SFPC - Security Fundamentals Professional Insider Threat Awareness Questions and Answers 1 — Questions and Answers
Question 1: An employee with authorized access to sensitive project files is observed exhibiting several potential risk indicators. They have recently started working unusually late hours, expressed significant dissatisfaction with management, and have been attempting to access files unrelated to their job responsibilities. These behaviors are MOST indicative of what type of threat?
- An external threat actor attempting to brute-force network access.
- A negligent insider who is unintentionally violating policy.
- A potential malicious insider threat. (Correct answer)
- A compromised insider whose credentials have been stolen.
Correct answer: A potential malicious insider threat.
The combination of behavioral indicators (dissatisfaction, unusual hours) and technical indicators (attempting to access unauthorized information) strongly suggests a potential malicious insider threat, where an individual intentionally uses their authorized access to cause harm.
Question 2: Which of the following describes an unintentional insider threat?
- A disgruntled systems administrator who sabotages a critical server after being terminated.
- An employee who sells proprietary company data to a competitor for financial gain.
- A contractor who clicks on a phishing email link, inadvertently installing malware on the network. (Correct answer)
- A former employee who uses their still-active credentials to access and steal customer information.
Correct answer: A contractor who clicks on a phishing email link, inadvertently installing malware on the network.
An unintentional insider threat occurs when an authorized user inadvertently causes harm without malicious intent. Clicking on a phishing link is a classic example of an accidental action that can lead to a significant security breach. The other options all describe deliberate, malicious actions.
Question 3: A security manager is reviewing network logs as part of the organization's insider threat program. Which of the following activities would be considered a primary technical indicator of a potential insider threat?
- An employee accessing their corporate email from a personal mobile device.
- A large volume of data being downloaded to a removable storage device from a sensitive database. (Correct answer)
- A user failing to log out of their workstation at the end of the workday.
- Multiple employees accessing the company's public-facing website during lunch hours.
Correct answer: A large volume of data being downloaded to a removable storage device from a sensitive database.
Massive data exfiltration, such as downloading large volumes of data to a USB drive, is a critical technical indicator of a potential insider threat. While the other options may be policy violations, the large-scale movement of sensitive data is a much stronger and more direct indicator of potential theft or compromise.
Question 4: What is the primary purpose of establishing a formal Insider Threat Program within an organization?
- To exclusively focus on preventing espionage by foreign intelligence entities.
- To replace the need for traditional cybersecurity measures like firewalls and antivirus software.
- To create a culture of suspicion and distrust among employees to deter collaboration.
- To deter, detect, and mitigate threats posed by individuals with authorized access to organizational resources. (Correct answer)
Correct answer: To deter, detect, and mitigate threats posed by individuals with authorized access to organizational resources.
The core goal of an insider threat program is to provide a comprehensive, centralized capability to deter, detect, and mitigate risks from insiders who may intentionally or unintentionally harm the organization. This includes employees, contractors, and partners with authorized access.
Question 5: An employee observes a coworker using a personal smartphone to photograph documents marked 'Confidential' at their desk, a clear violation of company policy. What is the MOST appropriate immediate action for the observing employee to take?
- Confront the coworker directly and demand they delete the photos.
- Post about the incident on an anonymous company social media forum.
- Report the observation to their designated security manager or through the official insider threat reporting channel. (Correct answer)
- Wait to see if the coworker does it again before deciding on a course of action.
Correct answer: Report the observation to their designated security manager or through the official insider threat reporting channel.
Employees have a responsibility to report potential security incidents and insider threat indicators. The proper procedure is to report the activity through official channels, such as to a supervisor, Facility Security Officer (FSO), or a designated insider threat program official, so it can be investigated appropriately.
Question 6: Which of the following is a key administrative control used to mitigate insider threats?
- Installing user and entity behavior analytics (UEBA) software on the network.
- Requiring all employees to use multi-factor authentication for system access.
- Implementing a policy of least privilege to ensure employees only have access to information required for their jobs. (Correct answer)
- Deploying security cameras in all sensitive areas of the facility.
Correct answer: Implementing a policy of least privilege to ensure employees only have access to information required for their jobs.
The principle of least privilege is a fundamental administrative control that limits user access to the minimum levels that are necessary to perform their job functions. This mitigates risk by reducing the amount of data an insider *can* access, thereby limiting the potential damage from either a malicious or unintentional act. The other options are technical or physical controls.
SFPC - Security Fundamentals Professional Insider Threat Awareness Questions and Answers 1
An employee with authorized access to sensitive project files is observed exhibiting several potential risk indicators.
They have recently started working unusually late hours, expressed significant dissatisfaction with management, and have been attempting to access files unrelated to their job responsibilities.
These behaviors are MOST indicative of what type of threat?