Free CICP - Certified Insider Threat Professional Exam Questions and Answers

In the MICE model of motivations for insider betrayal, what does the letter C represent?

• AA. Compliance
• BB. Collusion
• CC. Coercion
• DD. Curiosity

Which security principle requires that no single individual be able to complete all steps of a critical process alone?

• AA. Data minimization
• BB. Need to know
• CC. Defense in depth
• DD. Separation of duties

What does the principle of least privilege require?

• AA. Access rights must be removed after a fixed period of 90 days
• BB. Privileged accounts must be reviewed by the user's supervisor each year
• CC. Users must be given only the access needed to perform their current duties
• DD. Users must be granted access to all systems within their department

Which description BEST fits a negligent insider?

• AA. An employee who sells customer lists to a competitor for personal profit
• BB. An employee who has been coerced by an outside party into providing network credentials
• CC. An employee who exposes sensitive data through carelessness, with no intent to cause harm
• DD. An employee who plants malicious code to disrupt systems after a demotion

An accounts payable clerk transferred to the procurement team eight months ago and can still approve payroll adjustments in the finance system. Which control would have MOST directly prevented this situation?

• AA. Access recertification triggered by the change in job role
• BB. Quarterly security awareness training for all finance staff
• CC. Session timeouts on the payroll approval screens
• DD. A DLP rule blocking payroll exports to removable media

An employee leaves an unencrypted laptop containing customer records on a train. Which type of insider risk does this represent?

• AA. Malicious insider
• BB. Compromised insider
• CC. Collusive insider
• DD. Negligent insider

An insider threat analyst receives a referral stating that a procurement officer has been working unusual hours and recently emailed vendor price lists to a personal address. The officer has no prior incidents on record. What should the analyst do NEXT?

• AA. Interview the officer to ask why the files were sent
• BB. Place the officer on administrative leave pending a hearing
• CC. Close the referral because the officer has no prior incidents
• DD. Correlate the email activity with authorized HR and access records

A software engineer with commit access to the company's main source code repository gives two weeks' notice and says she is joining a direct competitor. No policy violations have been reported. What should the insider threat program do FIRST?

• AA. Remind her of her nondisclosure agreement during the exit interview
• BB. Review her recent repository and file-transfer activity with HR and legal
• CC. Ask her manager to certify that no proprietary code has been copied
• DD. Disable all of her accounts and escort her from the building

An analyst notices that a billing clerk copied 3.2 GB of files to a removable drive on Friday afternoon. Before escalating, the analyst wants to decide whether the transfer is anomalous. Against which baseline should the transfer be compared?

• AA. The storage capacity of the removable drive
• BB. The organization-wide transfer total for that Friday
• CC. The department's fixed data-loss alert threshold
• DD. The clerk's past transfers and those of billing peers

A database administrator performs maintenance using a shared privileged account that has unrestricted access to a customer records database. The insider threat program wants each privileged action to be attributable to a named person and wants less standing privilege, without interrupting routine maintenance. Which control BEST meets this goal?

• AA. Annual signed acknowledgment of the acceptable use policy
• BB. Privileged access management with just-in-time elevation
• CC. Quarterly rotation of the shared account password
• DD. Network segmentation that isolates the database server