312-50 Question 216
Single answer▪ Insider ThreatsA company suspects a malicious insider in the finance department is copying sensitive payroll data to an external destination. The employee uses a managed Windows laptop, has legitimate access to the payroll share, and works remotely several days a week. Management wants to detect and contain suspicious activity without immediately disrupting normal business operations or accusing the employee without evidence. Which action would be the MOST appropriate first step for the security team?
- A
Enable and review detailed audit logging and DLP alerts for access to the payroll share, USB usage, and outbound transfers from the employee's endpoint and account
- B
Immediately disable the employee's account and seize the laptop to prevent any further data access
- C
Deploy a password-cracking attack against the employee's account to determine whether the credentials are weak or shared
- D
Block all outbound Internet access for the entire finance department until the investigation is complete
Show answer and explanation
Correct answer: A
Explanation
Insider threats are especially challenging because the user often has valid credentials and legitimate access to sensitive data. In CEH-style scenarios, the best answer typically balances detection, evidence preservation, least disruption, and proportional response. The security team should first improve visibility by correlating logs from file servers, endpoints, DLP systems, VPN, proxies, and identity platforms to distinguish normal business activity from suspicious behavior such as unusual file access volume, after-hours access, use of removable media, or transfer to unauthorized destinations. After confirming malicious behavior or a high likelihood of imminent loss, the team can escalate to containment measures such as account suspension, session termination, network isolation, or device seizure. This approach is consistent with common incident response guidance from NIST, particularly NIST SP 800-61 on incident handling, and with insider-risk monitoring practices that emphasize logging, behavioral analysis, chain of custody, and minimizing unnecessary operational impact.
- A. Correct.
Correct. In an insider-threat scenario, the most appropriate initial action is usually to increase visibility while preserving business continuity and evidence. Reviewing file access logs, endpoint telemetry, USB device events, VPN activity, proxy/firewall logs, and DLP alerts helps determine whether data access is legitimate job activity or suspicious exfiltration. This aligns with common insider-threat best practices: establish facts first, correlate user/account/device behavior, and preserve evidence before taking disruptive action.
- B. Incorrect.
Incorrect. Disabling the account and seizing the device may be appropriate later if there is confirmed malicious activity or immediate risk, but it is not the best first step here because management specifically wants to avoid unnecessary disruption and action without evidence. Premature containment can also alert the insider, potentially causing evidence destruction or denying investigators the chance to observe the full method of exfiltration.
- C. Incorrect.
Incorrect. Password cracking is not an appropriate first response to a suspected insider with legitimate access. The issue is not whether the account password is weak, but whether authorized access is being misused. This option confuses external credential compromise testing with insider-threat investigation and could violate policy or legal boundaries if done without proper authorization and need.
- D. Incorrect.
Incorrect. Blocking Internet access for the entire finance department is overly broad and disruptive. While network restrictions can be part of containment, this action would impact business operations and does not specifically address whether the employee is exfiltrating data via USB, cloud sync, personal email, or other approved channels. It is a common but inefficient overreaction when targeted monitoring and evidence collection are more appropriate initially.