorized security testing or research intended to improve security, such as actions by an ethical hacker operating with permission. In this scenario, the former employee acted without authorization, removed proprietary data, and demanded money, so the behavior is clearly malicious rather than ethical.
- C. Incorrect.
Revenge can motivate disgruntled insiders to steal data or damage systems after a perceived slight, and the recent resignation could make this option seem plausible. However, the explicit threat to release embarrassing messages unless the company pays a large sum indicates extortion as the primary motive. Revenge may be a secondary factor, but it is not the best answer.
- D. Correct.
Blackmail is the correct answer because the employee is threatening to release damaging information unless the company pays money. This is a classic extortion scenario. While the copying of design documents also suggests data exfiltration, the stated objective in the scenario is coercing payment by threatening disclosure, which aligns most directly with blackmail.
- E. Incorrect.
Philosophical/political beliefs are commonly associated with hacktivism, where attackers act to advance a social, political, or ideological cause. Nothing in the scenario suggests the employee is motivated by activism or ideology. The demand for money and coercive threat are inconsistent with that motivation.