Which solutions best identify TTPs from hired insider threat actors?
A security director at a remote company is concerned about recent threat intelligence reports regarding threat actors who are hired by the company and steal intellectual property. Which of the following solutions are the best ways to identify the tactics, techniques, and procedures (TTPs) used by these threat actors? (Choose two.)
Community Insight
This question tests how to detect the tactics, techniques, and procedures of an insider who is already employed; the trap is selecting pre-employment screening or DLP-only controls instead of behavioral and endpoint detection.
For a remote company facing threat actors who are hired as insiders, the best TTP identification comes from SIEM user behavioral analytics and endpoint detection and response. This page explains why UEBA and EDR (D and E) are the correct choices and why DLP, background checks, and identity proofing do not meet the TTP-identification requirement.
The most common wrong answer is selecting DLP because it can detect data theft; DLP is valuable for exfiltration policy violations, but it does not broadly identify an adversary's TTPs the way UEBA and EDR telemetry can.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
SIEM-based user behavioral analytics (UEBA) baselines normal identity and access activity, then flags deviations such as unusual data access, off-hours collection, or privilege misuse that can map to insider TTPs. Endpoint detection and response (EDR) captures process, file, network, and user behavior on endpoints, giving investigators the telemetry needed to reconstruct techniques such as staging or archiving intellectual property. Together, D and E provide detective visibility after the person is already hired, which matches the scenario's concern about threat actors who are employed by the company. This combination supports threat hunting and TTP mapping far better than a single data-loss control.Why the Other Options Are Wrong
A data loss prevention tool (A) can alert on sensitive data movement and exfiltration attempts, but it is focused on data policy enforcement rather than the full range of adversary tactics and techniques. Identity proofing (B), background checks (C), and manual validation of identification information (F) are pre-employment or identity-assurance controls; they cannot identify the TTPs of an insider who has already been hired and is operating inside the environment. Background checks may reduce hiring risk, but they are not continuous detection mechanisms and do not produce behavioral evidence of TTPs.Community Comment Notes
As rocco82 noted, "Its already passed the soliciting phase" — that observation correctly focuses the scenario on post-hire detection rather than screening. However, rocco82's pairing of DLP and behavioral analysis overweights DLP for TTP identification; DLP can flag possible exfiltration, but EDR provides the deeper endpoint behavior needed to identify techniques. The better reading is to pair SIEM behavioral analytics with EDR for insider TTP visibility.Exam Strategy
When a question asks how to identify TTPs, separate detective controls from preventive or pre-employment controls. Eliminate background checks, identity proofing, and manual identity validation because they happen before or outside active monitoring, then choose the two technologies that generate behavioral telemetry.
Frequently Asked Questions
Why is DLP not one of the two best answers for identifying insider TTPs?
DLP detects policy violations and possible data exfiltration, but it gives limited visibility into the sequence of adversary behaviors; UEBA and EDR map broader TTPs across identity and endpoint activity.
Why do background checks and identity proofing fail this scenario?
They are pre-employment or identity-assurance controls, not continuous detection tools, so they cannot identify the TTPs of an insider who is already working inside the company.