200-201 Question 395
Select 3A cybersecurity analyst at your organization identifies an unauthorized attempt to exfiltrate a proprietary algorithm developed by your company. Upon further investigation, the analyst discovers that an employee's credentials were used to access the sensitive data. Which of the following actions should the organization prioritize to protect its intellectual property?
- A
Revoke the compromised credentials and enforce a password reset for the affected account.
- B
Notify law enforcement and provide them with all forensic evidence collected.
- C
Disable access to the proprietary algorithm for all employees until the investigation is complete.
- D
Implement stricter access controls and monitor privileged accounts for unusual activity.
- E
Immediately contact the end user whose credentials were compromised to confront them about the breach.
Show answer and explanation
Correct answers: A, B, D
Explanation
Protecting intellectual property during a cybersecurity incident requires a combination of immediate containment (e.g., revoking compromised credentials), escalation to relevant authorities (e.g., law enforcement), and long-term measures to prevent recurrence (e.g., stricter access controls). These actions prioritize the safeguarding of sensitive data while ensuring that a proper investigation can proceed.
- A. Correct.
Revoking the compromised credentials and enforcing a password reset is a critical step to prevent further unauthorized access to sensitive data.
- B. Correct.
Notifying law enforcement is essential in cases involving intellectual property theft, as it is a serious legal matter that could have significant financial and competitive consequences.
- C. Incorrect.
Disabling access to the proprietary algorithm for all employees is not practical or necessary unless there is evidence that a widespread threat exists.
- D. Correct.
Implementing stricter access controls and monitoring privileged accounts helps reduce the risk of future breaches and ensures better protection of intellectual property.
- E. Incorrect.
Confronting the end user immediately is not an appropriate action as it could disrupt the investigation, especially if the credentials were stolen without their knowledge.