A manufacturing company has a small IT team and cannot afford a full SIEM. They want to detect insider threats without overwhelming the team with alerts. Which approach best balances detection and workload?

Enable logging on all systems and review logs manually once a month.

Rely on employee self-reporting and annual security surveys.

Deploy a free log-management tool and create alerts for high-risk events like mass file deletions or after-hours access to sensitive folders.

Disable all external storage devices and assume the risk is eliminated.

A company's security team discovers that a former employee's VPN account is still active and has been used to access the internal network. The former employee was terminated for cause. Which type of insider threat is this, and what is the most urgent action?

Malicious insider; immediately disable the VPN account and all associated access.

Negligent insider; the former employee forgot to return their VPN token.

External attack; block the VPN endpoint's IP address.

Compromised insider; the former employee's account was stolen by an external actor.

A SOC analyst observes unusual data transfers from an employee's workstation to a personal cloud storage account during off-hours. The employee has valid credentials and is authorized to access the data. How would this activity be classified?

A distributed denial-of-service (DDoS) attack, because the data transfer consumes network bandwidth.

An external attack, because the data is being sent to an external cloud service.

An insider attack, because the employee is using legitimate access to perform unauthorized actions.

A social engineering attack, because the employee was tricked into transferring data.

A security analyst is examining a data breach that involved the theft of customer data. The investigation reveals that the data was accessed using a valid employee account, but the employee's workstation shows signs of malware that could have captured keystrokes. The employee has no history of malicious behavior and has a clean record. Which classification is most appropriate for this incident?

Compromised insider, because the malware allowed an external attacker to use the employee's credentials

Malicious insider, because the employee's account was used

External attacker, because the malware was the direct cause of the breach

Negligent insider, because the employee failed to prevent malware infection

A company has a high turnover rate in its IT department. Several employees have left recently, and the security team is concerned about the risk of former employees using their old credentials to access systems. Which of the following controls is most effective in mitigating this specific risk?

Immediately revoke access for all departing employees and conduct exit interviews

Implement a policy that requires all employees to change their passwords every 90 days

Implement an automated identity lifecycle management system that disables accounts when an employee is terminated

Use a user access review process to periodically audit and remove accounts of former employees

EC-CouncilSOC Essentials

Domain 2Objective 4

Insider Attacks SCE Practice Questions (Page 8)

Part of the Fundamentals of Cyber Threats domain, which makes up ~12% of our current practice bank. EC-Council does not publish an official question count, but from its 120-minute exam (~50–80 total, ~6–10 in this domain), expect 1–2 from this objective — we provide 42 practice questions to prepare you well beyond it. (estimate)

42questions here

9free pages

4concepts

Questions 36–40

36application · medium
A manufacturing company has a small IT team and cannot afford a full SIEM. They want to detect insider threats without overwhelming the team with alerts. Which approach best balances detection and workload?
Select an answer first
37expert · hard
A company's security team discovers that a former employee's VPN account is still active and has been used to access the internal network. The former employee was terminated for cause. Which type of insider threat is this, and what is the most urgent action?
Select an answer first
38foundation · easy
A SOC analyst observes unusual data transfers from an employee's workstation to a personal cloud storage account during off-hours. The employee has valid credentials and is authorized to access the data. How would this activity be classified?
Select an answer first
39expert · hard
A security analyst is examining a data breach that involved the theft of customer data. The investigation reveals that the data was accessed using a valid employee account, but the employee's workstation shows signs of malware that could have captured keystrokes. The employee has no history of malicious behavior and has a clean record. Which classification is most appropriate for this incident?
Select an answer first
40expert · hard
A company has a high turnover rate in its IT department. Several employees have left recently, and the security team is concerned about the risk of former employees using their old credentials to access systems. Which of the following controls is most effective in mitigating this specific risk?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SCE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “SCE” is a trademark of its owner, used for identification only.