SFPC - Security Fundamentals Professional Insider Threat Awareness Questions and Answers

Question 1

An employee with authorized access to sensitive project files is observed exhibiting several potential risk indicators.
They have recently started working unusually late hours, expressed significant dissatisfaction with management, and have been attempting to access files unrelated to their job responsibilities.
These behaviors are MOST indicative of what type of threat?

Accepted Answer

A potential malicious insider threat.

Answer

An external threat actor attempting to brute-force network access.

Answer

A negligent insider who is unintentionally violating policy.

Answer

A compromised insider whose credentials have been stolen.

Question 2

Which of the following describes an unintentional insider threat?

Accepted Answer

A contractor who clicks on a phishing email link, inadvertently installing malware on the network.

Answer

A disgruntled systems administrator who sabotages a critical server after being terminated.

Answer

An employee who sells proprietary company data to a competitor for financial gain.

Answer

A former employee who uses their still-active credentials to access and steal customer information.

Question 3

A security manager is reviewing network logs as part of the organization's insider threat program. Which of the following activities would be considered a primary technical indicator of a potential insider threat?

Accepted Answer

A large volume of data being downloaded to a removable storage device from a sensitive database.

Answer

An employee accessing their corporate email from a personal mobile device.

Answer

A user failing to log out of their workstation at the end of the workday.

Answer

Multiple employees accessing the company's public-facing website during lunch hours.

Question 4

What is the primary purpose of establishing a formal Insider Threat Program within an organization?

Accepted Answer

To deter, detect, and mitigate threats posed by individuals with authorized access to organizational resources.

Answer

To exclusively focus on preventing espionage by foreign intelligence entities.

Answer

To replace the need for traditional cybersecurity measures like firewalls and antivirus software.

Answer

To create a culture of suspicion and distrust among employees to deter collaboration.

Question 5

An employee observes a coworker using a personal smartphone to photograph documents marked 'Confidential' at their desk, a clear violation of company policy. What is the MOST appropriate immediate action for the observing employee to take?

Accepted Answer

Report the observation to their designated security manager or through the official insider threat reporting channel.

Answer

Confront the coworker directly and demand they delete the photos.

Answer

Post about the incident on an anonymous company social media forum.

Answer

Wait to see if the coworker does it again before deciding on a course of action.

Question 6

Which of the following is a key administrative control used to mitigate insider threats?

Accepted Answer

Implementing a policy of least privilege to ensure employees only have access to information required for their jobs.

Answer

Installing user and entity behavior analytics (UEBA) software on the network.

Answer

Requiring all employees to use multi-factor authentication for system access.

Answer

Deploying security cameras in all sensitive areas of the facility.