2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which SIEM data would be most useful to correlate with a UEBA alert about a user's unusual data access?

   • AAntivirus signature updates
   • BDNS zone transfer logs
   • CFile access logs and authentication logs
   • DFirewall configuration changes
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A UEBA alert flags a user for accessing a database at an unusual time and downloading a large report. The analyst investigates and finds that the user's account is used by a batch process that runs at the same time every night. The batch process was recently moved to a new server, which changed the source IP address. The analyst also notices that the user's account has never been used for any other activity. What is the most appropriate response?

   • AUpdate the UEBA baseline to exclude the batch process's IP address and close the alert.
   • BEscalate to the application owner to confirm the batch process change, then update the baseline or create an exception for the known process.
   • CIgnore the alert because the batch process is legitimate and the IP change explains the anomaly.
   • DDisable the user's account because the batch process is using a human account, which is a violation of policy.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A UEBA alert shows a risk score of 70 for a user who accessed a server that is not in their normal work pattern. The analyst reviews the SIEM and finds that the user's account was used from a VPN IP that is on a blocklist. However, the user is currently in the office and has a valid active session. The analyst also notices that the user's account has multi-factor authentication (MFA) enabled and the MFA prompt was approved at the time of the VPN login. What is the most appropriate conclusion?

   • AThe account is not compromised because MFA was used, so the alert is a false positive.
   • BThe user is lying about being in the office, and the analyst should escalate to HR.
   • CThe account is compromised because the VPN IP is blocklisted, and the MFA approval may have been social-engineered.
   • DThe alert should be closed because the user's active session proves the account is in use by the legitimate user.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A company is deploying UEBA for the first time. The SIEM has been collecting authentication and file access logs for only two weeks. The UEBA administrator is concerned that the baseline will not be accurate. What should the administrator do?

   • ADeploy UEBA immediately and accept that the baseline will improve over time.
   • BEnable UEBA but only for administrative accounts, which have more predictable behavior.
   • CUse a static rule set instead of UEBA until more data is collected.
   • DWait until at least one full business cycle (e.g., a month) of data is collected before enabling UEBA.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When investigating a UEBA alert, what is the first step an analyst should take using SIEM data?

   • ADelete the alert from the SIEM
   • BValidate the alert by correlating it with related SIEM events
   • CReboot the affected endpoint
   • DImmediately block the user's account
   Reveal Solution Discussion Select an answer first