Handling and Responding to Insider Threats ECIH Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which control is most effective in reducing the risk of insider threats by limiting the amount of data an employee can access?

   • AImplementing the principle of least privilege
   • BInstalling antivirus software
   • CConducting regular security awareness training
   • DUsing strong password policies
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team is reviewing indicators of insider threats. Which combination of indicators would MOST strongly suggest a malicious insider?

   • AA user accessing sensitive files outside work hours and using a personal cloud storage service
   • BA user receiving a promotion and taking on more responsibilities
   • CA user attending security awareness training
   • DA user requesting a new monitor for their workstation
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   During the containment phase of an insider threat incident, the incident handler must prevent further data exfiltration while preserving the ability to investigate. Which action BEST achieves this?

   • AChange the user's password and leave the session active
   • BDisconnect the user's workstation from the network but keep it powered on
   • CShut down the workstation immediately
   • DMove the workstation to a different network segment
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company wants to detect employees who are about to leave and might exfiltrate sensitive data. They already have DLP on email and web. Which additional control would BEST detect unusual data access patterns before departure?

   • AAntivirus with heuristics
   • BPeriodic manual review of access logs
   • CNetwork intrusion detection system (NIDS)
   • DUser and Entity Behavior Analytics (UEBA)
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   Following an insider threat incident where an employee with access to financial systems sold confidential data, the organization wants to implement controls to reduce the risk of similar incidents. Which control is most directly aimed at limiting the damage a single insider can cause?

   • AIncrease the frequency of password changes
   • BConduct regular security awareness training for all employees
   • CDeploy an intrusion detection system on the network
   • DImplement separation of duties and least privilege access
   Reveal Solution Discussion Select an answer first