Insider Attacks SCE Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security team is investigating a potential insider threat. They have identified an employee who has access to sensitive data and has recently exhibited several behavioral indicators: working late, downloading large files, and expressing dissatisfaction with the company. However, the employee's manager says the employee is working on a legitimate project that requires after-hours access and large data transfers. Which of the following is the best course of action?

   • AImmediately suspend the employee's access pending a full investigation
   • BConduct a focused investigation to verify the legitimacy of the activity, such as reviewing project documentation and data transfer destinations
   • CIncrease monitoring of the employee's activity without informing them
   • DDismiss the behavioral indicators because the manager has provided a legitimate explanation
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company is implementing an insider threat program and wants to identify potential risks early. Which of the following is a common motivation for insider attacks that the program should monitor?

   • AExternal pressure from competitors to gain market advantage
   • BDesire to improve company security posture
   • CFinancial gain from selling company secrets
   • DAccidental deletion of files due to user error
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company is considering implementing a user activity monitoring (UAM) system to detect insider threats. The system would record all user actions, including emails, file access, and web browsing. The company is concerned about employee privacy and legal implications. Which of the following approaches best balances the need for security with employee privacy concerns?

   • AImplement UAM without notifying employees to avoid alerting potential insiders
   • BImplement UAM with a clear policy that informs employees of monitoring, and limit monitoring to work-related activities
   • CAvoid UAM entirely and rely on employee self-reporting of suspicious activity
   • DImplement UAM only for employees who have been flagged as high-risk
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A user at a law firm clicks a link in a phishing email and enters their credentials. The attacker then uses those credentials to access client files. Which type of insider threat does this scenario represent, and what is the most important mitigation to prevent recurrence?

   • AMalicious insider; terminate the user for violating policy.
   • BNegligent insider; provide security awareness training and enforce multi-factor authentication.
   • CExternal attack; block the phishing domain in the firewall.
   • DCompromised insider; reimage the user's workstation.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company is merging with another firm. During the transition, several employees from the acquired company have been given access to the parent company's systems. Which insider-threat risk is most elevated, and what is the most effective mitigation?

   • AMalicious insiders from the acquired company; immediately revoke all access for acquired employees.
   • BCompromised insiders whose accounts may be targeted; enforce MFA and conduct access reviews for all new accounts.
   • CNegligent insiders who may mishandle data; provide training on the parent company's policies.
   • DExternal attackers posing as acquired employees; block all traffic from the acquired company's IP range.
   Reveal Solution Discussion Select an answer first