A supervisor notices a clerk emailing large case exports to a personal address at odd hours without a business need. Which awareness theme does this scenario highlight for training?

A clerk emailing large case exports to a personal address at odd hours without business need highlights anomalous or risky user behavior. Awareness programs should train staff and managers to recognize unexpected, risky, or unintentional behaviors—odd data movement, unusual hours, policy bypasses—and escalate through proper channels such as the security operations path or insider-threat program. Early recognition can stop data loss whether the cause is malice, compromise, or simple mistake.

Claiming only malware signatures matter and human behavior never indicates risk ignores insider and account-abuse patterns. Limiting anomalous behavior recognition to hardware fan noise trivializes the concept. Advising managers to ignore unexpected actions to avoid awkward conversations prioritizes comfort over resident data protection and municipal duty.

Exam caveat: Behavioral awareness and escalation—not signature-only thinking or conflict avoidance—are the tested themes for user anomalies.

Operational check: teach managers concrete examples (personal email exfiltration, mass downloads, badge anomalies), publish a no-retaliation escalation path, pair awareness with DLP/UEBA alerts where available, and ensure investigations protect privacy of the subject while preserving evidence.