2.20 Analyze Anomalous User and Entity Behavior (UEBA) Using SIEM Data 350-201 Practice Questions (Page 9)

Questions 41–42

1. 41application · medium

   A SOC analyst reviews a UEBA alert for a finance user who has a risk score of 85 (scale 0-100). The alert indicates the user accessed 15 GB of data from a file share at 2:00 AM, which is unusual for this user. The analyst checks the SIEM and finds that the user's account was used to authenticate from an IP address known to be associated with a previous malware infection. What should the analyst do first?

   • ADisable the user's account immediately to prevent further data access.
   • BIgnore the alert because the user is in finance and may have legitimate reasons to access data at night.
   • CIncrease the risk score threshold to reduce future false positives.
   • DCorrelate the UEBA alert with authentication logs and endpoint detection and response (EDR) data to confirm the activity.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A SIEM administrator wants to configure UEBA to detect a user who suddenly starts accessing systems at 3:00 AM when they normally work 9 AM to 5 PM. The administrator has six months of authentication logs and wants to minimize false positives. Which approach should the administrator choose?

   • AUse a statistical model that compares the user's current access time against a baseline of their historical access times.
   • BUse a signature-based detection rule that matches known malware command-and-control patterns.
   • CSet a static rule that alerts on any access outside 9 AM to 5 PM.
   • DApply a machine learning model trained on all users' access times to flag any user who accesses at 3:00 AM.
   Reveal Solution Discussion Select an answer first