Insider Attacks SCE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A security analyst is investigating a data breach where customer records were leaked. The logs show that a legitimate employee account was used to access the data, but the employee claims they did not perform the actions. Which of the following scenarios best explains this situation?

   • AThe employee is lying and is a malicious insider
   • BThe logs are incorrect and the breach was external
   • CThe employee was negligent and left their workstation unlocked
   • DThe employee's account was compromised, making them a compromised insider
   Reveal Solution Discussion Select an answer first
2. 27expert · hard · select all that apply

   A security team is reviewing a user's activity after a suspected insider incident. Which of the following are common behavioral indicators of a malicious insider? (Select all that apply.)

   • ADownloading large volumes of data shortly before resignation.
   • BAttempting to bypass security controls such as DLP or proxy filters.
   • CAccessing sensitive files outside of normal working hours.
   • DExpressing dissatisfaction with the company or management.
   • EConsistently arriving early and staying late.
   Check answers Discussion Select an answer first
4. 28application · medium

   A security analyst is reviewing user activity logs and notices that an employee who normally works 9-to-5 has been logging in at odd hours, accessing areas of the file server unrelated to their role, and recently received a poor performance review. Which of the following best describes the significance of these observations?

   • AThey are normal work patterns and should be ignored
   • BThey are behavioral indicators that warrant further investigation
   • CThey are evidence of a compromised account rather than an insider action
   • DThey are definitive proof that the employee is an insider threat
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is a primary impact of insider attacks on an organization?

   • AReduced need for security monitoring because threats are internal.
   • BLoss of proprietary data and intellectual property.
   • CImproved employee morale due to increased security awareness.
   • DIncreased network bandwidth due to higher traffic volumes.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company has a high number of insider threat incidents, but most are minor, such as accidental data exposure. The security team wants to reduce the overall risk without implementing overly restrictive controls that could harm productivity. Which of the following strategies is most effective for this goal?

   • AMonitor all employee communications and internet usage continuously
   • BRequire all employees to use a VPN for all internet access
   • CBlock all external email and file sharing services
   • DImplement a comprehensive security awareness training program and enforce data classification policies
   Reveal Solution Discussion Select an answer first