Handling and Responding to Insider Threats ECIH Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An incident response team is investigating a suspected insider threat. The team has collected the suspect's laptop and made a forensic image. The original laptop is now stored in a secure evidence locker. What is the correct next step to maintain chain of custody?

   • AShare the forensic image with all incident response team members
   • BAnalyze the forensic image and then delete the original image
   • CDocument the transfer of the laptop to the evidence locker with date, time, and personnel involved
   • DReturn the laptop to the user to avoid disruption
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization has experienced several insider threat incidents involving employees sending sensitive data to personal email accounts. The security team is considering implementing a data loss prevention (DLP) solution. However, the organization has a high volume of legitimate email traffic that includes sensitive data sent to external partners. Which approach would best reduce insider threat risk while minimizing disruption to legitimate business?

   • ABlock all emails containing sensitive data to external addresses
   • BMonitor all email traffic without any automated actions
   • CDisable email access for all employees
   • DImplement DLP rules that alert on sensitive data sent to personal email domains, but allow external partner domains
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is an example of a behavioral indicator that may signal an insider threat?

   • AAn employee accessing files outside of normal working hours
   • BA new firewall rule being implemented
   • CA sudden increase in network bandwidth usage
   • DA change in the organization's security policy
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An organization has confirmed an insider threat incident involving a mid-level manager who has been selling customer data to a competitor. The incident response team has contained the incident and collected evidence. The legal department is preparing for a civil lawsuit against the manager. Which communication should the incident response team provide to the legal department?

   • AA summary of the incident for public disclosure
   • BA list of all employees who had access to the customer data
   • CA recommendation for the manager's termination
   • DA detailed technical report of the incident, including evidence and chain of custody
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an insider threat investigation, the incident handler needs to share information with external parties. What is the MOST important consideration?

   • AShare information only after the investigation is complete
   • BShare all evidence to ensure transparency
   • CShare only the minimum necessary information and follow legal requirements
   • DShare information with any interested party
   Reveal Solution Discussion Select an answer first