Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration?

Insider threat actors often use unidentified removable devices (like USB drives) for data exfiltration because these devices are small, easily concealed, and can bypass many network security controls designed to detect external threats. They allow for direct copying of sensitive data without leaving extensive network logs that might trigger alerts. Default network device credentials are a vulnerability, but primarily for unauthorized access to systems, not direct data exfiltration by an insider. Spear phishing emails and impersonation through typosquatting are external threat vectors, used by outsiders to gain initial access or credentials, not by insiders for exfiltration.