2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A SOC analyst is investigating a UEBA alert for a user who has a risk score of 95. The alert indicates the user accessed a large number of files from a file server and then attempted to access a database. The analyst checks the SIEM and finds that the user's account was used to authenticate from an IP address that is on a threat intelligence blocklist. However, the user is currently logged in to the corporate network and has an active session. What should the analyst do?

   • ADisable the user's account immediately because the IP is blocklisted.
   • BCorrelate the UEBA alert with the user's current session and the blocklisted IP to determine if the IP is actually being used.
   • CIncrease the risk score threshold to avoid future alerts from blocklisted IPs.
   • DIgnore the blocklisted IP because the user is currently logged in to the corporate network.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A UEBA alert flags a user who has been accessing a sensitive database at unusual times and then transferring data to an external IP address. The user's manager confirms the user is working on a project that requires data transfer to a partner. The analyst checks the SIEM and finds that the external IP address is associated with a known malicious domain. What should the analyst do?

   • AIgnore the alert because the manager confirmed the activity is legitimate.
   • BUpdate the UEBA baseline to include the external IP address.
   • CBlock the data transfer to the external IP and escalate the incident.
   • DAllow the activity because the manager confirmed the project is legitimate.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What does a high UEBA risk score typically indicate?

   • AThe activity has a higher likelihood of being malicious or a security threat
   • BThe user is a high-privilege account holder
   • CThe network is under a distributed denial-of-service (DDoS) attack
   • DThe SIEM system is experiencing performance issues
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A company wants to deploy UEBA to detect insider threats. The security team has access to Active Directory logs, firewall logs, and VPN logs, but no HR data or badge-access logs. Which data source is essential for building a baseline of user behavior?

   • AVPN logs, because they are the only source that shows remote access patterns.
   • BNo data source is essential; UEBA can work with any available logs.
   • CFirewall logs, because they show all network traffic and are the most comprehensive data source.
   • DActive Directory logs, because they provide authentication and authorization events that define user activity patterns.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company is deploying UEBA and wants to minimize false positives for users who work different shifts. The SIEM has six months of authentication logs. Which approach should the analyst take to build the baseline?

   • ABuild individual baselines per user that account for time-of-day and day-of-week patterns.
   • BUse only the most recent week of data to reflect current behavior.
   • CUse a static rule that allows logins only during business hours.
   • DBuild a single baseline for all users using the full six months of data.
   Reveal Solution Discussion Select an answer first