GCFA · Question #13
Mark works as a security manager for SofTech Inc. He is using a technique for monitoring what the employees are doing with corporate resources. Which of the following techniques is being used by Mark
The correct answer is A. Electronic surveillance. Mark is using electronic surveillance to monitor employee email communications for evidence of data exfiltration. This technique involves the interception and review of electronic data transmissions.
Question
Mark works as a security manager for SofTech Inc. He is using a technique for monitoring what the employees are doing with corporate resources. Which of the following techniques is being used by Mark to gather evidence of an ongoing computer crime if a member of the staff is e-mailing company's secrets to an opponent?
Options
- AElectronic surveillance
- BCivil investigation
- CPhysical surveillance
- DCriminal investigation
How the community answered
(21 responses)- A76% (16)
- B14% (3)
- C5% (1)
- D5% (1)
Why each option
Mark is using electronic surveillance to monitor employee email communications for evidence of data exfiltration. This technique involves the interception and review of electronic data transmissions.
Electronic surveillance refers to the monitoring of electronic communications such as email, instant messages, and network traffic to detect unauthorized activity. Because Mark is specifically watching email traffic to gather evidence of company secrets being sent externally, this fits the definition of electronic surveillance. It is a recognized security management technique used to detect insider threats and gather digital forensic evidence.
Civil investigation is a formal legal proceeding initiated after a dispute or wrongdoing is suspected, not a real-time monitoring technique used by a security manager.
Physical surveillance involves visually or physically observing a person in the real world, such as using cameras or in-person observation, not monitoring electronic communications.
Criminal investigation is a law enforcement process conducted after a crime is reported or suspected, not a proactive monitoring technique performed by an internal security manager.
Concept tested: Electronic surveillance for insider threat detection
Source: https://csrc.nist.gov/publications/detail/sp/800-137/final
Topics
Community Discussion
No community discussion yet for this question.