An incident handler is responding to an insider threat where a developer has been exfiltrating source code to a personal repository. The developer is a key contributor to a critical project. The handler must contain the threat while minimizing disruption to the project. What is the BEST approach?

Immediately revoke the developer's access and isolate the workstation

Monitor the developer's activities and gradually restrict access to sensitive repositories

Do nothing until the project is completed

Confront the developer and ask for an explanation

A financial analyst has been printing large volumes of client reports and accessing the customer database outside normal business hours for the past two weeks. The analyst's manager reports the employee has recently been passed over for promotion and has made negative comments about the company. Which combination of indicators should prompt the incident response team to escalate this as a potential insider threat?

The employee's negative comments alone, as they signal intent to harm the company

Technical indicators of unusual access times and data volume, combined with behavioral indicators of disgruntlement

The fact that the employee has legitimate access to the customer database

Organizational indicators such as recent restructuring and the employee's tenure

After an insider threat incident, an organization wants to implement a control to detect employees who are about to leave the company and might take sensitive data. The organization has a policy that prohibits employees from accessing certain systems after they submit their resignation. Which control would best enforce this policy?

Monitor employee behavior for signs of disgruntlement

Require managers to manually disable access when they learn of a resignation

Conduct exit interviews to remind employees of their obligations

Automatically revoke access to sensitive systems when HR records a resignation

During an insider threat incident, the incident response team discovers that a manager has been accessing employee salary records without authorization. The team has confirmed the activity. Which stakeholder should the team notify first?

The human resources department and legal counsel

The local law enforcement agency

All employees via a company-wide email

The manager's direct supervisor

When collecting digital evidence from an insider's workstation, which action is most important to preserve the evidence's integrity?

Copying only the files that appear relevant

Browsing the files to identify relevant data

Creating a forensic image of the hard drive

Turning off the computer immediately

EC-CouncilCertified Incident Handler

Domain 5Objective 1

Handling and Responding to Insider Threats ECIH Practice Questions (Page 9)

Part of the Insider Threats and Endpoint Incidents domain, which makes up ~20% of our current practice bank.

46questions here

10free pages

7concepts

Questions 41–45

41expert · hard
An incident handler is responding to an insider threat where a developer has been exfiltrating source code to a personal repository. The developer is a key contributor to a critical project. The handler must contain the threat while minimizing disruption to the project. What is the BEST approach?
Select an answer first
42application · medium
A financial analyst has been printing large volumes of client reports and accessing the customer database outside normal business hours for the past two weeks. The analyst's manager reports the employee has recently been passed over for promotion and has made negative comments about the company. Which combination of indicators should prompt the incident response team to escalate this as a potential insider threat?
Select an answer first
43expert · hard
After an insider threat incident, an organization wants to implement a control to detect employees who are about to leave the company and might take sensitive data. The organization has a policy that prohibits employees from accessing certain systems after they submit their resignation. Which control would best enforce this policy?
Select an answer first
44application · medium
During an insider threat incident, the incident response team discovers that a manager has been accessing employee salary records without authorization. The team has confirmed the activity. Which stakeholder should the team notify first?
Select an answer first
45foundation · easy
When collecting digital evidence from an insider's workstation, which action is most important to preserve the evidence's integrity?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECIH

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECIH” is a trademark of its owner, used for identification only.

Handling and Responding to Insider Threats ECIH Practice Questions (Page 9)

Questions 41–45

An incident handler is responding to an insider threat where a developer has been exfiltrating source code to a personal repository. The developer is a key contributor to a critical project. The handler must contain the threat while minimizing disruption to the project. What is the BEST approach?

During an insider threat incident, the incident response team discovers that a manager has been accessing employee salary records without authorization. The team has confirmed the activity. Which stakeholder should the team notify first?

When collecting digital evidence from an insider's workstation, which action is most important to preserve the evidence's integrity?

Keep studying — Insider Threats and Endpoint Incidents