nerdexam
GIAC

GCFA · Question #13

Mark works as a security manager for SofTech Inc. He is using a technique for monitoring what the employees are doing with corporate resources. Which of the following techniques is being used by Mark

The correct answer is A. Electronic surveillance. Mark is using electronic surveillance to monitor employee email communications for evidence of data exfiltration. This technique involves the interception and review of electronic data transmissions.

Advanced Incident Response & Digital Forensics Fundamentals

Question

Mark works as a security manager for SofTech Inc. He is using a technique for monitoring what the employees are doing with corporate resources. Which of the following techniques is being used by Mark to gather evidence of an ongoing computer crime if a member of the staff is e-mailing company's secrets to an opponent?

Options

  • AElectronic surveillance
  • BCivil investigation
  • CPhysical surveillance
  • DCriminal investigation

How the community answered

(21 responses)
  • A
    76% (16)
  • B
    14% (3)
  • C
    5% (1)
  • D
    5% (1)

Why each option

Mark is using electronic surveillance to monitor employee email communications for evidence of data exfiltration. This technique involves the interception and review of electronic data transmissions.

AElectronic surveillanceCorrect

Electronic surveillance refers to the monitoring of electronic communications such as email, instant messages, and network traffic to detect unauthorized activity. Because Mark is specifically watching email traffic to gather evidence of company secrets being sent externally, this fits the definition of electronic surveillance. It is a recognized security management technique used to detect insider threats and gather digital forensic evidence.

BCivil investigation

Civil investigation is a formal legal proceeding initiated after a dispute or wrongdoing is suspected, not a real-time monitoring technique used by a security manager.

CPhysical surveillance

Physical surveillance involves visually or physically observing a person in the real world, such as using cameras or in-person observation, not monitoring electronic communications.

DCriminal investigation

Criminal investigation is a law enforcement process conducted after a crime is reported or suspected, not a proactive monitoring technique performed by an internal security manager.

Concept tested: Electronic surveillance for insider threat detection

Source: https://csrc.nist.gov/publications/detail/sp/800-137/final

Topics

#electronic surveillance#corporate investigation#email monitoring#evidence gathering

Community Discussion

No community discussion yet for this question.

Full GCFA Practice