Which solutions best identify TTPs from hired insider threat actors?

CS0-003 By islever Editorial Last updated

Given a scenario, analyze indicators of potentially malicious activity Compare and contrast threat-intelligence and threat-hunting concepts

Short answer

DE Use SIEM-based user behavioral analytics and endpoint detection and response to identify the hired insider's TTPs through anomalous behavior and endpoint telemetry.

Question

A security director at a remote company is concerned about recent threat intelligence reports regarding threat actors who are hired by the company and steal intellectual property. Which of the following solutions are the best ways to identify the tactics, techniques, and procedures (TTPs) used by these threat actors? (Choose two.)
  1. Installing and configuring a data loss prevention tool
  2. Subscribing to an identity proofing service for all employees
  3. Conducting thorough background checks on all incoming employees
  4. Utilizing user behavioral analytics-based detections implemented in the security information and event management (SIEM) Correct Answer
  5. Deploying a fully featured endpoint detection and response (EDR) Correct Answer
  6. Validating identification information manually

Key Takeaways

This question tests how to detect the tactics, techniques, and procedures of an insider who is already employed; the trap is selecting pre-employment screening or DLP-only controls instead of behavioral and endpoint detection.

For a remote company facing threat actors who are hired as insiders, the best TTP identification comes from SIEM user behavioral analytics and endpoint detection and response. This page explains why UEBA and EDR (D and E) are the correct choices and why DLP, background checks, and identity proofing do not meet the TTP-identification requirement.

Common mistake: The most common wrong answer is selecting DLP because it can detect data theft; DLP is valuable for exfiltration policy violations, but it does not broadly identify an adversary's TTPs the way UEBA and EDR telemetry can.

Expert Analysis

Why the Answer Is Correct

SIEM-based user behavioral analytics (UEBA) baselines normal identity and access activity, then flags deviations such as unusual data access, off-hours collection, or privilege misuse that can map to insider TTPs. Endpoint detection and response (EDR) captures process, file, network, and user behavior on endpoints, giving investigators the telemetry needed to reconstruct techniques such as staging or archiving intellectual property. Together, D and E provide detective visibility after the person is already hired, which matches the scenario's concern about threat actors who are employed by the company. This combination supports threat hunting and TTP mapping far better than a single data-loss control.

Why the Other Options Are Wrong

A data loss prevention tool (A) can alert on sensitive data movement and exfiltration attempts, but it is focused on data policy enforcement rather than the full range of adversary tactics and techniques. Identity proofing (B), background checks (C), and manual validation of identification information (F) are pre-employment or identity-assurance controls; they cannot identify the TTPs of an insider who has already been hired and is operating inside the environment. Background checks may reduce hiring risk, but they are not continuous detection mechanisms and do not produce behavioral evidence of TTPs.

Community Comment Notes

As rocco82 noted, "Its already passed the soliciting phase" — that observation correctly focuses the scenario on post-hire detection rather than screening. However, rocco82's pairing of DLP and behavioral analysis overweights DLP for TTP identification; DLP can flag possible exfiltration, but EDR provides the deeper endpoint behavior needed to identify techniques. The better reading is to pair SIEM behavioral analytics with EDR for insider TTP visibility.

Exam Strategy

When a question asks how to identify TTPs, separate detective controls from preventive or pre-employment controls. Eliminate background checks, identity proofing, and manual identity validation because they happen before or outside active monitoring, then choose the two technologies that generate behavioral telemetry.

Frequently Asked Questions

Why is DLP not one of the two best answers for identifying insider TTPs?

DLP detects policy violations and possible data exfiltration, but it gives limited visibility into the sequence of adversary behaviors; UEBA and EDR map broader TTPs across identity and endpoint activity.

Why do background checks and identity proofing fail this scenario?

They are pre-employment or identity-assurance controls, not continuous detection tools, so they cannot identify the TTPs of an insider who is already working inside the company.

More CS0-003 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. rocco82 👍 1
    Concerned about employees/threat actors already hired. Need DLP and behavioral analysis at the SIEM. Its already passed the soliciting phase.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Mitigating New Ransomware with Sandboxing Analysis

S-grade

Identifying Network Routing Anomalies Using ASN Lookups

S-grade

Next Step After Applying a Patch: Validation vs. Testing

S-grade

Missing Data from Network Vulnerability Scans

S-grade

← Back to CS0-003 Study Guide