Certified Ethical Hacker Certification (CEHv10) Practice Test

The correct choice indicates an internal threat that arises when employees transfer sensitive information to external storage devices. This action represents a significant security risk, as employees who have access to confidential data may take it outside the organization's secure environment, leading to potential data breaches or unauthorized distribution.

When employees copy information onto external storage, they can inadvertently or maliciously expose sensitive data to external parties. This can happen through USB drives, external hard drives, or even cloud storage services that the organization doesn't officially manage or monitor. Such activities can compromise brand reputation, customer trust, and regulatory compliance, making it vital for organizations to implement strict data protection policies and monitoring to mitigate these risks.

In contrast, the other options refer to different types of threats that do not focus specifically on employees copying information onto external storage. For example, session hijacking relates to taking over a user’s session, a technique often used in online attacks. Man in the middle attacks involve intercepting communications between two parties without their knowledge, while password-based attacks typically focus on attempting to compromise user accounts through weak or stolen passwords. Each of these threats presents significant risks but does not specifically address the scenario of employees transferring data to external storage.