An organization is investigating unexplained access to sensitive files over a prolonged period. Explain why data theft or an advanced persistent threat may be relevant, and identify evidence-supported response planning concerns.

### The concept The scenario suggests possible data theft because sensitive stored information may have been taken. The prolonged period of unexplained access also resembles an advanced persistent threat (APT), which allows a threat actor to remain on a network without being identified and may enable monitoring and theft. The organization should not assume the exact cause from duration alone. Its response plan should provide for monitoring, documenting and analyzing observations, deciding whether to activate the plan, containing a confirmed threat, and preserving evidence for analysis. Recovery and improvement activities should be guided by what the investigation establishes. ### What a good answer covers - Explains why stored information and possible unauthorized access suggest data theft. - Connects prolonged, undetected network access with an APT. - Avoids treating the scenario as proof of a specific cause. - Identifies monitoring, activation decisions, containment, evidence preservation, and recovery planning. ### Terms - **Advanced persistent threat (APT)**: Prolonged, undetected network access that can enable monitoring and data theft. - **Sensitive information**: Data that requires protection because exposure could harm the organization or people. ### Remember Prolonged unexplained access raises concern for persistent intrusion, but investigation is needed to establish what occurred.