Of the 4 statements, which apply to be part of personnel security and insider threats ;
1. Insider threats can often be addressed before malicious activity can occur
2. Measures can include checking employment history and performing background checks
3.Measures should be completed after employees are hired and given access to the organization’s IT environment and data
4. Purpose is to minimize the risk and damage potential of insider threats
Clearly #1 and #3 are wrong. Amongst #2 and #4, I would go with #4 since it is more "managerial" and #2 is quite specific?