2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A UEBA alert flags a user for sending a large number of emails with attachments to external addresses. The analyst investigates and finds that the user is a marketing manager who regularly sends campaign emails. However, the volume is three times higher than the user's normal pattern. The user's manager confirms the user is running a new campaign. What is the most appropriate response?

   • AClose the alert because the manager confirmed the campaign is legitimate.
   • BUpdate the UEBA baseline to reflect the new campaign volume and close the alert.
   • CCorrelate the alert with email gateway logs to verify the recipients and attachment types match the campaign, then decide.
   • DDisable the user's account because the volume is anomalous.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A UEBA alert flags a user who has downloaded a large amount of data from a database and then attempted to access another database that is not part of their normal job function. The user's manager confirms the user is on a temporary project that requires cross-database access. What is the most appropriate response?

   • AIncrease the user's risk score threshold so future alerts are suppressed.
   • BUpdate the user's UEBA baseline to include the temporary project activity and close the alert with a note.
   • CClose the alert as a false positive and take no further action.
   • DDisable the user's account and escalate to incident response.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A SIEM administrator is planning to deploy UEBA and wants to ensure the analytics can detect anomalies in user behavior such as unusual login times and data access patterns. Which combination of data sources should the administrator prioritize for ingestion?

   • ADNS logs, NetFlow, and web proxy logs.
   • BAuthentication logs, VPN logs, and file access logs.
   • CFirewall logs, IDS alerts, and vulnerability scan results.
   • DSystem event logs, patch management logs, and configuration change logs.
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   Which of the following is a common statistical technique used by UEBA to detect anomalies?

   • APacket signature matching
   • BHash comparison
   • CStandard deviation analysis
   • DPort scanning
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   After confirming a UEBA alert indicates a compromised account, what is an appropriate immediate response action?

   • ASend an email to the user asking if they were active
   • BDisable the user account and force a password reset
   • CWait for additional alerts before taking action
   • DIncrease the user's permissions to monitor their activity
   Reveal Solution Discussion Select an answer first