10 exam-style questions with answers and explanations, straight from our 1,030-question bank. Tap an answer to check yourself. When you're ready, take the scored version in the free practice test.
The CCITP-A exam has 86 questions and runs 2 hours 15 minutes.
These 10 free CCITP-A questions are organized by exam domain, so you can see how each part of the Certified Counter-Insider Threat Professional - Analysis blueprint is tested. Reveal the answer and explanation under each question.
HR receives a request to verify whether a federal employee's overnight logins match an approved schedule change. The requesting analyst works for the same agency and is authorized to obtain scheduling information for this review. The personnel record also contains unrelated family medical details. For this request, HR should provide:
Correct answer: A - The effective dates and approved working hours, excluding the unrelated medical details.
The facility security officer of a cleared contractor telephones the nearest FBI field office about information indicating possible espionage at the facility. The FBI says it will take no investigative action at present. Under 32 CFR 117.8(b), what reporting work remains?
Correct answer: C - Follow up with the FBI in writing, promptly notify the cognizant security agency, and provide that agency a copy.
After a reorganization doubles a scientist's workload, the scientist becomes terse in meetings and misses two administrative deadlines. Classified project milestones remain on schedule, and there are no reported threats or access violations. An assessment note attributes the change to a hostile personality without considering workload or role disruption. The reasoning most directly illustrates:
Correct answer: B - Fundamental attribution error: favoring a dispositional explanation over relevant situational factors.
A referral packet alleges that an employee copied designs to a personal drive. HR forwards a manager's email; the manager cites a security ticket; the ticket quotes an anonymous hotline report. Separately, an authenticated endpoint record shows that a removable drive was connected, but it contains no file-operation data. How much independent support does the packet provide for the alleged copying?
Correct answer: B - One allegation stream, plus independent evidence of a drive connection rather than of copying.
Responders have contained a workstation associated with unauthorized record changes. It remains powered on, and no continuing destructive activity is detected. An authorized forensic responder is present; the approved collection plan includes memory and live-session evidence needed to resolve who controlled the account. A supervisor proposes powering it off immediately to protect the evidence. The collection priority is to:
Correct answer: D - Have the responder preserve the required volatile data before carrying out the planned shutdown.
An engineer's final week triggers an alert for a 46 GB export at 22:15. The analyst authenticates a handover approval covering the exact files, destination, and time. Protected transfer logs and the receiving system's records match that approval. No deviations or other concerns remain. A manager proposes suspending access because the engineer is leaving. What disposition does the completed review support?
Correct answer: C - Close the alert as authorized activity, retain the supporting evidence, and continue the scheduled offboarding process.
During a competing-hypotheses review, analysts examine how a document reached an unauthorized external account. An intact gateway audit shows that an employee's email attempt was blocked before any document content left. Independent service records establish that the external copy arrived through a separate cloud-upload session. The person controlling that session is still unknown. Which explanation is most directly contradicted?
Correct answer: A - The external copy arrived through the blocked email transmission.
A held-out evaluation contains 2,000 file-transfer events. Independent review identifies 40 policy violations. A data loss prevention rule flags 180 events, including 30 of those violations. A manager argues, 'It catches 75% of violations, so about three quarters of its alerts establish a violation.' Which response correctly addresses the manager's inference?
Correct answer: D - About 17% of alerts represent violations; alert status alone is insufficient to classify the remaining flagged events.
Leadership has accepted that repeated access exceptions reflect an organized insider effort. Before issuing the assessment, the lead analyst assigns a colleague to build the strongest evidence-based challenge to that single prevailing judgment, expose weak assumptions, and identify overlooked contrary evidence. What is this assignment?
Correct answer: C - Devil's advocacy
A design review finds that one administrator can create a supplier payment, approve that same payment, and alter the only audit record of both actions. The administrator needs to retain payment-entry duties. Which redesign directly addresses both the unchecked transaction and the ability to conceal it?
Correct answer: A - Enforce separate payment-approval permissions and protect audit records under independent administration.
The full bank has 1,020 more CCITP-A questions with explanations.
Continue in the free practice test →
View plans