Insider Attacks SCE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing a user's activity and finds that the user has been logging in from a remote location that is not typical for them, and the user's recent behavior includes downloading large amounts of data. The user's manager says the employee is on vacation. What should the analyst suspect?

   • AThe logs are incorrect due to a technical glitch
   • BThe employee is being negligent by accessing work systems during vacation
   • CThe employee's account has been compromised, and the attacker is acting as an insider
   • DThe employee is a malicious insider using vacation time to steal data
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating a potential insider threat. The user in question has access to sensitive data and has been exhibiting signs of financial stress. Which combination of behavioral indicators would most strongly suggest a malicious insider?

   • AThe user occasionally forgets to lock their workstation.
   • BThe user has received positive feedback from their manager.
   • CThe user accesses sensitive files outside normal working hours, downloads large volumes of data, and attempts to bypass DLP controls.
   • DThe user frequently works overtime and completes tasks ahead of schedule.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security analyst at a financial firm is investigating a potential data exfiltration. The logs show that a senior trader's account was used to access a large number of client records and then transfer them to an external cloud storage service. The trader is known to be disgruntled after a recent bonus dispute. However, the analyst also notices that the trader's account had a failed login attempt from a foreign IP address just before the activity began. Which conclusion is most appropriate?

   • AThe trader is a malicious insider because they have a motive and the activity matches their account
   • BThe trader is a negligent insider because they may have left their account vulnerable
   • CThe evidence is inconclusive, and the analyst should gather more data to determine whether the trader acted maliciously or was compromised
   • DThe trader is a compromised insider because the foreign IP login indicates an external attacker took over the account
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A mid-sized company has a small security team. They have a SIEM that generates many alerts, but the team cannot investigate all of them. They want to focus on insider threats. Which approach best balances detection coverage with the team's limited capacity?

   • ADisable all alerts and rely on annual user behavior analytics reports.
   • BCreate alerts for all failed logins and all file-access events, and review them weekly.
   • CCreate alerts for a small set of high-risk behaviors, such as mass file downloads, after-hours access to sensitive folders, and attempts to access unauthorized resources.
   • DAlert on every login from a new device and require the team to respond within 10 minutes.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A financial analyst at a bank is observed logging into the customer relationship management system at 2:00 AM from the office, accessing records of high-net-worth clients, and emailing a spreadsheet to a personal webmail address. The analyst has no history of policy violations and had recently complained about a denied promotion. Which classification best describes this insider threat?

   • ANegligent insider
   • BCompromised insider
   • CMalicious insider
   • DExternal attacker
   Reveal Solution Discussion Select an answer first