312-50 Question 214
Single answer▪ Insider ThreatsA company has suffered several small but unexplained data leaks involving customer pricing spreadsheets. Network monitoring shows that the files were accessed by a sales analyst during normal business hours using valid credentials, then copied to a personal cloud storage site over HTTPS. The analyst's manager says the employee recently announced plans to join a competitor. As part of an insider threat assessment, which control would MOST effectively reduce the risk of similar incidents while still allowing the employee to perform legitimate job duties?
- A
Implement data loss prevention (DLP) rules to inspect and restrict sensitive file uploads to unsanctioned cloud services
- B
Disable all outbound HTTPS traffic from the analyst's workstation until the employee leaves the company
- C
Require the employee to change their password every day and monitor failed login attempts
- D
Move all pricing spreadsheets to a shared folder accessible by the entire sales department for transparency
Show answer and explanation
Correct answer: A
Explanation
This question tests the candidate's ability to distinguish between external compromise indicators and insider misuse. Here, the employee is authenticated, acting during normal hours, and abusing legitimate access to transfer sensitive data to a personal cloud service. That pattern aligns with a classic insider threat scenario. The most effective control is targeted data loss prevention combined with sanctioned-use policies and monitoring. In practice, organizations commonly combine DLP, cloud access security controls, least privilege, user activity monitoring, and formal offboarding procedures to manage insider risk. Guidance from NIST, including insider threat and data protection practices such as least privilege, monitoring of data movement, and control of exfiltration channels, supports this approach. The key exam takeaway is that when the threat is authorized misuse rather than unauthorized access, the best mitigation is usually a control focused on data handling and exfiltration rather than password or perimeter-only controls.
- A. Correct.
Correct. This scenario describes a malicious or negligent insider using legitimate access to exfiltrate sensitive data through a personal cloud service. DLP is specifically designed to identify, monitor, and control the movement of sensitive data across endpoints, networks, and cloud channels. Applying DLP policies to detect pricing spreadsheets or other confidential content and block uploads to unsanctioned cloud destinations addresses the actual exfiltration method while preserving legitimate internal access needed for the employee's role.
- B. Incorrect.
Incorrect. Blocking all outbound HTTPS traffic is overly disruptive and operationally unrealistic because most modern business applications depend on HTTPS. It does not represent a balanced, least-disruptive control and would likely impair normal business operations. A candidate might choose this because it appears to stop the immediate channel, but CEH-style questions generally favor precise, risk-based mitigations over broad service denial.
- C. Incorrect.
Incorrect. Frequent password changes and monitoring failed logins are more relevant to compromised accounts or brute-force attempts, not a trusted insider who is already using valid credentials successfully. In this case, the abuse occurs after authentication, so credential-focused controls do not address the core risk of authorized data misuse.
- D. Incorrect.
Incorrect. Expanding access to a broader group violates least privilege and increases the attack surface. It does not reduce insider threat risk; instead, it creates more opportunities for unauthorized disclosure. Someone might choose this if they confuse collaboration with accountability, but broader access is not a valid mitigation for insider exfiltration.