Study. uk . com
  1. Home
  2. All questions
  3. Question 431

CompTIA Security+ study material · question 431 of 611

Why does the ATT&CK Initial Access tactic have limited relevance to an insider threat?

  1. Insider activity is out of scope for ATT&CK
  2. The insider already holds legitimate access, so no initial access technique is needed
  3. Insiders operate only from outside the network
  4. Insiders always use stolen credentials
Show the answer

Answer: B. The insider already holds legitimate access, so no initial access technique is needed

Detection has to focus on unusual use of legitimate access rather than on an intrusion event.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 › Appendix D, Threat Sources

Challenge yourself on this topic → Study as cards