Insider Attacks SCE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A system administrator notices that a long-tenured employee, who is about to be laid off, has started accessing project repositories at unusual hours and downloading source code archives. The employee has never had a performance issue. Which combination of indicators and mitigation is most appropriate?

   • AImmediately revoke all access and publicly announce the investigation.
   • BInvestigate the activity as a potential malicious insider and temporarily restrict access to sensitive repositories while the case is reviewed.
   • CIgnore the behavior because the employee has a long tenure and no prior issues.
   • DTreat this as a negligent insider and provide refresher training on data handling.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An organization wants to reduce the risk of insider threats without hindering employee productivity. Which approach best balances security and usability?

   • AImplement least privilege access and conduct regular user activity reviews
   • BMonitor all employee communications and internet usage continuously
   • CRequire all employees to change passwords every 30 days
   • DDisable all external email and file sharing services
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team is designing a program to detect insider threats early. They want to focus on behavioral indicators that are most likely to precede a malicious action. Which of the following should they prioritize?

   • AEmployees taking frequent breaks during the workday
   • BEmployees participating in company social events
   • CEmployees using company-provided laptops for personal browsing
   • DEmployees accessing systems outside of normal working hours
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a common behavioral indicator of a potential insider threat?

   • AAn employee takes regular, scheduled vacations and never works overtime.
   • BAn employee consistently uses strong passwords and enables multi-factor authentication.
   • CAn employee accesses sensitive data outside of their normal job duties.
   • DAn employee frequently attends security awareness training sessions.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team is building a user-behavior analytics (UBA) program to detect insider threats. They have a small budget and need to choose which data sources to feed into the system. Which combination of data sources provides the best coverage for insider-threat detection?

   • AAuthentication logs, file-access logs, and email metadata.
   • BPhysical access logs only.
   • CPublic social media posts of employees.
   • DFirewall logs and DNS logs only.
   Reveal Solution Discussion Select an answer first