Certified Incident Handler (ECIH v3) — Question 19

Which of the following is NOT one of the common techniques used to detect Insider threats:

Answer options

• A. Spotting an increase in their performance
• B. Observing employee tardiness and unexplained absenteeism
• C. Observing employee sick leaves
• D. Spotting conflicts with supervisors and coworkers

Correct answer: A

Explanation

The correct answer is A because an increase in performance does not typically indicate an insider threat and could be a sign of positive employee engagement. Options B, C, and D are all behaviors that can raise red flags for potential insider threats, as they may indicate underlying issues that could lead to malicious actions.