2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is an example of a SIEM data source that can feed UEBA analytics?

   • AA list of approved software versions
   • BA business impact analysis report
   • CNetFlow records showing communication patterns between hosts
   • DAn organizational chart
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A SOC analyst is investigating a UEBA alert for a user with a risk score of 90. The alert indicates the user accessed a sensitive database and then attempted to disable security logging. The analyst checks the SIEM and finds that the user's account is a service account used by an application. The application is known to occasionally perform maintenance tasks that involve database access and logging changes. What should the analyst do?

   • AClose the alert as a false positive because the service account is known to perform maintenance.
   • BIncrease the UEBA risk score threshold for service accounts to reduce future alerts.
   • CCorrelate the alert with application logs to confirm the maintenance task was scheduled and executed by the application.
   • DDisable the service account immediately to prevent further damage.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company is deploying UEBA and has two years of historical SIEM data. The UEBA administrator is deciding how to build the baseline. The company has seasonal business cycles and employees who work different shifts. Which approach will produce the most accurate baseline?

   • AUse a static baseline that does not change over time.
   • BUse the entire two years of data to build a single baseline for each user.
   • CBuild multiple baselines that account for time of day, day of week, and seasonal patterns.
   • DUse the most recent 30 days of data to build a baseline that reflects current behavior.
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How should a security analyst use UEBA risk scores when triaging alerts?

   • APrioritize investigation of alerts with higher risk scores
   • BUse risk scores only for compliance reporting
   • CTreat all risk scores as equally important
   • DIgnore alerts with low risk scores entirely
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A UEBA alert flags a user for downloading a large amount of data from a database. The analyst checks the SIEM and finds that the user's account was used to log in from an IP address that is on the threat intelligence blocklist. What should the analyst do next?

   • AClose the alert because the download may be part of the user's job.
   • BAdd the IP to the allowlist to reduce false positives.
   • CDisable the user's account and initiate incident response procedures.
   • DContact the user to confirm whether they initiated the download.
   Reveal Solution Discussion Select an answer first