Insider Attacks SCE Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A system administrator notices that a user in the finance department has been downloading large amounts of customer data to a USB drive over the past week. The user's manager reports the employee has been acting withdrawn and has made negative comments about the company. Which combination of actions should the administrator take first?

   • AImmediately disable the user's account and confiscate the USB drive
   • BQuietly monitor the user's activity and gather more evidence before acting
   • CSend a company-wide email reminding employees about data handling policies
   • DAlert the incident response team and preserve logs while restricting the user's access to sensitive data
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has experienced a data breach caused by an employee who accidentally emailed a confidential spreadsheet to the wrong recipient. Which type of insider threat does this represent, and what is the most effective mitigation to prevent recurrence?

   • ACompromised insider; reset all passwords and enforce multi-factor authentication
   • BMalicious insider; implement stricter access controls
   • CExternal attacker; enhance firewall rules
   • DNegligent insider; provide training on data handling and implement email DLP controls
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst notices that a user account with administrative privileges is downloading files from a confidential share at 3 a.m. The account belongs to an IT administrator who is on vacation. Which type of insider threat is most likely, and what is the first step?

   • ACompromised insider; verify the activity with the administrator and temporarily disable the account if it cannot be confirmed.
   • BMalicious insider; the administrator is using their privileges to steal data.
   • CExternal attack; block the IP address of the session.
   • DNegligent insider; the administrator left a scheduled task running.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard · select all that apply

   A company wants to implement a comprehensive insider-threat mitigation program. Which of the following controls are effective components of such a program? (Select all that apply.)

   • AAllowing employees to use personal cloud storage for work files to increase productivity.
   • BConducting regular user access reviews.
   • CImplementing least-privilege access controls.
   • DProviding security awareness training on data handling and phishing.
   • EMonitoring user behavior with DLP and UBA tools.
   Check answers Discussion Select an answer first
6. 5expert · hard

   A company discovers that a departing employee emailed proprietary source code to a personal account before resigning. The employee claims it was for personal reference and not for a competitor. The company has a strict data-loss-prevention policy. Which response best balances legal, operational, and security considerations?

   • ASend a warning email to the employee and ask them to delete the email from their personal account.
   • BPreserve forensic evidence, revoke the employee's access, and conduct an investigation to determine the scope and intent.
   • CImmediately terminate the employee and file a criminal complaint.
   • DIgnore the incident because the employee claims it was for personal reference.
   Reveal Solution Discussion Select an answer first