2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which response action is most appropriate for a UEBA alert that indicates a user is performing data exfiltration?

   • AReboot the user's computer
   • BIsolate the affected endpoint and block the user's access to sensitive data
   • CUpgrade the user's account to administrator
   • DIgnore the alert because the user has legitimate access
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team is implementing UEBA to detect lateral movement. Which combination of SIEM data sources would provide the most complete view of user and entity behavior for this use case?

   • AAuthentication logs and endpoint logs
   • BFirewall logs and DNS logs only
   • CNetFlow data and web proxy logs
   • DVulnerability scan results and patch logs
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does UEBA typically establish a baseline of normal behavior for a user?

   • ABy applying a fixed set of rules defined by security analysts
   • BBy comparing the user's behavior to industry-standard benchmarks
   • CBy using real-time data only, without historical context
   • DBy analyzing historical SIEM data over a period of time to learn typical patterns
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security operations center (SOC) analyst notices that the UEBA module in their SIEM is flagging a high number of alerts for a user who regularly works late and accesses the HR system. The user's behavior has not changed, but the alerts started after the SIEM was reconfigured to ingest data from a new cloud-based file-sharing service. What is the most likely reason for the increase in alerts?

   • AThe SIEM's anomaly detection algorithm is now using a different statistical model that is more sensitive to late-night activity.
   • BThe file-sharing service logs are being ingested with incorrect timestamps, causing the user's activity to appear at unusual times.
   • CThe user's account was compromised and the attacker is using the file-sharing service to exfiltrate data.
   • DThe UEBA baseline was built from a period that did not include the new data source, so the user's normal late-night activity now appears anomalous.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A UEBA system uses a statistical model to detect anomalies in user login frequency. The model is trained on the last 30 days of data. A user who normally logs in 5 times per day suddenly logs in 20 times in one hour. The system generates an alert, but the SOC team finds that the user was resetting passwords for multiple accounts as part of a legitimate IT task. The team wants to prevent similar false positives in the future without losing the ability to detect genuine brute-force attacks. What should they do?

   • ACreate a static rule to allow 20 logins per hour for any user.
   • BIncrease the anomaly threshold for all users to reduce false positives.
   • CAdd the user's IT task to the baseline by excluding password reset activities from the login count.
   • DDisable UEBA for the user because the activity is legitimate.
   Reveal Solution Discussion Select an answer first