2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A UEBA alert indicates that a user's account is performing administrative actions outside of business hours, which is unusual for that user. The analyst verifies that the user is on vacation and has no scheduled tasks. What is the most appropriate immediate response?

   • ASend an email to the user to ask if they are performing the actions.
   • BIgnore the alert because the user is on vacation and cannot be performing actions.
   • CDisable the user's account and escalate to the incident response team.
   • DWait until the user returns from vacation to confirm the activity.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company has a SIEM with UEBA. The UEBA baseline for a user is built from the last 90 days of authentication logs. The user normally logs in from the office between 8 AM and 6 PM. The company recently implemented a work-from-home policy, and the user now logs in from home at various times. The UEBA system is generating a high number of alerts for this user. The SOC team wants to reduce false positives without losing detection capability. What should they do?

   • ADisable UEBA for this user because the work-from-home policy is legitimate.
   • BUpdate the user's baseline to include the new work-from-home behavior.
   • CIncrease the risk score threshold globally to reduce the number of alerts.
   • DCreate a static rule to allow logins from the user's home IP address.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A UEBA alert fires for a finance user who has never accessed the HR file share before. The alert shows the user copied 500 files from the HR share to a USB drive. The user's manager confirms the user recently transferred to the HR department. Which action should the analyst take first?

   • AClose the alert as a false positive because the user's role change explains the behavior.
   • BCorrelate the alert with the user's HR transfer date and any other data-loss prevention (DLP) events before deciding.
   • CImmediately disable the user's account to prevent further data loss.
   • DEscalate the alert to the incident response team as a confirmed data breach.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which machine learning approach is often used by UEBA to detect anomalies without labeled data?

   • ADeep packet inspection
   • BReinforcement learning
   • CSupervised learning with labeled attack data
   • DUnsupervised learning
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC analyst is reviewing three UEBA alerts with the following risk scores and context: Alert 1: score 95, user downloaded 10 GB from a file share (user is a data scientist). Alert 2: score 80, user logged in from a new country and then accessed a finance system (user is in sales). Alert 3: score 75, user accessed a server at 2 AM (user is an IT admin who has on-call duties). The SOC has time to investigate only one alert. Which alert should be investigated first?

   • AAlert 3, because the IT admin's on-call duties make the 2 AM access suspicious.
   • BAll alerts equally, because risk scores are the only factor.
   • CAlert 1, because the risk score is the highest.
   • DAlert 2, because the new-country login and access to finance systems indicate a possible account takeover.
   Reveal Solution Discussion Select an answer first