Handling and Responding to Insider Threats ECIH Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   An organization wants to detect insider threats that involve employees sending sensitive files to personal email accounts. The security team has access to email gateway logs, endpoint DLP agents, and Active Directory. Which detection technique would most directly identify this specific behavior?

   • AMonitor privileged account usage with a privileged access management solution
   • BConfigure data loss prevention rules on the email gateway to block or alert on sensitive content sent to personal domains
   • CDeploy user behavior analytics to flag users who access files outside business hours
   • DReview Active Directory logs for failed login attempts
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A security analyst notices that a finance manager with access to the payment system has been logging in at 2:00 AM from the office network, downloading large batches of customer records to a USB drive, and then deleting the local copies. The analyst suspects an insider threat. What should the analyst do FIRST?

   • ADisable the manager's account and revoke all access rights
   • BConfront the manager immediately to ask for an explanation
   • CCopy the downloaded files to a secure share for later analysis
   • DPreserve the logs and USB activity records, then escalate to the incident response team
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A security operations center wants to detect insider threats that involve employees accessing sensitive files they do not need for their job. Which detection technique is most effective for this scenario?

   • AAntivirus software that scans for malicious executables
   • BFirewall logs that show outbound connections
   • CUser behavior analytics that baselines normal access patterns and flags deviations
   • DNetwork intrusion detection systems that monitor for malware signatures
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   An incident handler is collecting evidence from a suspect's computer. The handler must ensure that the evidence is admissible in court. Which practice is MOST critical?

   • AAnalyze the evidence on the original system
   • BDocument every action taken with timestamps and signatures
   • CUse the fastest forensic tool available
   • DKeep the evidence in the incident handler's desk drawer
   Reveal Solution Discussion Select an answer first
6. 40foundation · easy

   Which detection technique is most effective for preventing the unauthorized transfer of sensitive data outside the organization?

   • APrivileged access monitoring
   • BUser behavior analytics (UBA)
   • CNetwork intrusion detection system (NIDS)
   • DData loss prevention (DLP)
   Reveal Solution Discussion Select an answer first