A security analyst sees a user account that belongs to a former contractor downloading a large number of files from a file server. The account was supposed to be disabled when the contractor left two weeks ago. Which statement best describes this event?

This is a compromised insider attack because the contractor's account was stolen by an external actor.

This is an external attack because the contractor no longer works for the company.

This is a negligent insider attack because the contractor forgot to return their credentials.

This is an insider attack because the activity uses legitimate credentials that were provisioned to the contractor.

A healthcare organization is concerned about the risk of employees accessing patient records without a legitimate need. They want to implement a control that reduces this risk while maintaining operational efficiency. Which control is most effective for this purpose?

Require all employees to sign a confidentiality agreement annually

Monitor employee social media for signs of dissatisfaction

Disable USB ports on all workstations to prevent data exfiltration

Implement role-based access control (RBAC) and audit logging of all patient record access

A company is implementing a least-privilege policy to reduce insider risk. Which action best supports this policy?

Grant all employees the same level of access to simplify administration.

Use a single shared account for all employees in each department.

Review and adjust user permissions quarterly, removing access that is no longer needed for current roles.

Provide all employees with administrator accounts to avoid help-desk delays.

EC-CouncilSOC Essentials

Domain 2Objective 4

Insider Attacks SCE Practice Questions (Page 2)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 6–10

6application · medium
A security analyst sees a user account that belongs to a former contractor downloading a large number of files from a file server. The account was supposed to be disabled when the contractor left two weeks ago. Which statement best describes this event?
Select an answer first
7foundation · easy
An employee unintentionally clicks a phishing link and enters their credentials, allowing an attacker to access the corporate network. Which category of insider threat does this employee represent?
Select an answer first
8application · medium
A healthcare organization is concerned about the risk of employees accessing patient records without a legitimate need. They want to implement a control that reduces this risk while maintaining operational efficiency. Which control is most effective for this purpose?
Select an answer first
9application · medium
A company is implementing a least-privilege policy to reduce insider risk. Which action best supports this policy?
Select an answer first
10foundation · easy
Which of the following is a standard category of insider threat?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.

Insider Attacks SCE Practice Questions (Page 2)

Questions 6–10

A security analyst sees a user account that belongs to a former contractor downloading a large number of files from a file server. The account was supposed to be disabled when the contractor left two weeks ago. Which statement best describes this event?

An employee unintentionally clicks a phishing link and enters their credentials, allowing an attacker to access the corporate network. Which category of insider threat does this employee represent?

A healthcare organization is concerned about the risk of employees accessing patient records without a legitimate need. They want to implement a control that reduces this risk while maintaining operational efficiency. Which control is most effective for this purpose?

A company is implementing a least-privilege policy to reduce insider risk. Which action best supports this policy?

Which of the following is a standard category of insider threat?

Keep studying — Fundamentals of Cyber Threats