An employee who is a remote user has copied financial data from the corporate server to a laptop using virtual private network (VPN) connectivity. Which of the following is the MOST important factor t

The correct answer is B. Valid use case. The central question in determining whether data leakage occurred is whether there was a legitimate business reason - a valid use case - for copying the data. If the employee had an authorized, work-related need, the action is not a leakage incident regardless of job role (A) or

Submitted by valeria.br· Apr 18, 2026Information Security Incident Management

Question

An employee who is a remote user has copied financial data from the corporate server to a laptop using virtual private network (VPN) connectivity. Which of the following is the MOST important factor to determine if it should be classified as a data leakage incident?

Options

AEmployee's job role
BValid use case
CReview of the audit logs
DOwnership of the data

How the community answered

(36 responses)

A
3% (1)
B
75% (27)
C
14% (5)
D
8% (3)

Explanation

The central question in determining whether data leakage occurred is whether there was a legitimate business reason - a valid use case - for copying the data. If the employee had an authorized, work-related need, the action is not a leakage incident regardless of job role (A) or data ownership (D). Audit logs (C) can show that the copy occurred but do not by themselves determine intent or authorization. Valid use case directly addresses whether the action was sanctioned or not.

Topics

#Data leakage#Incident classification#Acceptable use policy#Data handling

Community Discussion

No community discussion yet for this question.

Full CISM Practice