Free CCITP-F Practice Questions

Question 1

An engineer's file-transfer alert fires after a move to the migration team. The project owner confirms that the destination, file set, and transfer window were approved. Endpoint and network records match that approval, and the volume increase is the alert's only trigger. How should this alert be resolved?

Accepted Answer

Close it as authorized activity, retaining the records that support the disposition.

Answer

Suspend the engineer's access until an interview rules out a hostile motive.

Answer

Keep it open until transfer volume returns to the engineer's former baseline.

Answer

Close it as a sensor fault and exclude migration-team transfers from the rule.

Question 2

A federal insider threat analyst requests an employee's reassignment dates from the agency's personnel system. The analyst is an employee of the same agency and needs the dates for an authorized duty. The Privacy Act applies, and no other restriction bars disclosure. HR objects because the employee has not consented. Which response correctly applies 5 U.S.C. 552a(b)(1)?

Accepted Answer

The dates may be disclosed because the analyst needs them to perform assigned agency duties.

Answer

Written consent from the employee is required before HR releases any dates from the personnel record.

Answer

A published routine use must first authorize the investigative disclosure.

Answer

A sharing agreement between the offices permits release of the employee's complete personnel file.

Question 3

'Three independent sources corroborate that a technician photographed a restricted drawing,' states a referral. Its sources are a supervisor's email, HR's forwarding of that email, and a security memorandum quoting the forwarded email. No additional observations were collected. The referral's evidentiary claim fails because:

Accepted Answer

It counts derivative reports of one originating allegation as independent corroboration.

Answer

It relies on a supervisor rather than a trained investigator as the originating source.

Answer

It fails to assign different credibility ratings to HR and security before comparing their reports.

Answer

It treats an allegation as usable information before a disciplinary finding has substantiated it.

Question 4

What should the hub recommend when an employee's request for counseling and financial-assistance resources after a poor performance review is the sole basis for a proposed elevated insider threat designation? The supervisor reports no threats, safeguard violations, or changes in work behavior.

Accepted Answer

Facilitate appropriate support without elevating threat concern solely because the employee seeks counseling.

Answer

Classify the case as elevated concern pending a clinical risk assessment.

Answer

Obtain treatment details to determine whether the employee's reported difficulties are genuine.

Answer

Expand user monitoring until counseling demonstrates that the workplace stressor has resolved.

Question 5

An independent evaluation finds 18 unauthorized transfers that triggered alerts, 102 authorized transfers that triggered alerts, and 12 unauthorized transfers that were missed. A briefing calls 60% of the alerts confirmed unauthorized transfers. Which correction belongs in the briefing?

Accepted Answer

15% of alerts identified unauthorized transfers; 60% is sensitivity, not alert precision.

Answer

60% is correct because the relevant denominator is the 30 actual unauthorized transfers.

Answer

40% is correct because the 12 missed transfers account for the detector's incorrect alerts.

Answer

85% is correct because the 102 authorized transfers determine the detector's positive yield.

Question 6

An employee reports that an overseas contact offered payment for classified program information and asked that the exchange be concealed. The employee preserved the messages and reports making no disclosure. The insider threat hub has no investigative authority. Which assignment respects the participating organizations' roles?

Accepted Answer

Refer the approach to counterintelligence; the hub integrates relevant, authorized security and personnel information.

Answer

Have cybersecurity confirm that a transfer occurred before sending the contact report to counterintelligence.

Answer

Have the hub interview the contact to establish the purpose of the request before seeking investigative support.

Answer

Refer first to HR for an outside-employment determination, then involve counterintelligence if a conflict is substantiated.

Question 7

An unauthorized upload used a researcher's valid account. Two explanations remain: the researcher operated the account, or another person used compromised credentials. The upload time, destination, and file list are already verified. Which additional collection would best help distinguish those explanations?

Accepted Answer

Endpoint and session records showing the activity that initiated the upload.

Answer

Additional network-flow records confirming the upload's volume and destination.

Answer

The researcher's approved project authorizations for the files already identified in the upload.

Answer

The classification records establishing the sensitivity of the files that were uploaded.

Question 8

At 14:05, a worker tells the hub that a colleague sent a message saying he is coming to the office that afternoon to shoot his supervisor. A security officer independently reports that the colleague is approaching the occupied building with a visible firearm. The analyst is in a secure location, and emergency responders have not been notified. What takes precedence?

Accepted Answer

Notify emergency responders now and activate the site's protective procedures.

Answer

Complete a rapid behavioral assessment so responders receive a documented threat classification.

Answer

Ask HR to arrange a mediated conversation before deciding whether emergency procedures are needed.

Answer

Disable the colleague's badge and await confirmation that entry is blocked before contacting responders.

Question 9

Account disabled: June 8, 23:50 (UTC-4).
Successful authentication: June 9, 03:35 UTC.
Alert received: June 9, 04:10 UTC.
Both source clocks are accurate. What does this chronology establish about an allegation that the recorded authentication succeeded after disablement?

Accepted Answer

Authentication occurred 15 minutes before disablement; delayed alert delivery does not establish a post-disable login.

Answer

Authentication occurred 3 hours 45 minutes after disablement, showing that the account remained usable.

Answer

Authentication occurred 20 minutes after disablement, showing that the account remained usable.

Answer

Authentication occurred 4 hours 15 minutes before disablement, so the event predates the revocation.

Question 10

A cleared contractor accidentally sends a classified file through an approved system to a recipient who lacks authorized access, then immediately reports the error. No harmful intent is found. How does the National Insider Threat Policy apply to this incident?

Accepted Answer

The incident remains within insider threat scope because authorized access can cause harm unwittingly.

Answer

The recipient, rather than the sender, becomes the insider because the recipient now possesses the disclosed information.

Answer

No harmful intent was found, so the incident is outside insider threat scope.

Answer

The incident becomes an insider threat matter only if further review establishes a pattern of negligence.

Free CCITP-F Practice Questions

Domain 1: Policy and Directives 25% of exam

Question 1

Question 2

Question 3

Domain 2: Social and Behavioral Science 10% of exam

Question 4

Domain 3: Researching 30% of exam

Question 5

Question 6

Question 7

Domain 4: Synthesis & Tools and Methods 35% of exam

Question 8

Question 9

Question 10

That's 10 of 1,030