During an insider threat investigation, the incident handler needs to collect a laptop's hard drive as evidence. What is the MOST important action to preserve the evidence's admissibility?

Remove the drive and store it in a plastic bag

Copy all files to a network share

Create a forensic image of the drive using a write blocker

Run a quick antivirus scan on the drive

An incident handler is managing an insider threat case that involves a high-ranking executive. The executive's activities are under investigation, and the handler must report to the board. What is the BEST way to communicate the status?

Report only to the executive's direct supervisor

Share all evidence with the board to ensure transparency

Delay reporting until the investigation is complete

Provide a high-level summary without revealing sensitive investigative details

An incident handler discovers that an employee has been selling customer data to a competitor. The handler has collected evidence and the legal team is involved. What is the MOST appropriate next step in communication?

Post a warning on the company's internal social network

Wait until the employee resigns before reporting

Notify law enforcement and the organization's data protection officer

Inform all employees about the investigation

An organization wants to detect insider threats that involve employees accessing sensitive data outside of their normal working hours. The security team has access to authentication logs, file access logs, and a user behavior analytics (UBA) platform. Which approach would best identify this behavior while minimizing false positives?

Use UBA to establish a baseline of each user's normal working hours and alert on deviations

Alert on any access to sensitive data outside of 9 AM to 5 PM

Alert on any access to sensitive data from a new device

Monitor for multiple failed login attempts followed by successful login

A company wants to implement a comprehensive insider threat detection program. Which of the following techniques should be included? (Select all that apply.)

Data Loss Prevention (DLP) on endpoints and network

User and Entity Behavior Analytics (UEBA)

Manual review of all employee emails

EC-CouncilCertified Incident Handler

Domain 5Objective 1

Handling and Responding to Insider Threats ECIH Practice Questions (Page 6)

Part of the Insider Threats and Endpoint Incidents domain, which makes up ~20% of our current practice bank.

46questions here

10free pages

7concepts

Questions 26–30

26application · medium
During an insider threat investigation, the incident handler needs to collect a laptop's hard drive as evidence. What is the MOST important action to preserve the evidence's admissibility?
Select an answer first
27expert · hard
An incident handler is managing an insider threat case that involves a high-ranking executive. The executive's activities are under investigation, and the handler must report to the board. What is the BEST way to communicate the status?
Select an answer first
28application · medium
An incident handler discovers that an employee has been selling customer data to a competitor. The handler has collected evidence and the legal team is involved. What is the MOST appropriate next step in communication?
Select an answer first
29expert · hard
An organization wants to detect insider threats that involve employees accessing sensitive data outside of their normal working hours. The security team has access to authentication logs, file access logs, and a user behavior analytics (UBA) platform. Which approach would best identify this behavior while minimizing false positives?
Select an answer first
30expert · hard · select all that apply
A company wants to implement a comprehensive insider threat detection program. Which of the following techniques should be included? (Select all that apply.)
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.