2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A UEBA alert flags a user who has been sending large amounts of data to an external cloud storage service. The user's manager confirms the user is working on a project that requires sharing files with an external partner. The user has never used this service before. What is the best response?

   • AVerify the external partner's identity and the user's authorization before allowing the activity.
   • BBlock the cloud storage service immediately to prevent data exfiltration.
   • CIgnore the alert because the manager confirmed the activity is legitimate.
   • DAllow the activity but add the cloud storage service to the user's baseline for future reference.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which scenario best illustrates the role of UEBA in detecting an anomaly?

   • AA user logs in from a new geographic location at an unusual time and accesses a large volume of sensitive files
   • BA network administrator manually reviews firewall logs to identify misconfigurations
   • CAn antivirus program quarantines a file that matches a known malware hash
   • DA firewall blocks a known malicious IP address based on a signature match
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A UEBA implementation uses a baseline of each user's typical number of logins per day. A user who normally logs in 5 times per day suddenly logs in 50 times in one hour. The UEBA system generates an alert with a high risk score. Which anomaly detection technique is most likely being used?

   • AStatistical deviation from the user's historical average.
   • BSignature-based detection matching known brute-force patterns.
   • CClustering analysis grouping all users by login frequency.
   • DSupervised machine learning trained on labeled malicious login data.
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team is evaluating UEBA techniques to detect slow and low data exfiltration. The team has six months of SIEM data and wants to minimize false positives while detecting gradual increases in data transfer volume. Which technique is most appropriate?

   • AA simple threshold rule that flags any transfer above a fixed size.
   • BA rule that flags any transfer to a cloud storage provider.
   • CA signature-based detection system that matches known exfiltration patterns.
   • DA statistical model that tracks the moving average and standard deviation of transfer volume per user over time.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which type of SIEM data is most commonly used by UEBA to analyze user activity patterns?

   • AAuthentication and access logs
   • BVulnerability scan reports
   • CNetwork flow records only
   • DConfiguration management database (CMDB) data
   Reveal Solution Discussion Select an answer first