A database administrator was demoted last week after a heated HR meeting. Logs now show his still-valid credentials deleting backup jobs and storage snapshots after hours from his own workstation. No ticket requested the deletions and there are no external connections. Which threat actor and motivation best fit?

Insiders are threat actors with authorized access, and their motivations range from financial gain to revenge. The scenario combines a recent grievance, actions taken with the employee's own valid credentials from his own workstation, the absence of any change request, and destructive targeting of backups, which removes the organization's ability to recover. That pattern matches a malicious insider motivated by revenge. An accidental insider makes an error while trying to do legitimate work; deletions with no ticket, after hours, immediately following a demotion, and aimed specifically at recovery assets do not fit an honest mistake. An external attacker using stolen credentials would usually connect from outside, and an extortion motive would come with a ransom demand, but there are no external connections and no demand. A competitor seeks intellectual property or advantage, and deleting backups gives a competitor nothing to take away. Exam caveat: insider cases are confirmed by investigation, so the exam answer reflects the best fit to the indicators rather than a legal conclusion. Operational check: disable the account immediately, preserve the logs and workstation as evidence, restore backup configuration from offline copies, and review why a demotion did not trigger an access review.