CompTIA Security+ Exam SY0-601: Data Compromise Investigation and Mitigation

Data Compromise Investigation and Mitigation

Prev Question Next Question

Question

A company is investigating a data compromise where data exfiltration occurred.

Prior to the investigation, the supervisor terminates an employee as a result of the suspected data loss.

During the investigation, the supervisor is absent for the interview, and little evidence can be provided form the role-based authentication system in use by the company.

The situation can be identified for future mitigation as which of the following?

Answers

A. Job rotation

B. Log failure

C. Lack of training

D. Insider threat.

Show Answer

Explanations

Click on the arrows to vote for the correct answer

A. B. C. D.

The situation described in the question can be identified as an Insider threat (Option D).

Insider threat refers to the potential risk posed to an organization's security by its employees, contractors, or vendors who have access to sensitive information, systems, or facilities. An insider threat can be intentional or unintentional, and it can result in data breaches, data exfiltration, intellectual property theft, or other security incidents.

In the scenario described, the terminated employee is suspected of being involved in the data compromise, indicating an intentional insider threat. Additionally, the absence of the supervisor during the investigation and the lack of evidence from the role-based authentication system indicate a lack of oversight and controls, making it easier for an insider to carry out malicious activities.

To mitigate insider threats, organizations can implement various measures, such as access controls, monitoring and auditing, security awareness training, and incident response planning. Job rotation, log failure, and lack of training may be contributing factors to insider threats, but they are not the primary cause of the situation described in the question.

Prev Question Next Question