2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of User and Entity Behavior Analytics (UEBA) in a security operations environment?

   • ATo encrypt sensitive data at rest and in transit
   • BTo replace traditional signature-based intrusion detection systems
   • CTo automatically block all suspicious IP addresses in real time
   • DTo establish a baseline of normal behavior and identify deviations that may indicate security threats
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of establishing a baseline in UEBA?

   • ATo reduce the volume of logs stored in the SIEM
   • BTo ensure compliance with regulatory standards
   • CTo replace the need for real-time monitoring
   • DTo provide a reference point for identifying deviations that may indicate security incidents
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A UEBA alert flags a user for accessing a server that is not in their normal work pattern. The analyst checks the SIEM and finds that the user's credentials were used from a VPN IP that is associated with a known malware command-and-control (C2) server. However, the user is currently logged in from the office and denies any remote access. What is the most likely conclusion and appropriate action?

   • AThe VPN IP is a false positive, and the alert should be closed.
   • BThe user's credentials are compromised, and the account should be disabled immediately.
   • CThe user's account is fine because the user is physically in the office.
   • DThe user is lying, and the analyst should escalate to HR for disciplinary action.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A SOC team uses a SIEM with UEBA. The UEBA module assigns risk scores to alerts. The team has limited resources and must prioritize which alerts to investigate. Which approach should they use?

   • AOnly investigate alerts that involve administrative accounts.
   • BAutomatically close all alerts with a risk score below 50.
   • CInvestigate alerts with the highest risk scores first, then correlate with other SIEM data.
   • DInvestigate alerts in the order they are received, regardless of risk score.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC analyst receives a UEBA alert indicating that a user's account has an elevated risk score due to multiple failed logins followed by a successful login from a new geographic location. The analyst wants to determine whether the successful login was legitimate. Which SIEM data source should the analyst examine first?

   • AVPN logs to see if the user connected through the corporate VPN before the login.
   • BNetFlow data to see the volume of traffic from the new location.
   • CAuthentication logs to check the timestamp, source IP, and authentication method of the successful login.
   • DDNS logs to check for domain generation algorithm (DGA) queries from the user's workstation.
   Reveal Solution Discussion Select an answer first