What is the primary reason for reporting insider threat incidents to law enforcement?

To receive technical support from law enforcement

To transfer liability to law enforcement

To publicize the incident to deter other employees

To comply with legal obligations and enable prosecution

A user's workstation is infected with malware that is sending internal documents to an external server. The user had no knowledge of the malware and did not intentionally exfiltrate data. How should the incident response team classify this insider?

Compromised insider, because the user's credentials or system are under external control

External attacker, because the malware originated from outside the organization

Malicious insider, because the user's system is the source of the data loss

Negligent insider, because the user failed to prevent the malware infection

A company has a high rate of false positives in its insider threat detection system, causing alert fatigue. The security team wants to reduce false positives without missing real threats. Which approach is MOST effective?

Increase the alert threshold for all indicators

Tune the analytics to require multiple correlated indicators before alerting

Disable alerts for low-risk users

Reduce the number of monitored data sources

In the eradication phase of insider threat response, which action is typically performed?

Disabling the insider's user account

Removing malicious software or backdoors installed by the insider

EC-CouncilCertified Incident Handler

Domain 5Objective 1

Handling and Responding to Insider Threats ECIH Practice Questions (Page 3)

Part of the Insider Threats and Endpoint Incidents domain, which makes up ~20% of our current practice bank.

46questions here

10free pages

7concepts

Questions 11–15

11foundation · easy
What is the primary reason for reporting insider threat incidents to law enforcement?
Select an answer first
12application · medium
A user's workstation is infected with malware that is sending internal documents to an external server. The user had no knowledge of the malware and did not intentionally exfiltrate data. How should the incident response team classify this insider?
Select an answer first
13expert · hard
A company has a high rate of false positives in its insider threat detection system, causing alert fatigue. The security team wants to reduce false positives without missing real threats. Which approach is MOST effective?
Select an answer first
14foundation · easy
Which detection technique is specifically designed to identify unusual patterns of user behavior that may indicate an insider threat?
Select an answer first
15foundation · easy
In the eradication phase of insider threat response, which action is typically performed?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.